Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:21
Static task
static1
Behavioral task
behavioral1
Sample
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Raasejlenes106.app
Resource
macos-20240410-en
General
-
Target
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
-
Size
692KB
-
MD5
904ff58ae02442b30663c9be0f4d9e77
-
SHA1
9009f89ab55e84c8bbf70303247c62f8048deb77
-
SHA256
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5
-
SHA512
46aceab3cd6a6ba0ad1405d4c4f124863f4fc07a5dd0ee7df2c210c285eeb0c367d91d4e7e6e7c4865e6f494dbd3c211fb09ff4485621f69e819be3ebbb722fa
-
SSDEEP
12288:K2Co9kUzVAtb/WMdXDKDAObjsZt7P68BmPE:Kt39W8aTbjsH7P
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
Processes:
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exepid process 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exec4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exepid process 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe 2592 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exedescription pid process target process PID 2764 set thread context of 2592 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe -
Drops file in Program Files directory 3 IoCs
Processes:
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\pernille\aftershine.ini c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe File opened for modification C:\Program Files (x86)\bevirket\kabinettets.bef c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe File opened for modification C:\Program Files (x86)\barbatimao.Gro c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exepid process 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exedescription pid process target process PID 2764 wrote to memory of 2592 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe PID 2764 wrote to memory of 2592 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe PID 2764 wrote to memory of 2592 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe PID 2764 wrote to memory of 2592 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe PID 2764 wrote to memory of 2592 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe PID 2764 wrote to memory of 2592 2764 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe"C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe"C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4