Overview

overview

10

Static

static

1

Буџет...23.exe

windows7-x64

10

Буџет...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    280s
  • max time network
    257s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-02-2023 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Буџет за 2023.exe

  • Size

    553KB

  • MD5

    02d3420e0bc7ee42be3ac64bf0754a9e

  • SHA1

    d68c19a349f19faad729f5f5a5733e5b114d061c

  • SHA256

    f2d084f0a71c46d2152cefc1255135c367bc439ab35471746061a858282c6b69

  • SHA512

    84b4b45c3993bfd18d80f785b4982646a1d760c6367803e99f8fdb4e6c3cc58d38866c65d2f3b4d2e53693c705837377b848d5fd444bdd43da27e27c0292f030

  • SSDEEP

    12288:YkylifmvMhxliCymp+N8v2ocCSivrlicgwHeS:glgli7j8vcKGK

Score
10/10
guloaderdownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 20 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Буџет за 2023.exe
    "C:\Users\Admin\AppData\Local\Temp\Буџет за 2023.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Users\Admin\AppData\Local\Temp\Буџет за 2023.exe
      "C:\Users\Admin\AppData\Local\Temp\Буџет за 2023.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1468
        3⤵
        • Program crash
        PID:1356
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4024 -ip 4024
    1⤵
      PID:1252
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4328
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RedoRemove.DVR-MS"
        1⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1144

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsz6E40.tmp\System.dll
        Filesize

        11KB

        MD5

        17ed1c86bd67e78ade4712be48a7d2bd

        SHA1

        1cc9fe86d6d6030b4dae45ecddce5907991c01a0

        SHA256

        bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

        SHA512

        0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

        Download Submit
      • memory/3140-157-0x0000000077520000-0x00000000776C3000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/3140-153-0x0000000004970000-0x0000000009FA1000-memory.dmp
        Filesize

        86.2MB

        Download
      • memory/3140-154-0x00007FFFFCD10000-0x00007FFFFCF05000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/3140-155-0x0000000077520000-0x00000000776C3000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/3140-152-0x0000000004970000-0x0000000009FA1000-memory.dmp
        Filesize

        86.2MB

        Download
      • memory/3140-162-0x0000000077520000-0x00000000776C3000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/4024-156-0x0000000000000000-mapping.dmp
        Download
      • memory/4024-158-0x0000000000400000-0x0000000001654000-memory.dmp
        Filesize

        18.3MB

        Download
      • memory/4024-159-0x0000000001660000-0x0000000006C91000-memory.dmp
        Filesize

        86.2MB

        Download
      • memory/4024-160-0x00007FFFFCD10000-0x00007FFFFCF05000-memory.dmp
        Filesize

        2.0MB

        Download
      • memory/4024-161-0x0000000077520000-0x00000000776C3000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/4024-163-0x0000000001660000-0x0000000006C91000-memory.dmp
        Filesize

        86.2MB

        Download
      • memory/4024-164-0x00007FFFFCD10000-0x00007FFFFCF05000-memory.dmp
        Filesize

        2.0MB

        Download