Analysis
-
max time kernel
90s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2022 08:07
Static task
static1
Behavioral task
behavioral1
Sample
c13d6628fbf5433e847407af849e1e77.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c13d6628fbf5433e847407af849e1e77.exe
Resource
win10v2004-20221111-en
General
-
Target
c13d6628fbf5433e847407af849e1e77.exe
-
Size
486KB
-
MD5
c13d6628fbf5433e847407af849e1e77
-
SHA1
a9f1623a24ac35e3d739df064db917ca42750d16
-
SHA256
02562a3a5be85b9ed5b6022e1e50ab3e8ded7bfe9007512fa03e8a21779078d3
-
SHA512
663f0972a3c139a693b930f8dee7cabc32a5853889f212a67fcb4c338482c7823fc39d8e56f34ed29e4c3a1cadf46c4229d372508fead40493d67a1df72eb028
-
SSDEEP
12288:ztoAXsmMsGFWGgTiwKhcQeuIbv/FeWUPa:q1mMsGF5oiVEh
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
Processes:
c13d6628fbf5433e847407af849e1e77.exepid process 3300 c13d6628fbf5433e847407af849e1e77.exe -
Drops file in Program Files directory 1 IoCs
Processes:
c13d6628fbf5433e847407af849e1e77.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\subtilisation\Untumidly14.ini c13d6628fbf5433e847407af849e1e77.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nss7509.tmp\System.dllFilesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
memory/3300-133-0x0000000003330000-0x0000000003431000-memory.dmpFilesize
1.0MB
-
memory/3300-134-0x0000000003330000-0x0000000003431000-memory.dmpFilesize
1.0MB