Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 18:31

General

  • Target

    RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe

  • Size

    505KB

  • MD5

    d418dddd91daec7e4460bc69ad7c3321

  • SHA1

    b62e7bf7832bda1bf73f741b8d3b548c85ec3885

  • SHA256

    406a9e03ab016d68a3aa919ac67397a83081f3ef478baf752d90545ec0fac6dc

  • SHA512

    f4b0c91803228c098ae820f2b5c90edc4db27b15d2d560766ef1d044e008e8044305a1c53f65e0ca031d20c98ed47015fee0716a4def69aabb4fa14370a81e9d

  • SSDEEP

    6144:VhRkHGPBfjVd4QMtGOipbxyteRrhoYCio4DVFwTsLxHdyH:PGu+Q+idSrYC74DMTsFHU

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd82A9.tmp\System.dll

    Filesize

    11KB

    MD5

    55a26d7800446f1373056064c64c3ce8

    SHA1

    80256857e9a0a9c8897923b717f3435295a76002

    SHA256

    904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    SHA512

    04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

  • \Users\Admin\AppData\Local\Temp\nsd82A9.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    ee449b0adce56fbfa433b0239f3f81be

    SHA1

    ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    SHA256

    c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    SHA512

    22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

  • memory/2460-37-0x0000000077450000-0x00000000775F9000-memory.dmp

    Filesize

    1.7MB

  • memory/2460-39-0x0000000001510000-0x0000000002052000-memory.dmp

    Filesize

    11.3MB

  • memory/3008-33-0x0000000006670000-0x00000000071B2000-memory.dmp

    Filesize

    11.3MB

  • memory/3008-34-0x0000000077451000-0x0000000077552000-memory.dmp

    Filesize

    1.0MB

  • memory/3008-35-0x0000000077450000-0x00000000775F9000-memory.dmp

    Filesize

    1.7MB

  • memory/3008-36-0x0000000006670000-0x00000000071B2000-memory.dmp

    Filesize

    11.3MB

  • memory/3008-40-0x0000000006670000-0x00000000071B2000-memory.dmp

    Filesize

    11.3MB