Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2024 12:15
Static task
static1
Behavioral task
behavioral1
Sample
Fignen234.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Fignen234.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Fignen234.exe
-
Size
529KB
-
MD5
f71ca6bd7ede3a21cf722ffe4112e594
-
SHA1
e45d7fb3c3f224c47ad6e26b101fef648aa22b63
-
SHA256
feaabdf9165e508294f7006308b85802672ee6d7fac58ce4b3c92f6cb63334cc
-
SHA512
ab3d60930e10bc49fd0c9cf54215ba59641238cd486bf796000e14b4605de2373441f5ec76777d14e943cf1f9bc54ff30c1c2de829b19b941fd639da77cc620e
-
SSDEEP
12288:DMUVNauikWJNEay+ZfXDKqdMN559ClR9FzS/s+ZHmkHN3HiPCpfBVx:I/YW++ZfX72N559JHnHpHiwV
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
Processes:
Fignen234.exepid Process 3128 Fignen234.exe 3128 Fignen234.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Fignen234.exepid Process 1872 Fignen234.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Fignen234.exeFignen234.exepid Process 3128 Fignen234.exe 1872 Fignen234.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Fignen234.exedescription pid Process procid_target PID 3128 set thread context of 1872 3128 Fignen234.exe 94 -
Drops file in Windows directory 1 IoCs
Processes:
Fignen234.exedescription ioc Process File opened for modification C:\Windows\resources\Trnregimenternes\totalsanerende.Obs202 Fignen234.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Fignen234.exeFignen234.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fignen234.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fignen234.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Fignen234.exepid Process 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe 1872 Fignen234.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Fignen234.exepid Process 3128 Fignen234.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Fignen234.exedescription pid Process procid_target PID 3128 wrote to memory of 1872 3128 Fignen234.exe 94 PID 3128 wrote to memory of 1872 3128 Fignen234.exe 94 PID 3128 wrote to memory of 1872 3128 Fignen234.exe 94 PID 3128 wrote to memory of 1872 3128 Fignen234.exe 94 PID 3128 wrote to memory of 1872 3128 Fignen234.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5cf85183b87314359488b850f9e97a698
SHA16b6c790037eec7ebea4d05590359cb4473f19aea
SHA2563b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
SHA512fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
-
Filesize
750B
MD5bf6c6c1bb46e7e0a0e0729fcf89ebeb8
SHA1391261875577bfdf6d603fb9cd010b01a28b2208
SHA25667303c927f66a65f13186eb09b958d1cc29649d3d2701792ca53bd245a237058
SHA512edd1e414939adcec8b304be7163e1a85ec2a969c8e19f5c71cfd6273896d15423696db55b996d4db986daa314e8ff8af6bee951266621482966b639ebdbaecb9