Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 14:52

General

  • Target

    d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1.exe

  • Size

    793KB

  • MD5

    d4f137b8bf2f0d40d41191c8be541821

  • SHA1

    ce050c34d79421adb074de782e0ea52c736c1e86

  • SHA256

    d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1

  • SHA512

    4837970ca6401dba707f15fdc793ba98b9b70af4299b8f9b9f49914b149745f428a85fd15613692e8549cf9d70089c3fb3738d6dc77d1f030b6d68a2e36584dc

  • SSDEEP

    12288:gKdQYPhiCUSyZsnY40EfLBUc4unPZAKCBHVE3L6440vaP/SS/LZi:gJYHUS9F0ETBUqREI6VpSSE

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1.exe
    "C:\Users\Admin\AppData\Local\Temp\d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Users\Admin\AppData\Local\Temp\d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1.exe
      "C:\Users\Admin\AppData\Local\Temp\d5c2c232447f0e59930b03dfb417815c61fa857d6ed61237554a947e598a08f1.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsg638F.tmp\System.dll

    Filesize

    11KB

    MD5

    34442e1e0c2870341df55e1b7b3cccdc

    SHA1

    99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

    SHA256

    269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

    SHA512

    4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

  • memory/2268-13-0x0000000005240000-0x0000000007241000-memory.dmp

    Filesize

    32.0MB

  • memory/2268-14-0x0000000077D91000-0x0000000077EB1000-memory.dmp

    Filesize

    1.1MB

  • memory/2268-15-0x00000000749E4000-0x00000000749E5000-memory.dmp

    Filesize

    4KB

  • memory/2268-27-0x0000000005240000-0x0000000007241000-memory.dmp

    Filesize

    32.0MB

  • memory/2268-38-0x0000000005240000-0x0000000007241000-memory.dmp

    Filesize

    32.0MB

  • memory/4924-16-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/4924-17-0x0000000001660000-0x0000000003661000-memory.dmp

    Filesize

    32.0MB

  • memory/4924-31-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/4924-33-0x0000000001660000-0x0000000003661000-memory.dmp

    Filesize

    32.0MB