Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
17/04/2024, 01:03
General
- Target 0c3a38ca1a01a40daf13699cae74d8903aeb6362f75611dbd8df3430b850026b.exe
- Size 564KB
- Sample240417-bevmfshc53
- SHA256 0c3a38ca1a01a40daf13699cae74d8903aeb6362f75611dbd8df3430b850026b
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 59 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0c3a38ca1a01a40daf13699cae74d8903aeb6362f75611dbd8df3430b850026b.exe"C:\Users\Admin\AppData\Local\Temp\0c3a38ca1a01a40daf13699cae74d8903aeb6362f75611dbd8df3430b850026b.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$airgraphics=Get-Content 'C:\Users\Admin\AppData\Local\Temp\sammentrkkenes\petrochemical\pakken\Resawer134\Prehardener\Flacherie132\Novemfid116.Ops3';$Fyldepenneblks=$airgraphics.SubString(9556,3);.$Fyldepenneblks($airgraphics)"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Gajas.exe"C:\Users\Admin\AppData\Local\Temp\Gajas.exe"4⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "galgenfristens" /t REG_EXPAND_SZ /d "%Roriferous% -windowstyle minimized $Blossomed=(Get-ItemProperty -Path 'HKCU:\Sempervirid\').Revetement;%Roriferous% ($Blossomed)"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "galgenfristens" /t REG_EXPAND_SZ /d "%Roriferous% -windowstyle minimized $Blossomed=(Get-ItemProperty -Path 'HKCU:\Sempervirid\').Revetement;%Roriferous% ($Blossomed)"6⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Gajas.exe
__PSScriptPolicyTest_vxujwu2x.yhn.ps1
nsExec.dll
Camarin.mul
Novemfid116.Ops3
memory/2096-124-0x000000001DAE0000-0x000000001DAFC000-memory.dmp
memory/2096-117-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2096-128-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2096-107-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2096-108-0x0000000001660000-0x00000000020C5000-memory.dmp
memory/2096-111-0x0000000077A58000-0x0000000077A59000-memory.dmp
memory/2096-112-0x00000000779D1000-0x0000000077AF1000-memory.dmp
memory/2096-113-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2096-123-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2096-114-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2096-120-0x0000000001660000-0x00000000020C5000-memory.dmp
memory/2096-119-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2096-118-0x000000001E190000-0x000000001E4DA000-memory.dmp
memory/3456-125-0x000000000D900000-0x000000000DF3B000-memory.dmp
memory/3456-133-0x000000000D900000-0x000000000DF3B000-memory.dmp
memory/4440-134-0x0000000000A00000-0x0000000000A3F000-memory.dmp
memory/4440-135-0x00000000011D0000-0x000000000126B000-memory.dmp
memory/4440-132-0x00000000011D0000-0x000000000126B000-memory.dmp
memory/4440-130-0x0000000001300000-0x000000000164A000-memory.dmp
memory/4440-126-0x0000000000A00000-0x0000000000A3F000-memory.dmp
memory/4440-131-0x0000000000A00000-0x0000000000A3F000-memory.dmp
memory/4440-127-0x0000000000A00000-0x0000000000A3F000-memory.dmp
memory/4768-89-0x0000000006F20000-0x0000000006F3A000-memory.dmp
memory/4768-90-0x0000000007230000-0x0000000007252000-memory.dmp
memory/4768-104-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/4768-102-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/4768-100-0x0000000008B70000-0x00000000095D5000-memory.dmp
memory/4768-109-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/4768-110-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/4768-99-0x0000000073F80000-0x0000000074730000-memory.dmp
memory/4768-98-0x0000000008B70000-0x00000000095D5000-memory.dmp
memory/4768-97-0x0000000007590000-0x0000000007594000-memory.dmp
memory/4768-115-0x0000000073F80000-0x0000000074730000-memory.dmp
memory/4768-95-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/4768-116-0x0000000008B70000-0x00000000095D5000-memory.dmp
memory/4768-93-0x00000000084F0000-0x0000000008B6A000-memory.dmp
memory/4768-91-0x00000000078C0000-0x0000000007E64000-memory.dmp
memory/4768-105-0x00000000779D1000-0x0000000077AF1000-memory.dmp
memory/4768-88-0x0000000007190000-0x0000000007226000-memory.dmp
memory/4768-87-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/4768-86-0x00000000060A0000-0x00000000060EC000-memory.dmp
memory/4768-85-0x0000000006050000-0x000000000606E000-memory.dmp
memory/4768-84-0x0000000005A00000-0x0000000005D54000-memory.dmp
memory/4768-74-0x0000000005990000-0x00000000059F6000-memory.dmp
memory/4768-73-0x00000000058B0000-0x0000000005916000-memory.dmp
memory/4768-72-0x0000000005020000-0x0000000005042000-memory.dmp
memory/4768-71-0x0000000005090000-0x00000000056B8000-memory.dmp
memory/4768-70-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/4768-69-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/4768-68-0x0000000004A20000-0x0000000004A56000-memory.dmp
memory/4768-67-0x0000000073F80000-0x0000000074730000-memory.dmp