Analysis
- max time kernel
150s - max time network
127s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
25/01/2024, 19:12
General
- Target e778bb2a5cf80db389e541958d9c3bf2.exe
- Size 1.2MB
- Sample240125-xwpcnaecgn
- SHA256 489485f76c425b348691243b18355c39990c477483b8f2eca99d9df8225ba3f9
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e778bb2a5cf80db389e541958d9c3bf2.exe"C:\Users\Admin\AppData\Local\Temp\e778bb2a5cf80db389e541958d9c3bf2.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Users\Admin\AppData\Local\Temp\e778bb2a5cf80db389e541958d9c3bf2.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
Cab4DB5.tmp
Tar4E83.tmp
System.dll
memory/2220-34-0x0000000002F00000-0x000000000459E000-memory.dmp
memory/2220-35-0x0000000077740000-0x00000000778E9000-memory.dmp
memory/2220-36-0x0000000077930000-0x0000000077A06000-memory.dmp
memory/2220-37-0x0000000002F00000-0x000000000459E000-memory.dmp
memory/2220-38-0x00000000750F0000-0x00000000750F7000-memory.dmp
memory/2552-39-0x0000000000230000-0x00000000018CE000-memory.dmp
memory/2552-40-0x0000000077740000-0x00000000778E9000-memory.dmp
memory/2552-41-0x0000000077966000-0x0000000077967000-memory.dmp
memory/2552-42-0x0000000077930000-0x0000000077A06000-memory.dmp
memory/2552-44-0x0000000000230000-0x00000000018CE000-memory.dmp
memory/2552-106-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-124-0x0000000077930000-0x0000000077A06000-memory.dmp
memory/2552-125-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-123-0x0000000000230000-0x00000000018CE000-memory.dmp
memory/2552-126-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-127-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-128-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-129-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-130-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-131-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-132-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-133-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-134-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-135-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-136-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-138-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-139-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-141-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-142-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-143-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-144-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-145-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-146-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-147-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-148-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-149-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-150-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-151-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-152-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-154-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-155-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-156-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-157-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-158-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-160-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-161-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-162-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-163-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-164-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-166-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-167-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-168-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-169-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-170-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-171-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-173-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-174-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-175-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-176-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-177-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-178-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-179-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-180-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-181-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-182-0x0000000072CC0000-0x0000000073D22000-memory.dmp
memory/2552-183-0x0000000072CC0000-0x0000000073D22000-memory.dmp