Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 14:29

General

  • Target

    xerox322200524.exe

  • Size

    464KB

  • MD5

    5b578b597f4f4eef57eda996ee33cdb6

  • SHA1

    efdb66166e1a45e9a30c67bc6d80e42f843b5604

  • SHA256

    285009b0e71742b5fbe9407dcb25e378d35c2b9eab33f51618b46b647878c60d

  • SHA512

    a7cc33e0e73c5c821d66a2ce437dfcd1ae8074161e3cafb9c2668dd3e411fc4073e1161f8781a17bbb3c8af29f210b9c3b7cf9d7a534fb278fc54ae4eabdeea3

  • SSDEEP

    12288:vi3hR5SANiItEOU79Uhua4g8Do3BMJSojhvnH3:K3hv5iIizUhH4g8eqSqd3

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\xerox322200524.exe
    "C:\Users\Admin\AppData\Local\Temp\xerox322200524.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Krydsrevisionernes.lnk

    Filesize

    886B

    MD5

    51fa4aa550487f844278f2d4214cbd70

    SHA1

    57c9cd1cea75d4b446cdd4e14e6f8069bfb0ba85

    SHA256

    f459f9a9fb45277c316e410f16dc15e8eda27a8ee31d200135efffaf50726024

    SHA512

    948a2d95ec2f78e8a206d1d3340c50f692d9f7d62a95ae5bb17eef6fdbe45d44bab12e4e4d65b3417b01586c68bed678678babb8f2106843571706d897482b02

  • \Users\Admin\AppData\Local\Temp\nst1F64.tmp\BgImage.dll

    Filesize

    7KB

    MD5

    9436196007f65f0ae96f64b1c8b2572e

    SHA1

    4b004b5c2865c9450876be83faa8cc96e1d12c01

    SHA256

    286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9

    SHA512

    5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e

  • \Users\Admin\AppData\Local\Temp\nst1F64.tmp\System.dll

    Filesize

    11KB

    MD5

    8b3830b9dbf87f84ddd3b26645fed3a0

    SHA1

    223bef1f19e644a610a0877d01eadc9e28299509

    SHA256

    f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

    SHA512

    d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

  • \Users\Admin\AppData\Local\Temp\nst1F64.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    82c3f38cd34739872af07443c65d0bd8

    SHA1

    1f4ee2d394404a291eda6419f856adaf4b960237

    SHA256

    59cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311

    SHA512

    3a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d

  • memory/2932-48-0x0000000003880000-0x00000000054FB000-memory.dmp

    Filesize

    28.5MB

  • memory/2932-49-0x0000000077061000-0x0000000077162000-memory.dmp

    Filesize

    1.0MB

  • memory/2932-50-0x0000000077060000-0x0000000077209000-memory.dmp

    Filesize

    1.7MB

  • memory/2932-51-0x0000000003880000-0x00000000054FB000-memory.dmp

    Filesize

    28.5MB