Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 13:11
Static task
static1
Behavioral task
behavioral1
Sample
Factura 9000012567.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Factura 9000012567.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Factura 9000012567.exe
-
Size
419KB
-
MD5
1194e870e252e43b41cc724c1c7a987e
-
SHA1
e7a95416ebc253d9fe01fb3c90c6fa713143436d
-
SHA256
e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367
-
SHA512
d88e334a88740a5d71666757bc5309414deefe82c4bd601ea9d7dec1fc54cead898f750215028fef8026b7a948a7f184e4b06a0c9eb6e99e0ad55b014733b101
-
SSDEEP
12288:bch7SSzvYNxbs0V0utVFWN5yUBHWpwyx9fag6vI:bqvv2Vx0urqwg4xyrvI
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
pid Process 1764 Factura 9000012567.exe 1764 Factura 9000012567.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 drive.google.com 15 drive.google.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1764 Factura 9000012567.exe 3660 Factura 9000012567.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1764 set thread context of 3660 1764 Factura 9000012567.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4544 3660 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Factura 9000012567.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Factura 9000012567.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1764 Factura 9000012567.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1764 wrote to memory of 3660 1764 Factura 9000012567.exe 82 PID 1764 wrote to memory of 3660 1764 Factura 9000012567.exe 82 PID 1764 wrote to memory of 3660 1764 Factura 9000012567.exe 82 PID 1764 wrote to memory of 3660 1764 Factura 9000012567.exe 82 PID 1764 wrote to memory of 3660 1764 Factura 9000012567.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura 9000012567.exe"C:\Users\Admin\AppData\Local\Temp\Factura 9000012567.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\Factura 9000012567.exe"C:\Users\Admin\AppData\Local\Temp\Factura 9000012567.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:3660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 15243⤵
- Program crash
PID:4544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3660 -ip 36601⤵PID:3348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5