Analysis
- max time kernel
148s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
06/03/2024, 14:06
General
- Target factura-022853.exe
- Size 816KB
- Sample240306-redxpsce7x
- SHA256 df09e53e0571765247faf08a316fd75c13e84be01f4db61b294e0ec95aaf1b5e
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\factura-022853.exe"C:\Users\Admin\AppData\Local\Temp\factura-022853.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\factura-022853.exe"C:\Users\Admin\AppData\Local\Temp\factura-022853.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\rasautou.exe"C:\Windows\SysWOW64\rasautou.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Spahees99.lnk
System.dll
memory/1260-345-0x00000000000C0000-0x0000000000100000-memory.dmp
memory/1260-337-0x00000000000C0000-0x0000000000100000-memory.dmp
memory/1260-338-0x00000000000C0000-0x0000000000100000-memory.dmp
memory/1260-341-0x0000000001EC0000-0x00000000021C3000-memory.dmp
memory/1260-342-0x00000000000C0000-0x0000000000100000-memory.dmp
memory/1260-344-0x0000000001DE0000-0x0000000001E83000-memory.dmp
memory/1260-346-0x0000000001DE0000-0x0000000001E83000-memory.dmp
memory/1524-289-0x00000000038B0000-0x0000000005E10000-memory.dmp
memory/1524-292-0x0000000074F10000-0x0000000074F17000-memory.dmp
memory/1524-291-0x0000000077BF0000-0x0000000077CC6000-memory.dmp
memory/1524-290-0x0000000077A00000-0x0000000077BA9000-memory.dmp
memory/1524-323-0x00000000038B0000-0x0000000005E10000-memory.dmp
memory/1524-288-0x00000000038B0000-0x0000000005E10000-memory.dmp
memory/2084-294-0x0000000001470000-0x00000000039D0000-memory.dmp
memory/2084-322-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-325-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-326-0x0000000033D80000-0x0000000034083000-memory.dmp
memory/2084-327-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-329-0x0000000077BF0000-0x0000000077CC6000-memory.dmp
memory/2084-334-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-335-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-336-0x00000000000D0000-0x00000000000F4000-memory.dmp
memory/2084-324-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-300-0x0000000001470000-0x00000000039D0000-memory.dmp
memory/2084-339-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-298-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-297-0x0000000077C26000-0x0000000077C27000-memory.dmp
memory/2084-343-0x0000000001470000-0x00000000039D0000-memory.dmp
memory/2084-296-0x0000000077A00000-0x0000000077BA9000-memory.dmp
memory/2084-295-0x0000000000400000-0x0000000001462000-memory.dmp
memory/2084-293-0x0000000000400000-0x0000000001462000-memory.dmp