Analysis
-
max time kernel
96s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/09/2024, 06:30
General
-
Target
List of Items Ref_02839273882.exe
-
Size
624KB
-
MD5
50ade32ff9b174e1ce5788d9b0382bcc
-
SHA1
47945e27bb8c49412cb405281d57c28af7db0812
-
SHA256
635057b83f36b7fd2061a67442e4bc6115b7bff972cf86bd0941bde151eb9cfe
-
SHA512
155fa422dd5e74606528179aa147a0ebfeea3a29154b97885dd1741ad9feb6d37dd64ed122381ee691ecfdc4d4335659ce6f7484414d948ceaf16eca2c1f1787
-
SSDEEP
12288:VY+T5LbPV56MWGSf9sdrHbgeaWA+1DLTW:VYYLbr6MhS64eNw
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\List of Items Ref_02839273882.exe"C:\Users\Admin\AppData\Local\Temp\List of Items Ref_02839273882.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\List of Items Ref_02839273882.exe"C:\Users\Admin\AppData\Local\Temp\List of Items Ref_02839273882.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
9.7MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
9.7MB
-
Filesize
12KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB