Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 18:10

General

  • Target

    Benefits-Signature-RequestsPlan#241205.com.exe

  • Size

    318KB

  • MD5

    46e978f5dee2d39687269d77e44df3cf

  • SHA1

    f15c27a41a2e7e78b07df29c687da3e70e813e66

  • SHA256

    5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

  • SHA512

    81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19

  • SSDEEP

    6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Benefits-Signature-RequestsPlan#241205.com.exe
    "C:\Users\Admin\AppData\Local\Temp\Benefits-Signature-RequestsPlan#241205.com.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Users\Admin\AppData\Local\Temp\Benefits-Signature-RequestsPlan#241205.com.exe
      "C:\Users\Admin\AppData\Local\Temp\Benefits-Signature-RequestsPlan#241205.com.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsw4A87.tmp\System.dll

    Filesize

    11KB

    MD5

    4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    SHA1

    7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    SHA256

    d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    SHA512

    cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

  • C:\Users\Admin\AppData\Local\Temp\nsw4A87.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    035bdb470a6807313bd005bd98341ffc

    SHA1

    5017d1e5a23f1c64594f737e6fccd519729c3b3e

    SHA256

    26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

    SHA512

    f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

  • C:\Users\Admin\AppData\Local\Temp\nsw4A87.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    eb2c74e05b30b29887b3219f4ea3fdab

    SHA1

    91173d46b34e7bae57acabdbd239111b5bcc4d9e

    SHA256

    d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

    SHA512

    1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

  • C:\Users\Public\Desktop\polres.lnk

    Filesize

    1KB

    MD5

    602f2ae31c769303901f0cc06dd404c9

    SHA1

    8887fbefff1fc747e84fe1b6e2cfda5edc56e35a

    SHA256

    fe790ab8a17687fb6320360abaa52925f05b58ef0a44a924855f3e0f14a3b3eb

    SHA512

    259b93ef7692fd68eaccd853fbe4398c9ba329ca40bb94b7664671cde6ce623187cee7b8304113456e11990a66a1e8595357d4bc689b63fae58c802e33ca1c91

  • memory/212-376-0x0000000005C50000-0x00000000088CF000-memory.dmp

    Filesize

    44.5MB

  • memory/212-377-0x0000000077531000-0x0000000077651000-memory.dmp

    Filesize

    1.1MB

  • memory/212-378-0x0000000074394000-0x0000000074395000-memory.dmp

    Filesize

    4KB

  • memory/212-381-0x0000000005C50000-0x00000000088CF000-memory.dmp

    Filesize

    44.5MB

  • memory/212-388-0x0000000005C50000-0x00000000088CF000-memory.dmp

    Filesize

    44.5MB

  • memory/2944-379-0x00000000016D0000-0x000000000434F000-memory.dmp

    Filesize

    44.5MB

  • memory/2944-380-0x0000000000470000-0x00000000016C4000-memory.dmp

    Filesize

    18.3MB

  • memory/2944-383-0x00000000016D0000-0x000000000434F000-memory.dmp

    Filesize

    44.5MB