Analysis

  • max time kernel
    16s
  • max time network
    119s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    23-07-2021 23:28

General

  • Target

    b931d8035a682f8a20e7d22f2a3eb583.exe

  • Size

    204KB

  • MD5

    b931d8035a682f8a20e7d22f2a3eb583

  • SHA1

    0beed11d5ff54eaefae2409c8379472ded8fb22b

  • SHA256

    88fc32a54543077e4f66df43eb5f41c908de966d843e5cc3b55298e8a12ed3f4

  • SHA512

    2fd87cd381843a06cdfb054803bc88492b58d23a9b06be9bc2e803e85cd515ab09b8238c868c7f9112eea17deccad0e8be717610f3962b696c5542ecd006bc96

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b931d8035a682f8a20e7d22f2a3eb583.exe
    "C:\Users\Admin\AppData\Local\Temp\b931d8035a682f8a20e7d22f2a3eb583.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:992
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
    MD5

    d02d27c34545bc0b69ec291fbe5b872f

    SHA1

    5131370c2af88e34ab023026e166329971c2e6ce

    SHA256

    2c05003672f05ef6ac4a45270bd555d721d26b8b3f191b45ef07a55de60e861d

    SHA512

    0ebff991d0f312db8edbf8e021497c2df76f649edb1bbc9dab19bb0980e608ce3d5a763aa10ca3800f13ab28c11e52583ff2ccaec6bb8484a676266114bc905e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
    MD5

    d02d27c34545bc0b69ec291fbe5b872f

    SHA1

    5131370c2af88e34ab023026e166329971c2e6ce

    SHA256

    2c05003672f05ef6ac4a45270bd555d721d26b8b3f191b45ef07a55de60e861d

    SHA512

    0ebff991d0f312db8edbf8e021497c2df76f649edb1bbc9dab19bb0980e608ce3d5a763aa10ca3800f13ab28c11e52583ff2ccaec6bb8484a676266114bc905e

  • memory/1836-114-0x0000000000000000-mapping.dmp
  • memory/1836-119-0x00000000006B0000-0x00000000006DA000-memory.dmp
    Filesize

    168KB