Analysis

  • max time kernel
    138s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/08/2023, 17:20

General

  • Target

    62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe

  • Size

    1.5MB

  • MD5

    d4d886c2a26c7a0a2100dbbfaf7bd753

  • SHA1

    344927ad5d62cc6e27d5011bde0cd8209e5d7399

  • SHA256

    62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033

  • SHA512

    dca780b10dd38b5108f829a66eb1e32058cb4430970b747519d0c780cbef9f6f7e51e46ef8923d8ccac3acdc96d1b970de44b2bc2167d128f9369e070c573d2e

  • SSDEEP

    24576:xy8I5+eb8yxWHy9+9tLFOsh2SwVgCuFAN2XyWjTmhdSxZycFfazuToXmJJRK/F5i:Lhruri5XyGugHB6mw7zLDwWKMkR

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe"
    1⤵
    • Loads dropped DLL
    PID:2756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1100
      2⤵
      • Program crash
      PID:5068
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2756 -ip 2756
    1⤵
      PID:3540

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsz77F0.tmp\System.dll

            Filesize

            11KB

            MD5

            b853d5d2361ade731e33e882707efc34

            SHA1

            c58b1aeabdf1cbb8334ef8797e7aceaa7a1cb6be

            SHA256

            f0cd96e0b6e40f92ad1aa0efacde833bae807b92fca19bf062c1cf8acf29484b

            SHA512

            8ea31d82ffa6f58dab5632fe72690d3a6db0be65aec85fc8a1f71626773c0974dcebefae17bcf67c4c56ef442545e985eea0b348ff6e4fc36740640092b08d69

          • memory/2756-143-0x0000000004ED0000-0x00000000058CC000-memory.dmp

            Filesize

            10.0MB

          • memory/2756-144-0x0000000004ED0000-0x00000000058CC000-memory.dmp

            Filesize

            10.0MB