Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 04:14
Static task
static1
Behavioral task
behavioral1
Sample
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe
Resource
win10v2004-en-20220113
General
-
Target
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe
-
Size
124KB
-
MD5
1a53e9230ba3bbd5969cc4499baaacdd
-
SHA1
2a55286c66012cfb09151effabac6f8d54cc3ce1
-
SHA256
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824
-
SHA512
3dd984ec282e2bd4ce4e26aa2c84548b69ef695ef761498eb40a4484a9f5be08bca851ca3d868b8b353721b65fd3252a42ebe0ad5cfc70d0591b97b580752f3d
Malware Config
Extracted
guloader
https://drive.google.com/uc?export=download&id=1usXhLD59IUljCZdD222jP2QYU-GP28tz
http://bnvtfhdfsasd.ug/Host_encrypted_F8B4CEF.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Executes dropped EXE 1 IoCs
Processes:
blokstartv.exepid process 1384 blokstartv.exe -
Loads dropped DLL 3 IoCs
Processes:
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exeblokstartv.exepid process 1924 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe 1924 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe 1836 blokstartv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exeblokstartv.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\renselsenskry = "C:\\Users\\Admin\\Gasturbineno\\blokstartv.vbs" bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce blokstartv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\renselsenskry = "C:\\Users\\Admin\\Gasturbineno\\blokstartv.vbs" blokstartv.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exebb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exeblokstartv.exeblokstartv.exepid process 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe 1924 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe 1384 blokstartv.exe 1836 blokstartv.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exeblokstartv.exedescription pid process target process PID 1204 set thread context of 1924 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe PID 1384 set thread context of 1836 1384 blokstartv.exe blokstartv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exeblokstartv.exepid process 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe 1384 blokstartv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exeblokstartv.exepid process 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe 1384 blokstartv.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exebb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exeblokstartv.exedescription pid process target process PID 1204 wrote to memory of 1924 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe PID 1204 wrote to memory of 1924 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe PID 1204 wrote to memory of 1924 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe PID 1204 wrote to memory of 1924 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe PID 1204 wrote to memory of 1924 1204 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe PID 1924 wrote to memory of 1384 1924 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe blokstartv.exe PID 1924 wrote to memory of 1384 1924 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe blokstartv.exe PID 1924 wrote to memory of 1384 1924 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe blokstartv.exe PID 1924 wrote to memory of 1384 1924 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe blokstartv.exe PID 1384 wrote to memory of 1836 1384 blokstartv.exe blokstartv.exe PID 1384 wrote to memory of 1836 1384 blokstartv.exe blokstartv.exe PID 1384 wrote to memory of 1836 1384 blokstartv.exe blokstartv.exe PID 1384 wrote to memory of 1836 1384 blokstartv.exe blokstartv.exe PID 1384 wrote to memory of 1836 1384 blokstartv.exe blokstartv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe"C:\Users\Admin\AppData\Local\Temp\bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe"C:\Users\Admin\AppData\Local\Temp\bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Gasturbineno\blokstartv.exe"C:\Users\Admin\Gasturbineno\blokstartv.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Gasturbineno\blokstartv.exe"C:\Users\Admin\Gasturbineno\blokstartv.exe"4⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Gasturbineno\blokstartv.exeMD5
1a53e9230ba3bbd5969cc4499baaacdd
SHA12a55286c66012cfb09151effabac6f8d54cc3ce1
SHA256bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824
SHA5123dd984ec282e2bd4ce4e26aa2c84548b69ef695ef761498eb40a4484a9f5be08bca851ca3d868b8b353721b65fd3252a42ebe0ad5cfc70d0591b97b580752f3d
-
C:\Users\Admin\Gasturbineno\blokstartv.exeMD5
1a53e9230ba3bbd5969cc4499baaacdd
SHA12a55286c66012cfb09151effabac6f8d54cc3ce1
SHA256bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824
SHA5123dd984ec282e2bd4ce4e26aa2c84548b69ef695ef761498eb40a4484a9f5be08bca851ca3d868b8b353721b65fd3252a42ebe0ad5cfc70d0591b97b580752f3d
-
C:\Users\Admin\Gasturbineno\blokstartv.exeMD5
1a53e9230ba3bbd5969cc4499baaacdd
SHA12a55286c66012cfb09151effabac6f8d54cc3ce1
SHA256bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824
SHA5123dd984ec282e2bd4ce4e26aa2c84548b69ef695ef761498eb40a4484a9f5be08bca851ca3d868b8b353721b65fd3252a42ebe0ad5cfc70d0591b97b580752f3d
-
\Users\Admin\Gasturbineno\blokstartv.exeMD5
1a53e9230ba3bbd5969cc4499baaacdd
SHA12a55286c66012cfb09151effabac6f8d54cc3ce1
SHA256bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824
SHA5123dd984ec282e2bd4ce4e26aa2c84548b69ef695ef761498eb40a4484a9f5be08bca851ca3d868b8b353721b65fd3252a42ebe0ad5cfc70d0591b97b580752f3d
-
\Users\Admin\Gasturbineno\blokstartv.exeMD5
1a53e9230ba3bbd5969cc4499baaacdd
SHA12a55286c66012cfb09151effabac6f8d54cc3ce1
SHA256bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824
SHA5123dd984ec282e2bd4ce4e26aa2c84548b69ef695ef761498eb40a4484a9f5be08bca851ca3d868b8b353721b65fd3252a42ebe0ad5cfc70d0591b97b580752f3d
-
memory/1204-62-0x0000000077BC0000-0x0000000077D40000-memory.dmpFilesize
1.5MB
-
memory/1204-58-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/1204-59-0x00000000779E0000-0x0000000077B89000-memory.dmpFilesize
1.7MB
-
memory/1204-57-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/1384-76-0x0000000000240000-0x000000000024A000-memory.dmpFilesize
40KB
-
memory/1384-81-0x00000000779E0000-0x0000000077B89000-memory.dmpFilesize
1.7MB
-
memory/1384-80-0x0000000077BC0000-0x0000000077D40000-memory.dmpFilesize
1.5MB
-
memory/1836-85-0x00000000001B0000-0x00000000002B0000-memory.dmpFilesize
1024KB
-
memory/1836-86-0x00000000779E0000-0x0000000077B89000-memory.dmpFilesize
1.7MB
-
memory/1836-87-0x0000000077BC0000-0x0000000077D40000-memory.dmpFilesize
1.5MB
-
memory/1924-66-0x00000000001B0000-0x0000000000380000-memory.dmpFilesize
1.8MB
-
memory/1924-60-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1924-68-0x0000000077BC0000-0x0000000077D40000-memory.dmpFilesize
1.5MB
-
memory/1924-67-0x00000000779E0000-0x0000000077B89000-memory.dmpFilesize
1.7MB