Analysis
-
max time kernel
6s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-10-2024 15:44
General
-
Target
Device/HarddiskVolume4/Users/belia.peso.IBEROSTARHV.000/AppData/Local/Temp/Rar$EXa7092.35635/factura 563423.exe
-
Size
901KB
-
MD5
6cb35cad38c80bbb552c99caf75f9371
-
SHA1
f1dcc7d9805738aaf1f30b32383674ea30706269
-
SHA256
057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf
-
SHA512
638594b7228a8e747c34f1ab7916774feaff1ce58e875e64bb28cc6742472a305c5aa06e709ec708aad990d9e78ce828509af8a575b3fe62082699de1bb81734
-
SSDEEP
12288:TSlZI9dcNnPmsS7wkJW7DQFeh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcv+l:2lTnpc/J2d2UVf+DLD1BbYGW
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\Users\belia.peso.IBEROSTARHV.000\AppData\Local\Temp\Rar$EXa7092.35635\factura 563423.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\Users\belia.peso.IBEROSTARHV.000\AppData\Local\Temp\Rar$EXa7092.35635\factura 563423.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\Users\belia.peso.IBEROSTARHV.000\AppData\Local\Temp\Rar$EXa7092.35635\factura 563423.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume4\Users\belia.peso.IBEROSTARHV.000\AppData\Local\Temp\Rar$EXa7092.35635\factura 563423.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 15403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2444 -ip 24441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5cf85183b87314359488b850f9e97a698
SHA16b6c790037eec7ebea4d05590359cb4473f19aea
SHA2563b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
SHA512fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
-
Filesize
868B
MD52a298c5b8b0e036e9fc026cae0137363
SHA196f9ad9c057519d2eb339843e14039e47df9a64a
SHA25677e04cebc689574fbed7014b1bbf3b8fbc4fbb79a91d6bcfbe39f2e6ccbee824
SHA512daede9adcc1590059d555223d0855dcc99a0e556eb6e11405c136f9b49565c91d00814c65902e3b20b69a7f3e005e5f4d170e93d7a78861993c9c43585420463
-
Filesize
838B
MD5cb22b85e23d1d5d456410baa07cdec53
SHA1cafa83e1a5e8dd209cd032774474c50f7c7e4a5b
SHA25603f9d8e7d4d738722029eff44b70734152d06925c2ed63e7fd49ea5879078f8f
SHA51222b0cf77238fe1459c162b01a55627866d59b01844d2409d37788595267a88287a51acb544cafb5883f47ed023614e3b97e0614fb0c1335c2365f76699725c30
-
Filesize
24.4MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
24.4MB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
24.4MB
-
Filesize
24.4MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
24.4MB