Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
15/06/2024, 01:59
General
- Target a8b78aa0870056b9eb000f19d4aa732acd3b3657c905ca333ca772a0e9e31290.exe
- Size 588KB
- Sample240615-ceg7ssvgrc
- SHA256 a8b78aa0870056b9eb000f19d4aa732acd3b3657c905ca333ca772a0e9e31290
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8b78aa0870056b9eb000f19d4aa732acd3b3657c905ca333ca772a0e9e31290.exe"C:\Users\Admin\AppData\Local\Temp\a8b78aa0870056b9eb000f19d4aa732acd3b3657c905ca333ca772a0e9e31290.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a8b78aa0870056b9eb000f19d4aa732acd3b3657c905ca333ca772a0e9e31290.exe"C:\Users\Admin\AppData\Local\Temp\a8b78aa0870056b9eb000f19d4aa732acd3b3657c905ca333ca772a0e9e31290.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
kolorister.lnk
memory/3656-239-0x0000000001850000-0x0000000002A0A000-memory.dmp
memory/3656-240-0x0000000077C08000-0x0000000077C09000-memory.dmp
memory/3656-242-0x00000000005F0000-0x0000000001844000-memory.dmp
memory/3656-243-0x0000000001850000-0x0000000002A0A000-memory.dmp
memory/3656-245-0x0000000077B81000-0x0000000077CA1000-memory.dmp
memory/4164-236-0x0000000004A50000-0x0000000005C0A000-memory.dmp
memory/4164-237-0x0000000077B81000-0x0000000077CA1000-memory.dmp
memory/4164-238-0x00000000749E5000-0x00000000749E6000-memory.dmp
memory/4164-241-0x0000000004A50000-0x0000000005C0A000-memory.dmp
memory/4164-250-0x0000000004A50000-0x0000000005C0A000-memory.dmp