Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 14:30

General

  • Target

    a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe

  • Size

    652KB

  • MD5

    3783014e89435e8f979155435933d4f0

  • SHA1

    c711fb0d97d5d363e241ed5532c6331e0fe8aa57

  • SHA256

    a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f

  • SHA512

    611452baa7692ffd4a5f3fb73d60a0e1b4ecc8a77d1d94021c87e369909c8d9d583c5e2ae575fd7ebb95b5a3e70fb670fa4d97a4594644b74d1bb1adc9c75010

  • SSDEEP

    12288:NgeDYSnG4nSUWbjU0WHUMTJRewXLvWkgTkVj:tDYSnG4n2bjmHUMhvKI

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe
    "C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe
      "C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe
        C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe /stext "C:\Users\Admin\AppData\Local\Temp\civfegacpvnkrdyckf"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:988
      • C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe
        C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe /stext "C:\Users\Admin\AppData\Local\Temp\mciyfyldddfxurmgtpremf"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:5004
      • C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe
        C:\Users\Admin\AppData\Local\Temp\a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f.exe /stext "C:\Users\Admin\AppData\Local\Temp\wenrgrwxrlxcexiklalypsxpv"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3396
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:8
    1⤵
      PID:4172

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\civfegacpvnkrdyckf

      Filesize

      4KB

      MD5

      91227a2f05c7f74f6ebd1535a3f05b7b

      SHA1

      1ce317a272d67e3ac284948e49e6bc0acaee2e6d

      SHA256

      2967c8bcad47ab6cb88bf5b60a3a75b49f471a943d33c9b69aa7bfe1b763cfd2

      SHA512

      9ff9f6d2fb2880812fce42b91388e8b825483bb2df0976b9c630c397fed68f3625f4ba32d65933de0018b6e18554315152a1df00c98313d19612403076079a40

    • C:\Users\Admin\AppData\Local\Temp\nshE3BB.tmp\System.dll

      Filesize

      11KB

      MD5

      fc3772787eb239ef4d0399680dcc4343

      SHA1

      db2fa99ec967178cd8057a14a428a8439a961a73

      SHA256

      9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed

      SHA512

      79e491ca4591a5da70116114b7fbb66ee15a0532386035e980c9dfe7afb59b1f9d9c758891e25bfb45c36b07afd3e171bac37a86c887387ef0e80b1eaf296c89

    • C:\Users\Admin\Pictures\belejrernes.lnk

      Filesize

      1KB

      MD5

      74b4f5007ca19ebbad58c8ae7fadaef9

      SHA1

      f4622459a6dffb685a2bab7583fdb2054be47c12

      SHA256

      a0ef460996ac6521bb345950436edec397db28947224415effebb8f86861f1f6

      SHA512

      ec9c6f3dda2e9fcc1f725b51dc19a93215cd2ea11b5b92bf2832ab57369ae5ba4d2ae623ad8ff62b8ae006482eea288186844e6b0dd80b8546efbc3277f61efc

    • memory/988-352-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/988-327-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/988-325-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/988-326-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1056-290-0x0000000077CB1000-0x0000000077DD1000-memory.dmp

      Filesize

      1.1MB

    • memory/1056-291-0x0000000010004000-0x0000000010005000-memory.dmp

      Filesize

      4KB

    • memory/2516-292-0x0000000077D38000-0x0000000077D39000-memory.dmp

      Filesize

      4KB

    • memory/2516-322-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-298-0x00000000004E4000-0x00000000004E5000-memory.dmp

      Filesize

      4KB

    • memory/2516-299-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-365-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-301-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-297-0x0000000001710000-0x0000000006F6F000-memory.dmp

      Filesize

      88.4MB

    • memory/2516-302-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-303-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-304-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-305-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-367-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-310-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-311-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-312-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-313-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-314-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-315-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-317-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-318-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-362-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-320-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-321-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-366-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-323-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-324-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-413-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-411-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-410-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-409-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-408-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-407-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-350-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-353-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-295-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-341-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-359-0x0000000038430000-0x0000000038449000-memory.dmp

      Filesize

      100KB

    • memory/2516-358-0x0000000038430000-0x0000000038449000-memory.dmp

      Filesize

      100KB

    • memory/2516-355-0x0000000038430000-0x0000000038449000-memory.dmp

      Filesize

      100KB

    • memory/2516-293-0x0000000077CB1000-0x0000000077DD1000-memory.dmp

      Filesize

      1.1MB

    • memory/2516-360-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-319-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-363-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-364-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-300-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-296-0x0000000077CB1000-0x0000000077DD1000-memory.dmp

      Filesize

      1.1MB

    • memory/2516-306-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-368-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-369-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-370-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-372-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-373-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-374-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-375-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-376-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-377-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-378-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-379-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-380-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-382-0x0000000077CB1000-0x0000000077DD1000-memory.dmp

      Filesize

      1.1MB

    • memory/2516-384-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-385-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-386-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-387-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-388-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-389-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-390-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-391-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-392-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-393-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-394-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-396-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-397-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-398-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-399-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-400-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-402-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-401-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-403-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-404-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-405-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/2516-406-0x00000000004B0000-0x0000000001704000-memory.dmp

      Filesize

      18.3MB

    • memory/3396-336-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/3396-338-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/3396-339-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/3396-335-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/5004-334-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/5004-329-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/5004-330-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/5004-328-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB