Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 18:31

General

  • Target

    RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe

  • Size

    505KB

  • MD5

    d418dddd91daec7e4460bc69ad7c3321

  • SHA1

    b62e7bf7832bda1bf73f741b8d3b548c85ec3885

  • SHA256

    406a9e03ab016d68a3aa919ac67397a83081f3ef478baf752d90545ec0fac6dc

  • SHA512

    f4b0c91803228c098ae820f2b5c90edc4db27b15d2d560766ef1d044e008e8044305a1c53f65e0ca031d20c98ed47015fee0716a4def69aabb4fa14370a81e9d

  • SSDEEP

    6144:VhRkHGPBfjVd4QMtGOipbxyteRrhoYCio4DVFwTsLxHdyH:PGu+Q+idSrYC74DMTsFHU

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Users\Admin\AppData\Local\Temp\RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ#NEWORDER-SP-21-091-003-ASIA SUPPLY.com.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst4EFD.tmp\System.dll

    Filesize

    11KB

    MD5

    55a26d7800446f1373056064c64c3ce8

    SHA1

    80256857e9a0a9c8897923b717f3435295a76002

    SHA256

    904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    SHA512

    04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

  • C:\Users\Admin\AppData\Local\Temp\nst4EFD.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    ee449b0adce56fbfa433b0239f3f81be

    SHA1

    ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    SHA256

    c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    SHA512

    22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

  • memory/4008-30-0x0000000007760000-0x00000000082A2000-memory.dmp

    Filesize

    11.3MB

  • memory/4008-31-0x0000000077A91000-0x0000000077BB1000-memory.dmp

    Filesize

    1.1MB

  • memory/4008-32-0x0000000010004000-0x0000000010005000-memory.dmp

    Filesize

    4KB

  • memory/4008-36-0x0000000007760000-0x00000000082A2000-memory.dmp

    Filesize

    11.3MB

  • memory/4008-39-0x0000000007760000-0x00000000082A2000-memory.dmp

    Filesize

    11.3MB

  • memory/4760-33-0x0000000001700000-0x0000000002242000-memory.dmp

    Filesize

    11.3MB

  • memory/4760-34-0x0000000077B18000-0x0000000077B19000-memory.dmp

    Filesize

    4KB

  • memory/4760-35-0x0000000077B35000-0x0000000077B36000-memory.dmp

    Filesize

    4KB

  • memory/4760-37-0x0000000077A91000-0x0000000077BB1000-memory.dmp

    Filesize

    1.1MB

  • memory/4760-38-0x0000000001700000-0x0000000002242000-memory.dmp

    Filesize

    11.3MB

  • memory/4760-40-0x00000000004AF000-0x00000000004B0000-memory.dmp

    Filesize

    4KB

  • memory/4760-41-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-42-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-43-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-44-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-46-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-47-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-48-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-49-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-50-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-51-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-52-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-53-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-54-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-55-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-56-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-57-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-58-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-59-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-60-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-61-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-62-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-63-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-64-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-65-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-66-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-67-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-68-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-69-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-70-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-72-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-74-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-75-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-76-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-77-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-78-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-79-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-80-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-81-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-83-0x0000000001700000-0x0000000002242000-memory.dmp

    Filesize

    11.3MB

  • memory/4760-85-0x0000000077A91000-0x0000000077BB1000-memory.dmp

    Filesize

    1.1MB

  • memory/4760-87-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-88-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-89-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-90-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-91-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-92-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-93-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-94-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-95-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-96-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-97-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-98-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-99-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-100-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-101-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-102-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-103-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-105-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-106-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-107-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB

  • memory/4760-108-0x00000000004A0000-0x00000000016F4000-memory.dmp

    Filesize

    18.3MB