Analysis
-
max time kernel
94s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-10-2024 16:01
General
-
Target
rpedido-002297.exe
-
Size
555KB
-
MD5
e7b674773e7c72426b2bcc90a9c1e299
-
SHA1
174323edc68682341dd312095cefaa2c6680de24
-
SHA256
643a505fefdbf1f0fa9915550a75b2b739aba1683858f92f332c9585c838690d
-
SHA512
88775e285072fd73cc42eb162b30f81197830befe7751529b4dc3a4d021571a17b90323805236149683097850916cc534205467ed0f584f67cb79b029f771ddb
-
SSDEEP
12288:TaIq2S5iC8dHsPeOXHO80cE6PU2dLkbdG0A:WrJ8MLXHO8ZE6PU4IdGb
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rpedido-002297.exe"C:\Users\Admin\AppData\Local\Temp\rpedido-002297.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rpedido-002297.exe"C:\Users\Admin\AppData\Local\Temp\rpedido-002297.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD58b3830b9dbf87f84ddd3b26645fed3a0
SHA1223bef1f19e644a610a0877d01eadc9e28299509
SHA256f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
SHA512d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
-
Filesize
37B
MD5cfda8e6aade7958f94a959bdb29cb209
SHA159c459e105a7af33d13a365f735e3cb7b8e5ddb0
SHA256b4543e8ab4997934d2edc7de8a76a24b7c2ccb641212ae3b9b17fe05b71d3e87
SHA512edfdca00667ed3a5558f7e614373f0b8393763a979154666972c659cb44e75ccd51170e4e2189043046eb4ddb8a68642bbdb6f98a0e494e76e86faaf14f993b2
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
10.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.1MB
-
Filesize
18.3MB
-
Filesize
10.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
4KB
-
Filesize
10.1MB