Analysis

  • max time kernel
    3s
  • max time network
    55s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2024, 03:24

General

  • Target

    8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe

  • Size

    545KB

  • MD5

    af7981a2ac42f21ac4820f14bbb294b2

  • SHA1

    51d83fde26f84015365231c9526cc26adf2e3bf0

  • SHA256

    8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c

  • SHA512

    866320fc0b724695cfa9e1abf2f673ab48150bdab109f30106bd838ca3ba6aa5e50eb554e217e2bec974065a5a0ecb735d65abc5c8493abe1d14537ca73c1ef1

  • SSDEEP

    6144:lp+ggeIHjncXksyUHxAqJ1LGmg8EmDu7dRQ26RihUvqhEYGZtrLBU91BscRt1y/n:7XYvfs1c8JGRQ2UicttUjy82Ki5p

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe
    "C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"
    1⤵
    • Loads dropped DLL
    PID:380
    • C:\Program Files (x86)\windows mail\wab.exe
      "C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"
      2⤵
        PID:4952
      • C:\Program Files (x86)\windows mail\wab.exe
        "C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"
        2⤵
          PID:1932
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"
          2⤵
            PID:3096

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\nsy441F.tmp\System.dll

                Filesize

                11KB

                MD5

                75ed96254fbf894e42058062b4b4f0d1

                SHA1

                996503f1383b49021eb3427bc28d13b5bbd11977

                SHA256

                a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

                SHA512

                58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

              • memory/380-27-0x0000000005410000-0x0000000006340000-memory.dmp

                Filesize

                15.2MB

              • memory/380-9-0x0000000005410000-0x0000000006340000-memory.dmp

                Filesize

                15.2MB

              • memory/380-10-0x0000000077401000-0x0000000077521000-memory.dmp

                Filesize

                1.1MB

              • memory/380-11-0x0000000074260000-0x0000000074266000-memory.dmp

                Filesize

                24KB

              • memory/380-13-0x0000000005410000-0x0000000006340000-memory.dmp

                Filesize

                15.2MB

              • memory/3096-29-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-24-0x0000000077401000-0x0000000077521000-memory.dmp

                Filesize

                1.1MB

              • memory/3096-25-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-26-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-28-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-15-0x0000000077488000-0x0000000077489000-memory.dmp

                Filesize

                4KB

              • memory/3096-12-0x0000000001100000-0x0000000002030000-memory.dmp

                Filesize

                15.2MB

              • memory/3096-23-0x0000000001100000-0x0000000002030000-memory.dmp

                Filesize

                15.2MB

              • memory/3096-30-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-16-0x0000000077401000-0x0000000077521000-memory.dmp

                Filesize

                1.1MB

              • memory/3096-31-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-33-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-32-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-34-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-35-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-36-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-38-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB

              • memory/3096-37-0x0000000000400000-0x00000000005E4000-memory.dmp

                Filesize

                1.9MB