Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 15:01
Static task
static1
Behavioral task
behavioral1
Sample
Signatureformrequest#54526.com.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Signatureformrequest#54526.com.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
General
-
Target
Signatureformrequest#54526.com.exe
-
Size
380KB
-
MD5
5670f42a9ed9c593b72fdf7351cd5e6c
-
SHA1
781615f55566cd8f5442b6bf7e065ab7cea1b902
-
SHA256
86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6
-
SHA512
ace933955f63a7f7a0fd873907992371f6f36304b78bf12fe47f7046162f97a6b0cae082e1c354d9ada1ad6e631f1fcc1b26ad44e987a8a334f6b37e8e5d3f38
-
SSDEEP
6144:cM231sHcuulI7ph/+nA3feUHzXclMIXuLQwidBSGYFuXSjLat:UecuuAph/IAFzXhdLspY/U
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2032-26236-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/2032-26227-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4800-26230-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4800-26228-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4800-26244-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral2/memory/804-26238-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/804-26241-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/804-26237-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2032-26236-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/4800-26230-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/4800-26228-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2032-26227-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/4800-26244-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Loads dropped DLL 2 IoCs
Processes:
Signatureformrequest#54526.com.exepid process 772 Signatureformrequest#54526.com.exe 772 Signatureformrequest#54526.com.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
Signatureformrequest#54526.com.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Signatureformrequest#54526.com.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
Signatureformrequest#54526.com.exepid process 5104 Signatureformrequest#54526.com.exe 5104 Signatureformrequest#54526.com.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Signatureformrequest#54526.com.exeSignatureformrequest#54526.com.exepid process 772 Signatureformrequest#54526.com.exe 5104 Signatureformrequest#54526.com.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Signatureformrequest#54526.com.exeSignatureformrequest#54526.com.exedescription pid process target process PID 772 set thread context of 5104 772 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 set thread context of 4800 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 set thread context of 2032 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 set thread context of 804 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Signatureformrequest#54526.com.exeSignatureformrequest#54526.com.exepid process 4800 Signatureformrequest#54526.com.exe 4800 Signatureformrequest#54526.com.exe 804 Signatureformrequest#54526.com.exe 804 Signatureformrequest#54526.com.exe 4800 Signatureformrequest#54526.com.exe 4800 Signatureformrequest#54526.com.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
Signatureformrequest#54526.com.exeSignatureformrequest#54526.com.exepid process 772 Signatureformrequest#54526.com.exe 5104 Signatureformrequest#54526.com.exe 5104 Signatureformrequest#54526.com.exe 5104 Signatureformrequest#54526.com.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Signatureformrequest#54526.com.exedescription pid process Token: SeDebugPrivilege 804 Signatureformrequest#54526.com.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Signatureformrequest#54526.com.exeSignatureformrequest#54526.com.exedescription pid process target process PID 772 wrote to memory of 5104 772 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 772 wrote to memory of 5104 772 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 772 wrote to memory of 5104 772 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 772 wrote to memory of 5104 772 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 772 wrote to memory of 5104 772 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 4800 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 4800 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 4800 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 2032 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 2032 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 2032 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 804 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 804 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe PID 5104 wrote to memory of 804 5104 Signatureformrequest#54526.com.exe Signatureformrequest#54526.com.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe"C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe"C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exeC:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe /stext "C:\Users\Admin\AppData\Local\Temp\efiidgsid"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exeC:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe /stext "C:\Users\Admin\AppData\Local\Temp\oinsezdkqmeph"3⤵
- Accesses Microsoft Outlook accounts
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exeC:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe /stext "C:\Users\Admin\AppData\Local\Temp\rcslerneeuwuseri"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5788d7419b32411807cc6753cbbccecbe
SHA1761b99a1e5bc168f525181d78cff3f6ed82daa14
SHA25676150e857b36f1f070422d2ad4df17f87454466348e4bfc158b028977378140b
SHA5123003f104b0b07870015ff4e9e0d254c2e537d4c68ef664a772d7018827b0ccbeb5481a2ce587b88e6ab1d71d6ce523a620c11c00c676857d5fd5ab949fa617b4
-
Filesize
11KB
MD5e23600029d1b09bdb1d422fb4e46f5a6
SHA15d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA2567342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
SHA512c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
-
Filesize
45B
MD51ed15cc277af7562eb72f4e48be3fe10
SHA157c78bd7ec913f83e871c110be655ad827832669
SHA256f2a5a5e3109ab9577eb752819265b7f3552765356922bdd17f44a4781a104a1f
SHA51239ca25427cc43851029ada4d1986e5d0de4670436e9f311ca145cea67c47461b2ed35137ae188a1af9d5d70a26c91f721d2f33daac8654c46f48777780f33b97