Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 17:23
General
- Target d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f.exe
- Size 687KB
- Sample260810-vx68rayybv
- SHA256 d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f.exe"C:\Users\Admin\AppData\Local\Temp\d4bb9d06e50d0009f7380cea2a2c44bafe0b2419b5d1ed69f852135c72e0f20f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Sanemindedness=GC -raw 'C:\Users\Admin\AppData\Roaming\bookmakeriet\windowpane\Sumer.Rdt';$Lavsts1=$Sanemindedness.SubString(4235,3);.$Lavsts1($Sanemindedness)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_b34xwpgg.qtq.ps1
Kamikken.Reg
Sumer.Rdt
memory/2928-54-0x0000000007A90000-0x0000000007A9A000-memory.dmp
memory/2928-56-0x0000000007B00000-0x0000000007B0E000-memory.dmp
memory/2928-57-0x0000000007B10000-0x0000000007B24000-memory.dmp
memory/2928-24-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/2928-26-0x0000000005F40000-0x0000000006294000-memory.dmp
memory/2928-22-0x0000000005680000-0x0000000005CA8000-memory.dmp
memory/2928-34-0x0000000006530000-0x000000000654E000-memory.dmp
memory/2928-35-0x0000000006550000-0x000000000659C000-memory.dmp
memory/2928-36-0x00000000074F0000-0x0000000007586000-memory.dmp
memory/2928-37-0x0000000006A10000-0x0000000006A2A000-memory.dmp
memory/2928-38-0x0000000006A60000-0x0000000006A82000-memory.dmp
memory/2928-39-0x0000000007B80000-0x0000000008124000-memory.dmp
memory/2928-21-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-41-0x00000000087B0000-0x0000000008E2A000-memory.dmp
memory/2928-42-0x000000007F490000-0x000000007F4A0000-memory.dmp
memory/2928-44-0x0000000070340000-0x000000007038C000-memory.dmp
memory/2928-52-0x0000000007900000-0x000000000791E000-memory.dmp
memory/2928-43-0x0000000007920000-0x0000000007952000-memory.dmp
memory/2928-53-0x0000000007970000-0x0000000007A13000-memory.dmp
memory/2928-19-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-23-0x0000000005560000-0x0000000005582000-memory.dmp
memory/2928-55-0x0000000007AB0000-0x0000000007AC1000-memory.dmp
memory/2928-25-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/2928-58-0x0000000007B50000-0x0000000007B6A000-memory.dmp
memory/2928-59-0x0000000007B40000-0x0000000007B48000-memory.dmp
memory/2928-60-0x00000000082C0000-0x00000000082EA000-memory.dmp
memory/2928-61-0x00000000082F0000-0x0000000008314000-memory.dmp
memory/2928-62-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-64-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-66-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-65-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-20-0x0000000004F60000-0x0000000004F96000-memory.dmp
memory/2928-68-0x0000000007A70000-0x0000000007A72000-memory.dmp
memory/2928-69-0x0000000008E30000-0x000000000AF57000-memory.dmp
memory/2928-70-0x0000000008E30000-0x000000000AF57000-memory.dmp
memory/2928-71-0x000000007F490000-0x000000007F4A0000-memory.dmp
memory/2928-72-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-74-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-75-0x0000000005040000-0x0000000005050000-memory.dmp
memory/2928-76-0x0000000007A70000-0x0000000007A72000-memory.dmp
memory/2928-77-0x0000000008E30000-0x000000000AF57000-memory.dmp
memory/4028-80-0x0000000001200000-0x0000000002454000-memory.dmp