Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
13/05/2024, 12:30
General
- Target Factura1-FVO-2024000893.exe
- Size 515KB
- Sample240513-ppk3naed7s
- SHA256 d9d180756af8d9d4e320bcefbe2e9dcab604082309e92b0cf6b582fc37c2fa91
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura1-FVO-2024000893.exe"C:\Users\Admin\AppData\Local\Temp\Factura1-FVO-2024000893.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura1-FVO-2024000893.exe"C:\Users\Admin\AppData\Local\Temp\Factura1-FVO-2024000893.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\runas.exe"C:\Windows\SysWOW64\runas.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
memory/220-39-0x0000000000390000-0x00000000003CF000-memory.dmp
memory/220-36-0x0000000000390000-0x00000000003CF000-memory.dmp
memory/548-29-0x0000000000400000-0x0000000001654000-memory.dmp
memory/548-31-0x0000000000400000-0x0000000001654000-memory.dmp
memory/548-14-0x0000000001660000-0x0000000003F6D000-memory.dmp
memory/548-38-0x0000000000400000-0x0000000001654000-memory.dmp
memory/548-28-0x0000000000400000-0x0000000001654000-memory.dmp
memory/548-37-0x0000000000400000-0x0000000001654000-memory.dmp
memory/548-33-0x0000000000400000-0x0000000001654000-memory.dmp
memory/548-13-0x0000000000400000-0x0000000001654000-memory.dmp
memory/548-32-0x0000000001660000-0x0000000003F6D000-memory.dmp
memory/3456-40-0x00000000031E0000-0x00000000032E9000-memory.dmp
memory/3948-30-0x00000000049F0000-0x00000000072FD000-memory.dmp
memory/3948-11-0x0000000077E31000-0x0000000077F51000-memory.dmp
memory/3948-12-0x0000000010004000-0x0000000010005000-memory.dmp
memory/3948-15-0x00000000049F0000-0x00000000072FD000-memory.dmp
memory/3948-10-0x00000000049F0000-0x00000000072FD000-memory.dmp
memory/4780-47-0x000001AFBC850000-0x000001AFBC961000-memory.dmp