Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
05/05/2024, 12:58
General
- Target Required commercial Offer.pdf.scr
- Size 420KB
- Sample240505-p7vptaaf21
- SHA256 eeb7e440781f906f95dfc4ab743d97103e56b8be8d481b7cf066cb29641a5b35
Score
10/10
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Guloader payload 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Required commercial Offer.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Required commercial Offer.pdf.scr" /S1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\Required commercial Offer.pdf.scr" /S2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\Required commercial Offer.pdf.scr" /S2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3448-5-0x00000000770E1000-0x0000000077201000-memory.dmp
memory/3448-4-0x0000000000970000-0x0000000000A70000-memory.dmp
memory/4540-2-0x0000000002100000-0x0000000002109000-memory.dmp
memory/4540-3-0x00000000770E1000-0x0000000077201000-memory.dmp
memory/4540-18-0x0000000002100000-0x0000000002109000-memory.dmp
memory/4540-19-0x0000000002100000-0x0000000002109000-memory.dmp