Analysis
-
max time kernel
138s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-10-2024 16:18
General
-
Target
Lydisolerendes.exe
-
Size
540KB
-
MD5
c102be4fe0f4b2daa8079f8e96d3dbf9
-
SHA1
621ef9f2ec3b515811554c54fbc1876327ca9039
-
SHA256
d44e056cef3d42814519f4e2cb0bc609ffe8f1ab02bb49093ab9b04ba349e998
-
SHA512
dd1ab1ae628626ffc96ddc71076a70ef673dc22b0a3f10a888a43fec2fd89dba82b7158cc1460cec7753d61d60d40f3ce94d1c1c7c2833a31c4d9aa37f1eaf84
-
SSDEEP
12288:DML8DpbWc2SiqNxMhG330KXWBtxsqUGy841Wks+ZHmkHN3HiPCpfBVx:ILYtRt0BxTZy84DHnHpHiwV
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lydisolerendes.exe"C:\Users\Admin\AppData\Local\Temp\Lydisolerendes.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lydisolerendes.exe"C:\Users\Admin\AppData\Local\Temp\Lydisolerendes.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5cf85183b87314359488b850f9e97a698
SHA16b6c790037eec7ebea4d05590359cb4473f19aea
SHA2563b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
SHA512fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
-
Filesize
750B
MD5ad8fda560a4eb7cd24ccb8d928994a47
SHA19627d09f79d1fe3d165622f844481597ddeace28
SHA2569968f277ac2c5b75b3f0c817c2799da2d3ff0d4e585783872ad585d572a36f20
SHA512b6c3d12e7f6f1322be35d570c62640509180ff43eb2ebb08ec6021327bba1c5e65622f7c84d4ad61a25992e7a9c57823b20b0c59524423b588ef9129d5d3beb8
-
Filesize
1.1MB
-
Filesize
18.9MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.9MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB