Analysis
-
max time kernel
159s -
max time network
158s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 05:37
Static task
static1
Behavioral task
behavioral1
Sample
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe
Resource
win10-en-20211208
General
-
Target
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe
-
Size
52KB
-
MD5
61ce777555ee4d591ff151e0927ab8d4
-
SHA1
3c5a6a8825101a71d2372f5c6961861ef1b4223f
-
SHA256
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923
-
SHA512
3783ae2713492347fa627e51f3def9ec0502ed5c4d0f7e5c0932f80fa93e6a951ceb5708bd6347c031e081b1f7017bf86597db34fb6655f2f748439c825bd628
Malware Config
Extracted
guloader
https://share.dmca.gripe/hUZTLm0ETh86oDEL.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Executes dropped EXE 1 IoCs
Processes:
filename1.exepid process 2460 filename1.exe -
Loads dropped DLL 1 IoCs
Processes:
filename1.exepid process 432 filename1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exefilename1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\subfolder1\\filename1.vbs" 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce filename1.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\subfolder1\\filename1.vbs" filename1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exefilename1.exefilename1.exepid process 2568 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 3732 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 2460 filename1.exe 432 filename1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exefilename1.exedescription pid process target process PID 2568 set thread context of 3732 2568 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe PID 2460 set thread context of 432 2460 filename1.exe filename1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exefilename1.exepid process 2568 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 2460 filename1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exefilename1.exepid process 2568 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 2460 filename1.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exefilename1.exedescription pid process target process PID 2568 wrote to memory of 3732 2568 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe PID 2568 wrote to memory of 3732 2568 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe PID 2568 wrote to memory of 3732 2568 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe PID 2568 wrote to memory of 3732 2568 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe PID 3732 wrote to memory of 2460 3732 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe filename1.exe PID 3732 wrote to memory of 2460 3732 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe filename1.exe PID 3732 wrote to memory of 2460 3732 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe filename1.exe PID 2460 wrote to memory of 432 2460 filename1.exe filename1.exe PID 2460 wrote to memory of 432 2460 filename1.exe filename1.exe PID 2460 wrote to memory of 432 2460 filename1.exe filename1.exe PID 2460 wrote to memory of 432 2460 filename1.exe filename1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe"C:\Users\Admin\AppData\Local\Temp\29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe"C:\Users\Admin\AppData\Local\Temp\29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\subfolder1\filename1.exe"C:\Users\Admin\subfolder1\filename1.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\subfolder1\filename1.exe"C:\Users\Admin\subfolder1\filename1.exe"4⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\subfolder1\filename1.exeMD5
61ce777555ee4d591ff151e0927ab8d4
SHA13c5a6a8825101a71d2372f5c6961861ef1b4223f
SHA25629367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923
SHA5123783ae2713492347fa627e51f3def9ec0502ed5c4d0f7e5c0932f80fa93e6a951ceb5708bd6347c031e081b1f7017bf86597db34fb6655f2f748439c825bd628
-
C:\Users\Admin\subfolder1\filename1.exeMD5
61ce777555ee4d591ff151e0927ab8d4
SHA13c5a6a8825101a71d2372f5c6961861ef1b4223f
SHA25629367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923
SHA5123783ae2713492347fa627e51f3def9ec0502ed5c4d0f7e5c0932f80fa93e6a951ceb5708bd6347c031e081b1f7017bf86597db34fb6655f2f748439c825bd628
-
C:\Users\Admin\subfolder1\filename1.exeMD5
61ce777555ee4d591ff151e0927ab8d4
SHA13c5a6a8825101a71d2372f5c6961861ef1b4223f
SHA25629367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923
SHA5123783ae2713492347fa627e51f3def9ec0502ed5c4d0f7e5c0932f80fa93e6a951ceb5708bd6347c031e081b1f7017bf86597db34fb6655f2f748439c825bd628
-
memory/432-143-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/432-142-0x00007FFE3C4D0000-0x00007FFE3C6AB000-memory.dmpFilesize
1.9MB
-
memory/432-141-0x0000000000560000-0x0000000000750000-memory.dmpFilesize
1.9MB
-
memory/2460-140-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/2460-137-0x00000000006E0000-0x00000000006E8000-memory.dmpFilesize
32KB
-
memory/2460-139-0x00007FFE3C4D0000-0x00007FFE3C6AB000-memory.dmpFilesize
1.9MB
-
memory/2568-125-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/2568-124-0x00007FFE3C4D0000-0x00007FFE3C6AB000-memory.dmpFilesize
1.9MB
-
memory/2568-123-0x00000000021A0000-0x00000000021A8000-memory.dmpFilesize
32KB
-
memory/3732-129-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/3732-128-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/3732-127-0x00007FFE3C4D0000-0x00007FFE3C6AB000-memory.dmpFilesize
1.9MB
-
memory/3732-126-0x0000000000560000-0x00000000008E0000-memory.dmpFilesize
3.5MB
-
memory/3732-120-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/3732-122-0x0000000000401000-0x00000000004FD000-memory.dmpFilesize
1008KB