Analysis
-
max time kernel
125s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24/09/2024, 11:06
General
-
Target
1116543711892424.scr
-
Size
1.0MB
-
MD5
4648a0278bd003c324fcd7e7779dcf99
-
SHA1
401623540094e2eef531d366d8c155c1d3d72abb
-
SHA256
49260a07ff0d5c06efdfc3985bcc44d6df5cf2a56810f01c3243684b950264cc
-
SHA512
198d5db4bb4f612645786c27cdacb26665db4099cd8580091adf86d9d84fc16278d3a87c410912cb4968c630dca1cc14432551673fb7653ad83f28b601720da5
-
SSDEEP
12288:x9XMnptEWw7TAIh1LSw84bjZgyrMNAzP6RtRQXl51KBkpw8+QZ0:rcnsWw7sIh1uQba4mRjQVP2UkV
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1116543711892424.scr"C:\Users\Admin\AppData\Local\Temp\1116543711892424.scr" /S1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1116543711892424.scr"C:\Users\Admin\AppData\Local\Temp\1116543711892424.scr" /S2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3800,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902B
MD59bb365aeb85ba12f1bb09147e0b42b97
SHA116cffae6cbeec735850470dae5968c7c879cc340
SHA25605a87a6f54e22f55b8580708d8b23f5bce7b56e5d9c5e05ec8bf66c3569d2402
SHA512b5cf1c4b0d48dc2f44d4061ba7a67701839aa5cfd73cdab9fca56dbdd8134636466a43da446cc61cbd2cf3ca02cc0a88441792fe339085c5cde460d722c5f7d5
-
Filesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
Filesize
23.4MB
-
Filesize
1.1MB
-
Filesize
23.4MB
-
Filesize
4KB
-
Filesize
23.4MB
-
Filesize
18.3MB
-
Filesize
23.4MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB