Analysis

  • max time kernel
    96s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 14:29

General

  • Target

    xerox322200524.exe

  • Size

    464KB

  • MD5

    5b578b597f4f4eef57eda996ee33cdb6

  • SHA1

    efdb66166e1a45e9a30c67bc6d80e42f843b5604

  • SHA256

    285009b0e71742b5fbe9407dcb25e378d35c2b9eab33f51618b46b647878c60d

  • SHA512

    a7cc33e0e73c5c821d66a2ce437dfcd1ae8074161e3cafb9c2668dd3e411fc4073e1161f8781a17bbb3c8af29f210b9c3b7cf9d7a534fb278fc54ae4eabdeea3

  • SSDEEP

    12288:vi3hR5SANiItEOU79Uhua4g8Do3BMJSojhvnH3:K3hv5iIizUhH4g8eqSqd3

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xerox322200524.exe
    "C:\Users\Admin\AppData\Local\Temp\xerox322200524.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:512
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1060
      2⤵
      • Program crash
      PID:2852
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 512 -ip 512
    1⤵
      PID:2324

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\BgImage.dll

      Filesize

      7KB

      MD5

      9436196007f65f0ae96f64b1c8b2572e

      SHA1

      4b004b5c2865c9450876be83faa8cc96e1d12c01

      SHA256

      286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9

      SHA512

      5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e

    • C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\System.dll

      Filesize

      11KB

      MD5

      8b3830b9dbf87f84ddd3b26645fed3a0

      SHA1

      223bef1f19e644a610a0877d01eadc9e28299509

      SHA256

      f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

      SHA512

      d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

    • C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      82c3f38cd34739872af07443c65d0bd8

      SHA1

      1f4ee2d394404a291eda6419f856adaf4b960237

      SHA256

      59cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311

      SHA512

      3a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Krydsrevisionernes.lnk

      Filesize

      906B

      MD5

      d574991a4df6d0d76d59b5c65ab0423f

      SHA1

      ebac8847ca2fb8610bfff14c315761ef5870b1e6

      SHA256

      3ded11541e82aa7b94e2dd827b63f2de4db589ee5914b906085d4ddfbbadb695

      SHA512

      89ab4ca99730bfedd36802281fe4f723d1b9cbca2acae999b7b5d5672567d94b00294d1e1a94acba135a750d2b267d46e01356b0dae89e553a9da34defc68925

    • memory/512-45-0x0000000004320000-0x0000000005F9B000-memory.dmp

      Filesize

      28.5MB

    • memory/512-46-0x0000000077191000-0x00000000772B1000-memory.dmp

      Filesize

      1.1MB

    • memory/512-47-0x0000000004320000-0x0000000005F9B000-memory.dmp

      Filesize

      28.5MB