Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 16:19

General

  • Target

    ORDER88273747829304.exe

  • Size

    641KB

  • MD5

    530e8e04a85a0d33d960e21318b80478

  • SHA1

    c44ccc95de3b32b60c4c2ae6684cd97b253bc88e

  • SHA256

    f240a81fec7de0227d57e18da194b50d8cada15613719b3bda6236c401e0e8ea

  • SHA512

    a8805190ffcf67e5f8b6c0b7e421d6d7aa107c979d040a47fe0814dba706412a93afed88044a8e2619d19e78dc5e762087c8e626d233dced829d8d28439b79f4

  • SSDEEP

    12288:ewWNc8eZ5YG4rtXzlrkipUe3mQakoeN4eN/FH6+C8XKDem+Gk5lIeF3jYFTKE2:eBM74BJkipUQmsN4eN/FH6+CLDeT5bt/

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ORDER88273747829304.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDER88273747829304.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\ORDER88273747829304.exe
      "C:\Users\Admin\AppData\Local\Temp\ORDER88273747829304.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1328

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Cambo.ini

          Filesize

          29B

          MD5

          fb7e9f0a2cfd292c2a31edc1b25b3c4e

          SHA1

          fab73738d595e2428ea4da5cdeaab8e5e1ac7764

          SHA256

          6305d408267ea7ac8ef8ea596c082fe8259c86ea842702bfeeeecfe05cd9e062

          SHA512

          d87a24e83ed916027a2fb75d9d35ba00be0005e85532c3db387784bc9a42d4f02aac7225c2799fff37559664ecc62f0e05c76744c8eb313a3377670bfc02e9b1

        • C:\Users\Admin\AppData\Local\Temp\Cambo.ini

          Filesize

          29B

          MD5

          d856983df5f78b6918c4e0680279fea2

          SHA1

          03e1d3160bae500d7a6facae108c0ed1d9003c4b

          SHA256

          23a07e8c9efa38a34f21a116314ab925aa4a04fb287a39cbf965b9f478bdd676

          SHA512

          c52fda0cb3324ce3b111092780528a8210bd3d46baece0dbbfc4feee43b36c3f975e4d9d3e50833938cc32a3ae5dcbbc74bbfa1ce4e69f88073c6382a8d15b2e

        • C:\Users\Admin\AppData\Local\Temp\Cambo.ini

          Filesize

          29B

          MD5

          82b08967613d161614588d050a924bb1

          SHA1

          b9a29a8475ffc2ebeb4cb8cef70ef1c70b7dd0a3

          SHA256

          a7ecdfddad858b4815a3b0871d42621b3d57ba0f1e78c3013a7621ac7e7cfe15

          SHA512

          d57a0c00638531e86c478b0656608753fac9063a833096e3c684fc4a1ff26f7c2af8348052c550beca6a08a4ef88fc37fa1e9c08fc8a6b96529699c333b3f8dc

        • C:\Users\Admin\AppData\Local\Temp\Cambo.ini

          Filesize

          29B

          MD5

          019803e333ae98d5541e83869a5ac694

          SHA1

          5d8b0ec6e8218569358a55af9359718039283588

          SHA256

          e09cc06c305ca1d6bdc9c9929a5403040ca9115ff27a6f385bf1fce9eef5b773

          SHA512

          7f6039d023b6bc43d7df7c87fb4500d9d5004aae4f137f1fb47ced2c52400fbd2b12c7643acd5baefcc339e88f3a3d972e8e160ac7ed04c180d5cd5cc7dec403

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Asteriskerne.lnk

          Filesize

          1KB

          MD5

          1e05ec7edd7b8b85501b919539d5f4a4

          SHA1

          fb97cdff2ab05ac13f79862829f0f235a1cf29ee

          SHA256

          a2ffbfe69d96474faa760f3d0cf2038ee6d64e5f1170309d9be2d37328341db1

          SHA512

          088279ae0672169692cd3bae2d6a80a9aa3d00f3f0acdb1a39adbfc433c815280d720ea660c83c161bdfbe49b54bd242b0f1e2ece06d9739f33e431891f601fe

        • C:\Windows\Resources\murkier.lnk

          Filesize

          1KB

          MD5

          2c317b138dc769e9c54c8f299705d425

          SHA1

          ce81bb74ebdfd77217fb7d727c75ed42ba767ceb

          SHA256

          2f64b84f9b6f4ac227c4049564eb056f6e74faef242ed1e04d0075ef7478bf8c

          SHA512

          21dced78ceaa7b64f985dca09fb0c289272a6b5335516c9cb38392ffb7aba3ad0f0cb50a55c5e2b5592923e7fde38fdd4d176b896a35d86ba3aa128640d512ae

        • \Users\Admin\AppData\Local\Temp\nso450E.tmp\System.dll

          Filesize

          11KB

          MD5

          55a26d7800446f1373056064c64c3ce8

          SHA1

          80256857e9a0a9c8897923b717f3435295a76002

          SHA256

          904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

          SHA512

          04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

        • memory/1328-298-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-310-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-301-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-335-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-272-0x00000000014F0000-0x0000000001FA7000-memory.dmp

          Filesize

          10.7MB

        • memory/1328-334-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-274-0x0000000077640000-0x00000000777E9000-memory.dmp

          Filesize

          1.7MB

        • memory/1328-275-0x0000000077866000-0x0000000077867000-memory.dmp

          Filesize

          4KB

        • memory/1328-276-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-277-0x00000000014F0000-0x0000000001FA7000-memory.dmp

          Filesize

          10.7MB

        • memory/1328-333-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-278-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-280-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-281-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-282-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-283-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-284-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-286-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-287-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-288-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-289-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-290-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-291-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-292-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-293-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-294-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-295-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-296-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-297-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-332-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-299-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-300-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-331-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-303-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-330-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-304-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-305-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-306-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-307-0x0000000077830000-0x0000000077906000-memory.dmp

          Filesize

          856KB

        • memory/1328-308-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-309-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-302-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-312-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-313-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-314-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-315-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-316-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-317-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-318-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-319-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-320-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-321-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-322-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-323-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-324-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-325-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-326-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-327-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-328-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-329-0x0000000000480000-0x00000000014E2000-memory.dmp

          Filesize

          16.4MB

        • memory/2060-269-0x0000000077640000-0x00000000777E9000-memory.dmp

          Filesize

          1.7MB

        • memory/2060-270-0x0000000077830000-0x0000000077906000-memory.dmp

          Filesize

          856KB

        • memory/2060-268-0x0000000003A40000-0x00000000044F7000-memory.dmp

          Filesize

          10.7MB

        • memory/2060-279-0x0000000003A40000-0x00000000044F7000-memory.dmp

          Filesize

          10.7MB

        • memory/2060-273-0x0000000003A40000-0x00000000044F7000-memory.dmp

          Filesize

          10.7MB

        • memory/2060-271-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB