Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 01:17
Static task
static1
Behavioral task
behavioral1
Sample
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
General
-
Target
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe
-
Size
697KB
-
MD5
f2ce50197b4bbb37ea2d92b6375ad39a
-
SHA1
49453ce5731b600b9459fcd4896cfb22ba85e069
-
SHA256
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff
-
SHA512
70ef9adc4a09b6fdec670a251f3ce2a5b73491bf334bd3c5ca005ccac654c7e99197ef109f173d63c2d0cef94b1b8519457e156c91703d9d241e4b6183475fdc
-
SSDEEP
12288:9F8SHwVMnjioNvXt2sMVfbc7/B/XVu4HbSeHEt7XtdPMh5EpRamarPV+:9+swyRsVfgBs47s19dPQ5EpRamarPE
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
Processes:
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exepid process 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wab.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder1\\Spektralanalyser.exe" wab.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
wab.exepid process 2912 wab.exe 2912 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exewab.exepid process 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe 2912 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exedescription pid process target process PID 2372 set thread context of 2912 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe wab.exe -
Drops file in Windows directory 1 IoCs
Processes:
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exedescription ioc process File opened for modification C:\Windows\Fonts\Apokryfens\Byggrynene.ini 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exepid process 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 2912 wab.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exedescription pid process target process PID 2372 wrote to memory of 2912 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe wab.exe PID 2372 wrote to memory of 2912 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe wab.exe PID 2372 wrote to memory of 2912 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe wab.exe PID 2372 wrote to memory of 2912 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe wab.exe PID 2372 wrote to memory of 2912 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe wab.exe PID 2372 wrote to memory of 2912 2372 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe wab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe"C:\Users\Admin\AppData\Local\Temp\2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Users\Admin\AppData\Local\Temp\2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD53f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA256fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
SHA5120a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6