Analysis

  • max time kernel
    37s
  • max time network
    67s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 02:45

General

  • Target

    665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe

  • Size

    551KB

  • MD5

    341dab4037e9eff3fa0f34fb8382f30c

  • SHA1

    9833559bcda07e6976364672f6b7c8bcef84571f

  • SHA256

    665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea

  • SHA512

    bd0d81ddde528f9987f749f9789d6a32300c7eef5d98593c4fc708d0352d0c8828982482894bd8ac9e768e320f4ba5fede2ecd8937a461dadad4015be2940f3d

  • SSDEEP

    6144:ImOP0pJkkuNjE241F13gyLWoz6XVasKvGSz7tvIPykUn5CRFaPyCoUtU7Hi8R55i:pkNE2cL3rKou+vGEZvx5CD1W4i83bWL

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe
    "C:\Users\Admin\AppData\Local\Temp\665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4484
    • C:\Users\Admin\AppData\Local\Temp\665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe
      "C:\Users\Admin\AppData\Local\Temp\665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • outlook_office_path
      • outlook_win_path
      PID:4464

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsk3A89.tmp\System.dll

          Filesize

          11KB

          MD5

          9625d5b1754bc4ff29281d415d27a0fd

          SHA1

          80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

          SHA256

          c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

          SHA512

          dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

        • memory/4464-59-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-81-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-24-0x0000000077168000-0x0000000077169000-memory.dmp

          Filesize

          4KB

        • memory/4464-25-0x0000000077185000-0x0000000077186000-memory.dmp

          Filesize

          4KB

        • memory/4464-38-0x0000000001660000-0x0000000003835000-memory.dmp

          Filesize

          33.8MB

        • memory/4464-93-0x00000000770E1000-0x0000000077201000-memory.dmp

          Filesize

          1.1MB

        • memory/4464-40-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-92-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-84-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-83-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-82-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-41-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-43-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-44-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-45-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-46-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-47-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-48-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-49-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-50-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-54-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-62-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-56-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-57-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-58-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-21-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-22-0x0000000001660000-0x0000000003835000-memory.dmp

          Filesize

          33.8MB

        • memory/4464-60-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-55-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-63-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-64-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-65-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-66-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-67-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-68-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-69-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-70-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-71-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-72-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-73-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-74-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-75-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-76-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-77-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-78-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-79-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-80-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4464-61-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4484-42-0x00000000055F0000-0x00000000077C5000-memory.dmp

          Filesize

          33.8MB

        • memory/4484-23-0x00000000055F0000-0x00000000077C5000-memory.dmp

          Filesize

          33.8MB

        • memory/4484-20-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/4484-19-0x00000000770E1000-0x0000000077201000-memory.dmp

          Filesize

          1.1MB

        • memory/4484-18-0x00000000055F0000-0x00000000077C5000-memory.dmp

          Filesize

          33.8MB