Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
TNT Original Invoice.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
TNT Original Invoice.scr
Resource
win10v2004-20220414-en
General
-
Target
TNT Original Invoice.scr
-
Size
48KB
-
MD5
45439e2dfdd3b1f54b4952a46b487fa4
-
SHA1
d8becaffacaf238a8abe233bff210963d0d36e1e
-
SHA256
bac78784a96599a619b48b9998c449d213cd113bda215a0b6fe11e358e336785
-
SHA512
38532b48e6e71907fbd569e4e3ee71322f019368efa1db89f39f9a7b0dd5440859c9b824f6d2f0bda4c7c63ea95547f003c3db3fd571b41ffd75fdf07ea225bf
Malware Config
Extracted
guloader
https://drive.google.com/uc?export=download&id=1gKqCSICYGIrZRanQX1uIQYJBckKa2fUb
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1728-61-0x000000000006B7DE-mapping.dmp family_guloader behavioral1/memory/1728-64-0x00000000002B0000-0x00000000003B0000-memory.dmp family_guloader -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
TNT Original Invoice.scrRegAsm.exepid process 848 TNT Original Invoice.scr 1728 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TNT Original Invoice.scrdescription pid process target process PID 848 set thread context of 1728 848 TNT Original Invoice.scr RegAsm.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
TNT Original Invoice.scrpid process 848 TNT Original Invoice.scr 848 TNT Original Invoice.scr 848 TNT Original Invoice.scr -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
TNT Original Invoice.scrpid process 848 TNT Original Invoice.scr -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
TNT Original Invoice.scrdescription pid process target process PID 848 wrote to memory of 1936 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1936 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1936 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1936 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1936 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1936 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1936 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1456 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1456 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1456 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1456 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1456 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1456 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1456 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1728 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1728 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1728 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1728 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1728 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1728 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1728 848 TNT Original Invoice.scr RegAsm.exe PID 848 wrote to memory of 1728 848 TNT Original Invoice.scr RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr" /S1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr" /S2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr" /S2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.scr" /S2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-57-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/848-58-0x0000000000290000-0x0000000000298000-memory.dmpFilesize
32KB
-
memory/848-59-0x0000000077800000-0x00000000779A9000-memory.dmpFilesize
1.7MB
-
memory/848-60-0x00000000779E0000-0x0000000077B60000-memory.dmpFilesize
1.5MB
-
memory/848-66-0x0000000000290000-0x0000000000298000-memory.dmpFilesize
32KB
-
memory/848-67-0x0000000000290000-0x0000000000298000-memory.dmpFilesize
32KB
-
memory/848-68-0x00000000779E0000-0x0000000077B60000-memory.dmpFilesize
1.5MB
-
memory/1728-61-0x000000000006B7DE-mapping.dmp
-
memory/1728-65-0x0000000077800000-0x00000000779A9000-memory.dmpFilesize
1.7MB
-
memory/1728-64-0x00000000002B0000-0x00000000003B0000-memory.dmpFilesize
1024KB