Analysis
-
max time kernel
131s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 20:01
Static task
static1
Behavioral task
behavioral1
Sample
Rechnungen-2022.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Rechnungen-2022.exe
Resource
win10v2004-20220812-en
General
-
Target
Rechnungen-2022.exe
-
Size
616KB
-
MD5
59ac1cfddea69fa213b747faad3f0f62
-
SHA1
a7a2a21106b999828444ad16265ff339a2775f99
-
SHA256
67fc25f92a3074fe21704051a8aa72d438d5a06030cc7630db7e95953a998c90
-
SHA512
856534b24f4b0ae0a29a8ed740048b321e15593fed0cdf98bc816d04656e2b5d89042859342e52682e3817d9a9ec825fdda2c3502bc19781295fd40498aab368
-
SSDEEP
12288:lbif/mHZzu6uhuQgRN6Zuj90Z2upnDgy/HE0P3Q8x78IV7tc4NCp:Rif/mHZzutuQgHt90TnDgck0ILI1tco0
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
Processes:
Rechnungen-2022.exepid process 5040 Rechnungen-2022.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsd771B.tmp\System.dllFilesize
11KB
MD50ff2d70cfdc8095ea99ca2dabbec3cd7
SHA110c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA256982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
SHA512cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
-
memory/5040-133-0x0000000004220000-0x0000000005F9E000-memory.dmpFilesize
29.5MB
-
memory/5040-134-0x0000000004220000-0x0000000005F9E000-memory.dmpFilesize
29.5MB