General
- Target 39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1.exe
- Size 458KB
- Sample240902-rk5bvashpg
- SHA256 39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1
Score
10/10
Malware Config
Targets
-
- Target 39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1.exe
- Size 458KB
- SHA256 39f1703e13bdc112f4ffe9240f70cd5eb5b07cc218e6b22a8d58e4dcfaadd0a1
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
UAC bypass
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/BgImage.dll
- Size 7KB
- SHA256 5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab
Score3/10 -
- Target $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 77b40d42606d48f817b901f1e5abea114b4288b344b8c193bf3e3c52e469a926
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3