Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    04/08/2023, 17:20

General

  • Target

    62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe

  • Size

    1.5MB

  • MD5

    d4d886c2a26c7a0a2100dbbfaf7bd753

  • SHA1

    344927ad5d62cc6e27d5011bde0cd8209e5d7399

  • SHA256

    62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033

  • SHA512

    dca780b10dd38b5108f829a66eb1e32058cb4430970b747519d0c780cbef9f6f7e51e46ef8923d8ccac3acdc96d1b970de44b2bc2167d128f9369e070c573d2e

  • SSDEEP

    24576:xy8I5+eb8yxWHy9+9tLFOsh2SwVgCuFAN2XyWjTmhdSxZycFfazuToXmJJRK/F5i:Lhruri5XyGugHB6mw7zLDwWKMkR

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 496
      2⤵
      • Program crash
      PID:2796

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\nstB7BC.tmp\System.dll

          Filesize

          11KB

          MD5

          b853d5d2361ade731e33e882707efc34

          SHA1

          c58b1aeabdf1cbb8334ef8797e7aceaa7a1cb6be

          SHA256

          f0cd96e0b6e40f92ad1aa0efacde833bae807b92fca19bf062c1cf8acf29484b

          SHA512

          8ea31d82ffa6f58dab5632fe72690d3a6db0be65aec85fc8a1f71626773c0974dcebefae17bcf67c4c56ef442545e985eea0b348ff6e4fc36740640092b08d69

        • memory/1680-63-0x00000000035A0000-0x0000000003F9C000-memory.dmp

          Filesize

          10.0MB

        • memory/1680-64-0x00000000035A0000-0x0000000003F9C000-memory.dmp

          Filesize

          10.0MB