Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2024 12:08
Static task
static1
Behavioral task
behavioral1
Sample
Fignen234.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Fignen234.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Fignen234.exe
-
Size
529KB
-
MD5
f71ca6bd7ede3a21cf722ffe4112e594
-
SHA1
e45d7fb3c3f224c47ad6e26b101fef648aa22b63
-
SHA256
feaabdf9165e508294f7006308b85802672ee6d7fac58ce4b3c92f6cb63334cc
-
SHA512
ab3d60930e10bc49fd0c9cf54215ba59641238cd486bf796000e14b4605de2373441f5ec76777d14e943cf1f9bc54ff30c1c2de829b19b941fd639da77cc620e
-
SSDEEP
12288:DMUVNauikWJNEay+ZfXDKqdMN559ClR9FzS/s+ZHmkHN3HiPCpfBVx:I/YW++ZfX72N559JHnHpHiwV
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
Processes:
Fignen234.exepid Process 3920 Fignen234.exe 3920 Fignen234.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Fignen234.exepid Process 2300 Fignen234.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Fignen234.exeFignen234.exepid Process 3920 Fignen234.exe 2300 Fignen234.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Fignen234.exedescription pid Process procid_target PID 3920 set thread context of 2300 3920 Fignen234.exe 95 -
Drops file in Windows directory 1 IoCs
Processes:
Fignen234.exedescription ioc Process File opened for modification C:\Windows\resources\Trnregimenternes\totalsanerende.Obs202 Fignen234.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Fignen234.exeFignen234.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fignen234.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fignen234.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Fignen234.exepid Process 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe 2300 Fignen234.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Fignen234.exepid Process 3920 Fignen234.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Fignen234.exedescription pid Process procid_target PID 3920 wrote to memory of 2300 3920 Fignen234.exe 95 PID 3920 wrote to memory of 2300 3920 Fignen234.exe 95 PID 3920 wrote to memory of 2300 3920 Fignen234.exe 95 PID 3920 wrote to memory of 2300 3920 Fignen234.exe 95 PID 3920 wrote to memory of 2300 3920 Fignen234.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5cf85183b87314359488b850f9e97a698
SHA16b6c790037eec7ebea4d05590359cb4473f19aea
SHA2563b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
SHA512fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
-
Filesize
746B
MD5f1ef074df35d1cc56ee90c6c361be29c
SHA161646d4da4770ab0a6bc5133d66eb81e3407d7ad
SHA2562daafe15fcbc8001dea5b6438b0c764ca2fb3040bcc3e64a0228af28e98a44d8
SHA512e599ca5230e725d20869c7d13d5846743926ba3b56fbac774e4d9e3f99e787b4848239f852bcd73a017c840fac9867e0affc7ffcc87cc59ae69d3da51bd213a9