Analysis
-
max time kernel
148s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
02-10-2023 12:25
General
-
Target
Factura Pendiente.exe
-
Size
866KB
-
MD5
772a55c751698adb2a276e42f3722d7a
-
SHA1
c7e6bf6e433aac5d8006747e8878ea76b15e858c
-
SHA256
a71c9e5f6f83bccde192cff4982c7483ceaa6c3f9e6b309f0c36cedfccf3e837
-
SHA512
4d868fb118fbcc9f4a6df771b00c86d001a490a616496b4e83998759ae4569bbe267772be67a77fc3eea082c4497b065d3d3f273cfc75dca3ba1d635fbc38b9f
-
SSDEEP
24576:INPx3TpZ46uhgbeBcWI6Wqz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTveBcZ6Wqz6VL9J8xVCT5AT2Y6N
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Pendiente.exe"C:\Users\Admin\AppData\Local\Temp\Factura Pendiente.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura Pendiente.exe"C:\Users\Admin\AppData\Local\Temp\Factura Pendiente.exe"2⤵
- Checks QEMU agent file
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA2567fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
SHA5124910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
-
Filesize
49.1MB
-
Filesize
49.1MB
-
Filesize
1.7MB
-
Filesize
856KB
-
Filesize
28KB
-
Filesize
16.4MB
-
Filesize
49.1MB
-
Filesize
16.4MB
-
Filesize
49.1MB
-
Filesize
1.7MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
49.1MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
3.0MB
-
Filesize
16.4MB