Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 17:07

General

  • Target

    c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe

  • Size

    692KB

  • MD5

    904ff58ae02442b30663c9be0f4d9e77

  • SHA1

    9009f89ab55e84c8bbf70303247c62f8048deb77

  • SHA256

    c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5

  • SHA512

    46aceab3cd6a6ba0ad1405d4c4f124863f4fc07a5dd0ee7df2c210c285eeb0c367d91d4e7e6e7c4865e6f494dbd3c211fb09ff4485621f69e819be3ebbb722fa

  • SSDEEP

    12288:K2Co9kUzVAtb/WMdXDKDAObjsZt7P68BmPE:Kt39W8aTbjsH7P

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
    "C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
      "C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsy1048.tmp\System.dll

    Filesize

    11KB

    MD5

    75ed96254fbf894e42058062b4b4f0d1

    SHA1

    996503f1383b49021eb3427bc28d13b5bbd11977

    SHA256

    a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    SHA512

    58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

  • memory/2112-20-0x0000000077830000-0x00000000779D9000-memory.dmp

    Filesize

    1.7MB

  • memory/2112-22-0x00000000004D0000-0x0000000001532000-memory.dmp

    Filesize

    16.4MB

  • memory/2976-17-0x00000000040A0000-0x00000000060E0000-memory.dmp

    Filesize

    32.2MB

  • memory/2976-18-0x0000000077831000-0x0000000077932000-memory.dmp

    Filesize

    1.0MB

  • memory/2976-19-0x0000000077830000-0x00000000779D9000-memory.dmp

    Filesize

    1.7MB

  • memory/2976-21-0x00000000040A0000-0x00000000060E0000-memory.dmp

    Filesize

    32.2MB

  • memory/2976-28-0x00000000040A0000-0x00000000060E0000-memory.dmp

    Filesize

    32.2MB