Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/08/2026, 12:17
General
- Target 701d6201778829a7149cd5eff49fb69471b5597fb39885c7460828415437a0e0.exe
- Size 774KB
- Sample260831-pgc23styaz
- SHA256 701d6201778829a7149cd5eff49fb69471b5597fb39885c7460828415437a0e0
Malware Config
Signatures
- Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\701d6201778829a7149cd5eff49fb69471b5597fb39885c7460828415437a0e0.exe"C:\Users\Admin\AppData\Local\Temp\701d6201778829a7149cd5eff49fb69471b5597fb39885c7460828415437a0e0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle 1 "$Kandis=GC -raw 'C:\Users\Admin\AppData\Local\Witnessers153\raabte\amuletters\Fortaetteren\Kvilibrismens.Ort202';$Postharvest=$Kandis.SubString(52612,3);.$Postharvest($Kandis)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3god2lwr.kv5.ps1
Afbraend67.Dem
Kvilibrismens.Ort202
transudes.jpg
memory/736-75-0x0000000000E60000-0x00000000020B4000-memory.dmp
memory/736-76-0x00000000020C0000-0x000000000311D000-memory.dmp
memory/736-74-0x00000000020C0000-0x000000000311D000-memory.dmp
memory/3128-43-0x0000000002130000-0x0000000002140000-memory.dmp
memory/3128-55-0x00000000071B0000-0x00000000071BE000-memory.dmp
memory/3128-31-0x00000000054C0000-0x0000000005814000-memory.dmp
memory/3128-32-0x0000000005A60000-0x0000000005A7E000-memory.dmp
memory/3128-33-0x0000000005AA0000-0x0000000005AEC000-memory.dmp
memory/3128-34-0x0000000006A40000-0x0000000006AD6000-memory.dmp
memory/3128-35-0x0000000005F70000-0x0000000005F8A000-memory.dmp
memory/3128-36-0x0000000005FE0000-0x0000000006002000-memory.dmp
memory/3128-37-0x00000000072C0000-0x0000000007864000-memory.dmp
memory/3128-23-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/3128-39-0x0000000007EF0000-0x000000000856A000-memory.dmp
memory/3128-40-0x000000007FDF0000-0x000000007FE00000-memory.dmp
memory/3128-41-0x0000000006E70000-0x0000000006EA2000-memory.dmp
memory/3128-52-0x0000000006F00000-0x0000000006FA3000-memory.dmp
memory/3128-51-0x0000000006ED0000-0x0000000006EEE000-memory.dmp
memory/3128-21-0x0000000004AE0000-0x0000000004B02000-memory.dmp
memory/3128-42-0x00000000706B0000-0x00000000706FC000-memory.dmp
memory/3128-53-0x0000000007000000-0x000000000700A000-memory.dmp
memory/3128-54-0x0000000007160000-0x0000000007171000-memory.dmp
memory/3128-22-0x0000000004D80000-0x0000000004DE6000-memory.dmp
memory/3128-56-0x00000000071C0000-0x00000000071D4000-memory.dmp
memory/3128-57-0x0000000007200000-0x000000000721A000-memory.dmp
memory/3128-58-0x00000000071F0000-0x00000000071F8000-memory.dmp
memory/3128-59-0x0000000007200000-0x000000000722A000-memory.dmp
memory/3128-60-0x0000000007250000-0x0000000007274000-memory.dmp
memory/3128-61-0x0000000002130000-0x0000000002140000-memory.dmp
memory/3128-63-0x0000000002130000-0x0000000002140000-memory.dmp
memory/3128-64-0x0000000002130000-0x0000000002140000-memory.dmp
memory/3128-20-0x0000000004E20000-0x0000000005448000-memory.dmp
memory/3128-66-0x0000000007900000-0x0000000007902000-memory.dmp
memory/3128-67-0x0000000008570000-0x00000000095CD000-memory.dmp
memory/3128-68-0x0000000008570000-0x00000000095CD000-memory.dmp
memory/3128-69-0x000000007FDF0000-0x000000007FE00000-memory.dmp
memory/3128-71-0x0000000002130000-0x0000000002140000-memory.dmp
memory/3128-70-0x0000000002130000-0x0000000002140000-memory.dmp
memory/3128-72-0x0000000002130000-0x0000000002140000-memory.dmp
memory/3128-73-0x0000000008570000-0x00000000095CD000-memory.dmp
memory/3128-19-0x0000000002130000-0x0000000002140000-memory.dmp
memory/3128-18-0x0000000002180000-0x00000000021B6000-memory.dmp
memory/3128-17-0x0000000002130000-0x0000000002140000-memory.dmp