Analysis

  • max time kernel
    239s
  • max time network
    240s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    22-10-2024 16:18

General

  • Target

    Lydisolerendes.exe

  • Size

    540KB

  • MD5

    c102be4fe0f4b2daa8079f8e96d3dbf9

  • SHA1

    621ef9f2ec3b515811554c54fbc1876327ca9039

  • SHA256

    d44e056cef3d42814519f4e2cb0bc609ffe8f1ab02bb49093ab9b04ba349e998

  • SHA512

    dd1ab1ae628626ffc96ddc71076a70ef673dc22b0a3f10a888a43fec2fd89dba82b7158cc1460cec7753d61d60d40f3ce94d1c1c7c2833a31c4d9aa37f1eaf84

  • SSDEEP

    12288:DML8DpbWc2SiqNxMhG330KXWBtxsqUGy841Wks+ZHmkHN3HiPCpfBVx:ILYtRt0BxTZy84DHnHpHiwV

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lydisolerendes.exe
    "C:\Users\Admin\AppData\Local\Temp\Lydisolerendes.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\Lydisolerendes.exe
      "C:\Users\Admin\AppData\Local\Temp\Lydisolerendes.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Music\incinerations.lnk

    Filesize

    738B

    MD5

    c6cf00fbbac7e2824fb46bc52bddc9d8

    SHA1

    39076599acb4988cfecefd3760ac4cc95c748efa

    SHA256

    a804eac0322cd50591c449acdaf31af42022a03360d0bca3167b8f846f16e653

    SHA512

    455a1c6b21fc6c09cca8727b24dac4be72e5d20b425dbfc83b9a8408aa2e51ae9ca8d96c34d5bf45fee4133c4ff5e33e5c41ac0ca6c2c7122b6e88646a4727c2

  • \Users\Admin\AppData\Local\Temp\nsoCBA9.tmp\System.dll

    Filesize

    11KB

    MD5

    cf85183b87314359488b850f9e97a698

    SHA1

    6b6c790037eec7ebea4d05590359cb4473f19aea

    SHA256

    3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

    SHA512

    fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

  • memory/2072-460-0x0000000000400000-0x0000000001462000-memory.dmp

    Filesize

    16.4MB

  • memory/2072-459-0x0000000000400000-0x0000000001462000-memory.dmp

    Filesize

    16.4MB

  • memory/2072-468-0x0000000000400000-0x0000000001462000-memory.dmp

    Filesize

    16.4MB

  • memory/2072-462-0x0000000000400000-0x0000000001462000-memory.dmp

    Filesize

    16.4MB

  • memory/2072-461-0x0000000000400000-0x0000000001462000-memory.dmp

    Filesize

    16.4MB

  • memory/2072-434-0x0000000000400000-0x0000000001462000-memory.dmp

    Filesize

    16.4MB

  • memory/2072-435-0x0000000076F60000-0x0000000077109000-memory.dmp

    Filesize

    1.7MB

  • memory/2072-457-0x0000000000400000-0x0000000001462000-memory.dmp

    Filesize

    16.4MB

  • memory/2072-458-0x0000000000400000-0x0000000001462000-memory.dmp

    Filesize

    16.4MB

  • memory/2300-432-0x0000000077150000-0x0000000077226000-memory.dmp

    Filesize

    856KB

  • memory/2300-429-0x0000000003B50000-0x0000000004E38000-memory.dmp

    Filesize

    18.9MB

  • memory/2300-430-0x0000000076F61000-0x0000000077062000-memory.dmp

    Filesize

    1.0MB

  • memory/2300-433-0x0000000003B50000-0x0000000004E38000-memory.dmp

    Filesize

    18.9MB

  • memory/2300-431-0x0000000076F60000-0x0000000077109000-memory.dmp

    Filesize

    1.7MB