Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11/08/2024, 23:31
General
-
Target
Inquiry August Order RFQ #278823_pdf.exe
-
Size
384KB
-
MD5
ea89d9f3addd948e47cd6b11eb3c348d
-
SHA1
405d8b34849896329e9ef454577b98bdbb20710f
-
SHA256
da67608d6c93b04a34df39dd5c676e1e64fae1e5ca29c061041594c488446b8b
-
SHA512
048e65261d20cf718179b29e337b6113b799e25525cf825eed870e3f9c10189b547c1f6404b8970bd5fe45dad45c205e85329a620207e4cd950988da58593f8a
-
SSDEEP
6144:BC2O1qiGaNThPFSpLQEem09B6snZ0ttN/+qVVXWYcewhVSxW22c2BBL7dK:AbGaN5FSexm09B6HmqT02QbcIL7Q
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inquiry August Order RFQ #278823_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry August Order RFQ #278823_pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry August Order RFQ #278823_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry August Order RFQ #278823_pdf.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
31.0MB
-
Filesize
1.0MB
-
Filesize
1.7MB
-
Filesize
31.0MB
-
Filesize
31.0MB
-
Filesize
1.7MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB