Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2023, 15:28

General

  • Target

    Factura 1-000816pdf.exe

  • Size

    362KB

  • MD5

    f022d5f21c803c1936e2c6f28f0f9240

  • SHA1

    43e0065a86b944771992db8af0cad4ee86631aa4

  • SHA256

    22b6816c45f86b303404b94b09b852a910d4ef335c05244c4acf6450ed86572b

  • SHA512

    71996f172266f4b5ece2c2f374df618310df7f1e4e895a50337f955335dec9bea5403abf05fb96a2734184a9d121b52f11c65a244930f39d92aefb8bc61a9a2c

  • SSDEEP

    6144:/oShfEPZVheNA+ff03j2NVag8mLWUkCs3dD1A2uwxMf6rbmOuGot:QqCnhe2e4j2627kCsERwGfvdt

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Factura 1-000816pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Factura 1-000816pdf.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Users\Admin\AppData\Local\Temp\Factura 1-000816pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Factura 1-000816pdf.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3636

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsp6CD4.tmp\System.dll

          Filesize

          11KB

          MD5

          6ad39193ed20078aa1b23c33a1e48859

          SHA1

          95e70e4f47aa1689cc08afbdaef3ec323b5342fa

          SHA256

          b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2

          SHA512

          78c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b

        • memory/1608-142-0x0000000003260000-0x0000000006559000-memory.dmp

          Filesize

          51.0MB

        • memory/1608-143-0x0000000003260000-0x0000000006559000-memory.dmp

          Filesize

          51.0MB

        • memory/1608-144-0x0000000077351000-0x0000000077471000-memory.dmp

          Filesize

          1.1MB

        • memory/1608-145-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/3636-146-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3636-147-0x0000000001660000-0x0000000004959000-memory.dmp

          Filesize

          51.0MB

        • memory/3636-148-0x0000000001660000-0x0000000004959000-memory.dmp

          Filesize

          51.0MB

        • memory/3636-149-0x00000000773D8000-0x00000000773D9000-memory.dmp

          Filesize

          4KB

        • memory/3636-159-0x0000000077351000-0x0000000077471000-memory.dmp

          Filesize

          1.1MB

        • memory/3636-160-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB