Analysis
-
max time kernel
71s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 12:08
Static task
static1
Behavioral task
behavioral1
Sample
Fignen234.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Fignen234.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Fignen234.exe
-
Size
529KB
-
MD5
f71ca6bd7ede3a21cf722ffe4112e594
-
SHA1
e45d7fb3c3f224c47ad6e26b101fef648aa22b63
-
SHA256
feaabdf9165e508294f7006308b85802672ee6d7fac58ce4b3c92f6cb63334cc
-
SHA512
ab3d60930e10bc49fd0c9cf54215ba59641238cd486bf796000e14b4605de2373441f5ec76777d14e943cf1f9bc54ff30c1c2de829b19b941fd639da77cc620e
-
SSDEEP
12288:DMUVNauikWJNEay+ZfXDKqdMN559ClR9FzS/s+ZHmkHN3HiPCpfBVx:I/YW++ZfX72N559JHnHpHiwV
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
Processes:
Fignen234.exepid Process 2604 Fignen234.exe 2604 Fignen234.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Fignen234.exepid Process 1896 Fignen234.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Fignen234.exeFignen234.exepid Process 2604 Fignen234.exe 1896 Fignen234.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Fignen234.exedescription pid Process procid_target PID 2604 set thread context of 1896 2604 Fignen234.exe 29 -
Drops file in Windows directory 1 IoCs
Processes:
Fignen234.exedescription ioc Process File opened for modification C:\Windows\resources\Trnregimenternes\totalsanerende.Obs202 Fignen234.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Fignen234.exeFignen234.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fignen234.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fignen234.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Fignen234.exepid Process 1896 Fignen234.exe 1896 Fignen234.exe 1896 Fignen234.exe 1896 Fignen234.exe 1896 Fignen234.exe 1896 Fignen234.exe 1896 Fignen234.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Fignen234.exepid Process 2604 Fignen234.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Fignen234.exedescription pid Process procid_target PID 2604 wrote to memory of 1896 2604 Fignen234.exe 29 PID 2604 wrote to memory of 1896 2604 Fignen234.exe 29 PID 2604 wrote to memory of 1896 2604 Fignen234.exe 29 PID 2604 wrote to memory of 1896 2604 Fignen234.exe 29 PID 2604 wrote to memory of 1896 2604 Fignen234.exe 29 PID 2604 wrote to memory of 1896 2604 Fignen234.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
734B
MD56d3dfffc93832b074e3a06c2657f256c
SHA1f640770f547e54efed7e4df56ec27d848a131c66
SHA25653cf4eff5ae0e2c211fb1f0680a344d2ed66e538ad44cb88a8cfe7d95a55d8a8
SHA5129bc16c4aa49a4abb74281930e3188b264f5fbfb93b5fef215c253a266af14e7a34367aa0ecfd7a4106915553e1cf1012d91e1fc1eec0a37dc01341452f5197eb
-
Filesize
11KB
MD5cf85183b87314359488b850f9e97a698
SHA16b6c790037eec7ebea4d05590359cb4473f19aea
SHA2563b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
SHA512fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b