Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
16/05/2024, 01:26
General
- Target 6e849f1461600cf9c9d15613932c2ea2878cf71d3718d12d1c049c37c57d5d72.exe
- Size 287KB
- Sample240516-btybwsec48
- SHA256 6e849f1461600cf9c9d15613932c2ea2878cf71d3718d12d1c049c37c57d5d72
Score
10/10
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e849f1461600cf9c9d15613932c2ea2878cf71d3718d12d1c049c37c57d5d72.exe"C:\Users\Admin\AppData\Local\Temp\6e849f1461600cf9c9d15613932c2ea2878cf71d3718d12d1c049c37c57d5d72.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6e849f1461600cf9c9d15613932c2ea2878cf71d3718d12d1c049c37c57d5d72.exe"C:\Users\Admin\AppData\Local\Temp\6e849f1461600cf9c9d15613932c2ea2878cf71d3718d12d1c049c37c57d5d72.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
memory/872-30-0x0000000001A30000-0x0000000004310000-memory.dmp
memory/872-31-0x00000000007D0000-0x0000000001A24000-memory.dmp
memory/872-34-0x0000000001A30000-0x0000000004310000-memory.dmp
memory/4368-27-0x0000000004430000-0x0000000006D10000-memory.dmp
memory/4368-28-0x0000000077881000-0x00000000779A1000-memory.dmp
memory/4368-29-0x0000000010004000-0x0000000010005000-memory.dmp
memory/4368-32-0x0000000004430000-0x0000000006D10000-memory.dmp
memory/4368-39-0x0000000004430000-0x0000000006D10000-memory.dmp