Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 15:01

General

  • Target

    Signatureformrequest#54526.com.exe

  • Size

    380KB

  • MD5

    5670f42a9ed9c593b72fdf7351cd5e6c

  • SHA1

    781615f55566cd8f5442b6bf7e065ab7cea1b902

  • SHA256

    86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6

  • SHA512

    ace933955f63a7f7a0fd873907992371f6f36304b78bf12fe47f7046162f97a6b0cae082e1c354d9ada1ad6e631f1fcc1b26ad44e987a8a334f6b37e8e5d3f38

  • SSDEEP

    6144:cM231sHcuulI7ph/+nA3feUHzXclMIXuLQwidBSGYFuXSjLat:UecuuAph/IAFzXhdLspY/U

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 8 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe
    "C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe
      "C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe
        C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe /stext "C:\Users\Admin\AppData\Local\Temp\efiidgsid"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4800
      • C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe
        C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe /stext "C:\Users\Admin\AppData\Local\Temp\oinsezdkqmeph"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:2032
      • C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe
        C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe /stext "C:\Users\Admin\AppData\Local\Temp\rcslerneeuwuseri"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\efiidgsid

    Filesize

    4KB

    MD5

    788d7419b32411807cc6753cbbccecbe

    SHA1

    761b99a1e5bc168f525181d78cff3f6ed82daa14

    SHA256

    76150e857b36f1f070422d2ad4df17f87454466348e4bfc158b028977378140b

    SHA512

    3003f104b0b07870015ff4e9e0d254c2e537d4c68ef664a772d7018827b0ccbeb5481a2ce587b88e6ab1d71d6ce523a620c11c00c676857d5fd5ab949fa617b4

  • C:\Users\Admin\AppData\Local\Temp\nsp3887.tmp\System.dll

    Filesize

    11KB

    MD5

    e23600029d1b09bdb1d422fb4e46f5a6

    SHA1

    5d64a2f6a257a98a689a3db9a087a0fd5f180096

    SHA256

    7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38

    SHA512

    c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac

  • C:\Users\Admin\Tubaistens.ini

    Filesize

    45B

    MD5

    1ed15cc277af7562eb72f4e48be3fe10

    SHA1

    57c78bd7ec913f83e871c110be655ad827832669

    SHA256

    f2a5a5e3109ab9577eb752819265b7f3552765356922bdd17f44a4781a104a1f

    SHA512

    39ca25427cc43851029ada4d1986e5d0de4670436e9f311ca145cea67c47461b2ed35137ae188a1af9d5d70a26c91f721d2f33daac8654c46f48777780f33b97

  • memory/772-26218-0x0000000014C20000-0x0000000017C55000-memory.dmp

    Filesize

    48.2MB

  • memory/772-26216-0x00000000741E5000-0x00000000741E6000-memory.dmp

    Filesize

    4KB

  • memory/772-26215-0x0000000077381000-0x00000000774A1000-memory.dmp

    Filesize

    1.1MB

  • memory/772-26214-0x0000000014C20000-0x0000000017C55000-memory.dmp

    Filesize

    48.2MB

  • memory/772-26221-0x0000000014C20000-0x0000000017C55000-memory.dmp

    Filesize

    48.2MB

  • memory/804-26238-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/804-26231-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/804-26237-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/804-26241-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/804-26235-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2032-26226-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2032-26227-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2032-26224-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2032-26236-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/4800-26244-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4800-26230-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4800-26228-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4800-26223-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4800-26225-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/5104-26220-0x00000000017A0000-0x00000000047D5000-memory.dmp

    Filesize

    48.2MB

  • memory/5104-26219-0x0000000000540000-0x0000000001794000-memory.dmp

    Filesize

    18.3MB

  • memory/5104-26217-0x00000000017A0000-0x00000000047D5000-memory.dmp

    Filesize

    48.2MB

  • memory/5104-26247-0x0000000035530000-0x0000000035549000-memory.dmp

    Filesize

    100KB

  • memory/5104-26251-0x0000000035530000-0x0000000035549000-memory.dmp

    Filesize

    100KB

  • memory/5104-26250-0x0000000035530000-0x0000000035549000-memory.dmp

    Filesize

    100KB

  • memory/5104-26253-0x00000000017A0000-0x00000000047D5000-memory.dmp

    Filesize

    48.2MB