Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 16:59
General
- Target f2a14ab6b9d45255710fe9541e761de772ba40370628d6608914e6d47cffba9f.exe
- Size 760KB
- Sample260810-vhtdcatcla
- SHA256 f2a14ab6b9d45255710fe9541e761de772ba40370628d6608914e6d47cffba9f
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Badlisted process makes network request 14 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2a14ab6b9d45255710fe9541e761de772ba40370628d6608914e6d47cffba9f.exe"C:\Users\Admin\AppData\Local\Temp\f2a14ab6b9d45255710fe9541e761de772ba40370628d6608914e6d47cffba9f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Enliveningly84=GC -raw 'C:\Users\Admin\AppData\Local\Witnessers153\raabte\amuletters\predicted.Tei';$Upublicerede=$Enliveningly84.SubString(51000,3);.$Upublicerede($Enliveningly84)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_vsgsqlgp.iu5.ps1
Circumlental.Gul
transudes.jpg
predicted.Tei
memory/1728-78-0x0000000001C60000-0x000000000314E000-memory.dmp
memory/1728-77-0x0000000000A00000-0x0000000001C54000-memory.dmp
memory/4972-53-0x00000000071F0000-0x0000000007293000-memory.dmp
memory/4972-56-0x0000000007360000-0x000000000736E000-memory.dmp
memory/4972-28-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/4972-31-0x00000000057D0000-0x0000000005B24000-memory.dmp
memory/4972-32-0x0000000005D70000-0x0000000005D8E000-memory.dmp
memory/4972-33-0x0000000005E20000-0x0000000005E6C000-memory.dmp
memory/4972-34-0x0000000006D50000-0x0000000006DE6000-memory.dmp
memory/4972-35-0x0000000006290000-0x00000000062AA000-memory.dmp
memory/4972-36-0x00000000062E0000-0x0000000006302000-memory.dmp
memory/4972-37-0x00000000073D0000-0x0000000007974000-memory.dmp
memory/4972-21-0x0000000004DC0000-0x0000000004DE2000-memory.dmp
memory/4972-39-0x0000000008000000-0x000000000867A000-memory.dmp
memory/4972-40-0x000000007F000000-0x000000007F010000-memory.dmp
memory/4972-42-0x000000006F8B0000-0x000000006F8FC000-memory.dmp
memory/4972-41-0x0000000007180000-0x00000000071B2000-memory.dmp
memory/4972-50-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-51-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-52-0x00000000071C0000-0x00000000071DE000-memory.dmp
memory/4972-20-0x0000000005050000-0x0000000005678000-memory.dmp
memory/4972-54-0x00000000072F0000-0x00000000072FA000-memory.dmp
memory/4972-55-0x0000000007310000-0x0000000007321000-memory.dmp
memory/4972-22-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/4972-57-0x0000000007370000-0x0000000007384000-memory.dmp
memory/4972-58-0x00000000073B0000-0x00000000073CA000-memory.dmp
memory/4972-59-0x00000000073A0000-0x00000000073A8000-memory.dmp
memory/4972-60-0x0000000007B20000-0x0000000007B4A000-memory.dmp
memory/4972-61-0x0000000007B50000-0x0000000007B74000-memory.dmp
memory/4972-62-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-64-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-19-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-66-0x00000000072D0000-0x00000000072D2000-memory.dmp
memory/4972-67-0x0000000008680000-0x0000000009B6E000-memory.dmp
memory/4972-68-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-69-0x0000000008680000-0x0000000009B6E000-memory.dmp
memory/4972-70-0x000000007F000000-0x000000007F010000-memory.dmp
memory/4972-71-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-72-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-73-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-74-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/4972-75-0x00000000072D0000-0x00000000072D2000-memory.dmp
memory/4972-76-0x0000000008680000-0x0000000009B6E000-memory.dmp
memory/4972-18-0x0000000002780000-0x00000000027B6000-memory.dmp
memory/4972-17-0x00000000027C0000-0x00000000027D0000-memory.dmp