Analysis
- max time kernel
37s - max time network
67s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
12/03/2024, 02:45
General
- Target 665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe
- Size 551KB
- Sample240312-c832csfh89
- SHA256 665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe"C:\Users\Admin\AppData\Local\Temp\665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe"C:\Users\Admin\AppData\Local\Temp\665b8dea01643cce577cc8cc6cc1677e78cbf4559b7c0fbd0446dee65970b4ea.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
memory/4464-59-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-81-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-24-0x0000000077168000-0x0000000077169000-memory.dmp
memory/4464-25-0x0000000077185000-0x0000000077186000-memory.dmp
memory/4464-38-0x0000000001660000-0x0000000003835000-memory.dmp
memory/4464-93-0x00000000770E1000-0x0000000077201000-memory.dmp
memory/4464-40-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-92-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-84-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-83-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-82-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-41-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-43-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-44-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-45-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-46-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-47-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-48-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-49-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-50-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-54-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-62-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-56-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-57-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-58-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-21-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-22-0x0000000001660000-0x0000000003835000-memory.dmp
memory/4464-60-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-55-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-63-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-64-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-65-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-66-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-67-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-68-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-69-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-70-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-71-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-72-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-73-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-74-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-75-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-76-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-77-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-78-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-79-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-80-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4464-61-0x0000000000400000-0x0000000001654000-memory.dmp
memory/4484-42-0x00000000055F0000-0x00000000077C5000-memory.dmp
memory/4484-23-0x00000000055F0000-0x00000000077C5000-memory.dmp
memory/4484-20-0x0000000010000000-0x0000000010006000-memory.dmp
memory/4484-19-0x00000000770E1000-0x0000000077201000-memory.dmp
memory/4484-18-0x00000000055F0000-0x00000000077C5000-memory.dmp