Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 17:17
General
- Target d546ccfe65927247618f5db67dfcd6791d705034bb7bf4dc592f5042b09ee04b.exe
- Size 855KB
- Sample260810-vtzphahe29
- SHA256 d546ccfe65927247618f5db67dfcd6791d705034bb7bf4dc592f5042b09ee04b
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d546ccfe65927247618f5db67dfcd6791d705034bb7bf4dc592f5042b09ee04b.exe"C:\Users\Admin\AppData\Local\Temp\d546ccfe65927247618f5db67dfcd6791d705034bb7bf4dc592f5042b09ee04b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Femtenaariges=GC -raw 'C:\Users\Admin\AppData\Roaming\mediatizes\historicocultural\Brasswork\striber.Tun';$Nomadeproblemernes=$Femtenaariges.SubString(53523,3);.$Nomadeproblemernes($Femtenaariges)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_q4elngtm.enp.ps1
Auxiliaries.Tsn
striber.Tun
memory/1656-37-0x0000000006EB0000-0x0000000006F46000-memory.dmp
memory/1656-57-0x00000000073A0000-0x00000000073B1000-memory.dmp
memory/1656-58-0x00000000073F0000-0x00000000073FE000-memory.dmp
memory/1656-26-0x0000000005670000-0x00000000056D6000-memory.dmp
memory/1656-23-0x0000000004ED0000-0x00000000054F8000-memory.dmp
memory/1656-32-0x00000000056E0000-0x0000000005A34000-memory.dmp
memory/1656-35-0x0000000005CE0000-0x0000000005CFE000-memory.dmp
memory/1656-36-0x0000000005D10000-0x0000000005D5C000-memory.dmp
memory/1656-20-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-38-0x00000000061D0000-0x00000000061EA000-memory.dmp
memory/1656-39-0x0000000006220000-0x0000000006242000-memory.dmp
memory/1656-40-0x0000000007530000-0x0000000007AD4000-memory.dmp
memory/1656-22-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-42-0x0000000008160000-0x00000000087DA000-memory.dmp
memory/1656-43-0x000000007FB60000-0x000000007FB70000-memory.dmp
memory/1656-44-0x00000000070D0000-0x0000000007102000-memory.dmp
memory/1656-45-0x00000000700D0000-0x000000007011C000-memory.dmp
memory/1656-53-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-54-0x00000000070B0000-0x00000000070CE000-memory.dmp
memory/1656-55-0x0000000007120000-0x00000000071C3000-memory.dmp
memory/1656-24-0x0000000004D20000-0x0000000004D42000-memory.dmp
memory/1656-56-0x0000000007240000-0x000000000724A000-memory.dmp
memory/1656-25-0x0000000005600000-0x0000000005666000-memory.dmp
memory/1656-59-0x0000000007400000-0x0000000007414000-memory.dmp
memory/1656-60-0x0000000007440000-0x000000000745A000-memory.dmp
memory/1656-61-0x0000000007430000-0x0000000007438000-memory.dmp
memory/1656-62-0x0000000007490000-0x00000000074BA000-memory.dmp
memory/1656-63-0x00000000074C0000-0x00000000074E4000-memory.dmp
memory/1656-64-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-66-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-21-0x00000000026D0000-0x0000000002706000-memory.dmp
memory/1656-69-0x0000000007220000-0x0000000007224000-memory.dmp
memory/1656-68-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-70-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-71-0x00000000087E0000-0x000000000ACA8000-memory.dmp
memory/1656-72-0x00000000087E0000-0x000000000ACA8000-memory.dmp
memory/1656-73-0x000000007FB60000-0x000000007FB70000-memory.dmp
memory/1656-74-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-75-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-76-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/1656-77-0x00000000087E0000-0x000000000ACA8000-memory.dmp
memory/3172-81-0x0000000000E80000-0x00000000020D4000-memory.dmp