Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 12:31

General

  • Target

    shipping documents_pdf.exe

  • Size

    372KB

  • MD5

    bd62f17940dfd751c9819c454cc69bc5

  • SHA1

    fb98c9cad78cc269181e3eee7f14b89f74e04b09

  • SHA256

    32f3ca938c2ce5e47648ad52af6d01eb49d3f03d47dd7b45b91f8102aca68482

  • SHA512

    bff52c0a232b12a9369264b824583493448f0ee70381271dcd9f0214fefd48a0b9527c7bf7ecb75b651f8b9a942924037eb22340da768531c876823b9027a617

  • SSDEEP

    6144:0GYgXWlQwTiuj8KHwL0+OulsWJyaAt/wVcmBkTv6+CuxUHAKsvJT8wGl8KRLTm9O:tDGvj8KHwLbHdE/wRBSzCuxBKiZGl8LO

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\shipping documents_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\shipping documents_pdf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Users\Admin\AppData\Local\Temp\shipping documents_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\shipping documents_pdf.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4276
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4664

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\svbenes.lnk

            Filesize

            868B

            MD5

            8094999d00f84d2225ad7cb9b96f69ff

            SHA1

            8099edfd44483f38ec8d2b37693d6b2723ad6234

            SHA256

            cedc18ac6e659d826067aec61509af5ae2f6cecb806f56db25cc31660ae302f9

            SHA512

            4c25639f28dc8505e799691bf7fe823f1666ba7a618da123d25382a3f79998f60ee988cd7e57d2b4b0a6a33c8aebc04cf2466a02adeafc6a5644ac90d4950897

          • C:\Users\Admin\AppData\Local\Temp\nst904B.tmp\System.dll

            Filesize

            11KB

            MD5

            ee260c45e97b62a5e42f17460d406068

            SHA1

            df35f6300a03c4d3d3bd69752574426296b78695

            SHA256

            e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27

            SHA512

            a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3

          • memory/4276-11791-0x00000000778D5000-0x00000000778D6000-memory.dmp

            Filesize

            4KB

          • memory/4276-11787-0x0000000000400000-0x0000000001654000-memory.dmp

            Filesize

            18.3MB

          • memory/4276-11788-0x0000000001660000-0x0000000002543000-memory.dmp

            Filesize

            14.9MB

          • memory/4276-11790-0x00000000778B8000-0x00000000778B9000-memory.dmp

            Filesize

            4KB

          • memory/4276-11804-0x0000000000400000-0x0000000001654000-memory.dmp

            Filesize

            18.3MB

          • memory/4276-11806-0x0000000001660000-0x0000000002543000-memory.dmp

            Filesize

            14.9MB

          • memory/4276-11807-0x0000000077831000-0x0000000077951000-memory.dmp

            Filesize

            1.1MB

          • memory/4976-11785-0x0000000077831000-0x0000000077951000-memory.dmp

            Filesize

            1.1MB

          • memory/4976-11786-0x0000000010000000-0x0000000010006000-memory.dmp

            Filesize

            24KB

          • memory/4976-11789-0x00000000049C0000-0x00000000058A3000-memory.dmp

            Filesize

            14.9MB

          • memory/4976-11784-0x00000000049C0000-0x00000000058A3000-memory.dmp

            Filesize

            14.9MB

          • memory/4976-11812-0x00000000049C0000-0x00000000058A3000-memory.dmp

            Filesize

            14.9MB