Analysis
-
max time kernel
39s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-02-2024 05:59
General
-
Target
1151 AZKOND - KELBECER 30.01.2024.exe
-
Size
1.2MB
-
MD5
9b74b84e9c07cb1b16c40914ad401add
-
SHA1
992e3d4337a8b19a7acffb178809c44d13f7e637
-
SHA256
390b6fdbe11dae817ab38e25cc9974833eccf4a04e0307729b0c8507c15ed211
-
SHA512
d45eb31685f88c755fa46a30e52c482187254f9713fdbc7d5f5deded77529bd3c801feb7804a4231d9f4201ee1e7d16dd1f6dac7dd3d0cc94b43fd513d976547
-
SSDEEP
24576:dUnj9eiATpkYWFz+59iz+hDkiUgEnTZUQplhDx3nxEWfi80HcUiAEVc:daeiATBAz+riz+JVlEnTrpfJ9f0Hd2m
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1151 AZKOND - KELBECER 30.01.2024.exe"C:\Users\Admin\AppData\Local\Temp\1151 AZKOND - KELBECER 30.01.2024.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Users\Admin\AppData\Local\Temp\1151 AZKOND - KELBECER 30.01.2024.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5a4dd044bcd94e9b3370ccf095b31f896
SHA117c78201323ab2095bc53184aa8267c9187d5173
SHA2562e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
SHA51287335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
29.0MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
29.0MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
29.0MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
29.0MB
-
Filesize
24KB
-
Filesize
29.0MB