Analysis
-
max time kernel
98s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
-
submitted
14-02-2025 11:11
General
-
Target
PAGO.cmd
-
Size
959KB
-
MD5
b7819321f80217a516dc2649097a6cc4
-
SHA1
c35be052ffa3ad243512cafee4034656399f52cd
-
SHA256
77e15415d2427d168202684e80034c83d83230deee10efe86cf07049af98d77c
-
SHA512
8fd59280dd6658b6b105936eda91555e6c1f7c0f6b7aebfe3df7c74a6b94db2498acc36d896e31d9de63c8d0073fb25127c249d1c9ca15ba09127f83cb6a6525
-
SSDEEP
12288:UPCl0t4TkEIroYUI2K/AtBb2d/fNguvEc4sI20geXazMbkJ/i3O2CHaAUwvUbcYG:UKRfcOe4hDgeqzRJ/LLU6WcbTtUi
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Downloads MZ/PE file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 11 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
NSIS installer 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PAGO.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript p.js2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\maxthon.pifmaxthon.pif2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\maxthon.pifmaxthon.pif3⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjIxQTk2QUMtN0M1Qy00RURDLTgzMEItRkZEQkM1MjhDODQ0fSIgdXNlcmlkPSJ7N0RERkE5NEYtOTdGQS00QjRCLUI2QTAtOTA4NkJCMzc3MjU2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NEYzMDM0MDctMjk3MS00NDRDLUFFREYtOEIzMkQ2QzA1NjE2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMyMzYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI1MTE0ODAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTgwOTcwNTc1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
622KB
MD5ff0fdae83407b8ff69f9c665bab0d7d4
SHA1a6f10986b185a604dd458b9f535a01e3d325bcc2
SHA2560e3390f3f7bd283296ca3ee73ba5d9cb76d5132ed7d7c17e97789478a8a2f27b
SHA51272037c874b127b7eeb54594381041fb540185900ab5b937088741ee24750d4fcce7f8df31f753462a302b278ce0799f8c9d22bd315422cb633debc849f800615
-
Filesize
5KB
MD57af1e33d85459fbd2cf7ef29d7528e9e
SHA18a90d81eeabd6886e5b5985d3d10e3f435ccf00d
SHA256958b118ec87610f25232eb6257168bdbbf210cf2511bf38fb54bf4ffc908abb2
SHA5121aa61538a5fec5bb27dca4305f4b856446e032321f55f26c5e949bb125220a4c319c51c2050697cda6c39ba784eaf2f041ee742f57d3e2e8a6e9f6ec96007145
-
Filesize
11KB
MD5375e8a08471dc6f85f3828488b1147b3
SHA11941484ac710fc301a7d31d6f1345e32a21546af
SHA2564c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
SHA5125ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8
-
Filesize
454B
MD5512de64f32a0387d27f0d77251ea264c
SHA11f394a3cff8a9c0d7b5126859ec10356b9885cc4
SHA256fc89b98b929495596a34a2dff20fe6100c79b730d7e5734d0bf7f0c001a5ad7d
SHA5128b9f78ad373c1e11f441ef6fa9ea1d57776e11a1c0e39bc6de92aeba95a6d0c5228942869abd3e7ff82ca66b59545a9e8c0c5f6281b79baf3dbc7cfd933cabe9
-
Filesize
861KB
MD53738d9b4b11a30ab9395879e4ab25587
SHA14e51f637c25aec858fe6c80f126685c31f3c9590
SHA2565898b70fa5caa97424d8ffe51a95b648123bfe8f4a1d844b76d5b398fc59aad8
SHA5121c0a7361c2c459e3165643df226b1289678b1182097a3cff2cc2d16eddd0866f4e2a639e153b62c1703017e007139db1f8139cc9b36f14d54b0d8e2df28e566c
-
Filesize
4KB
MD578eb10eb6f4cb32466fd6058763c8649
SHA189558100fac2d33409f8152d4c7b163a1f03489f
SHA256a8fa027ddaa121753bbdb61f1f94b768b39c413d387902df4ba368279e60ca1e
SHA512cf77ebf898b350d9a5fc69e4a5b7766f62a35cd9dd8818c98bf99d0f1bd485ac6e03bb44ebe4acae9c06db1b454127325aaeeaefb4ce4f97a3b426719b8f738a
-
Filesize
11.6MB
-
Filesize
18.3MB
-
Filesize
11.6MB
-
Filesize
18.3MB
-
Filesize
11.6MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
11.6MB
-
Filesize
11.6MB