Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
Jailkeeper.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Jailkeeper.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Jackhead/keelhauls.scr
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
Jackhead/keelhauls.scr
Resource
win10v2004-20240611-en
General
-
Target
Jailkeeper.exe
-
Size
858KB
-
MD5
c7eefc30a9cdc5bab3269cefde2d221e
-
SHA1
27914bc81bdc74d9607784d9e239f5437b1e8cb1
-
SHA256
2a089fc9b24c5253a913526be0ac2ee62b911a96645cb70885d678c91dcb83c9
-
SHA512
fce33213726f84946162e2c115f67dc4dbfe60af9ca6b6ceb75d576f9370abc98ed0309acf617a2c6f34ffc023632ce1b32391716190980aceb4af84dce3798c
-
SSDEEP
24576:XcIjUna3iVPF+zgyKKht6APjMtiVBsRXRU:kbF50httQbi
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
Processes:
Jailkeeper.exepid process 2624 Jailkeeper.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Jailkeeper.exeJailkeeper.exepid process 2624 Jailkeeper.exe 1248 Jailkeeper.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Jailkeeper.exedescription pid process target process PID 2624 set thread context of 1248 2624 Jailkeeper.exe Jailkeeper.exe -
Drops file in Windows directory 1 IoCs
Processes:
Jailkeeper.exedescription ioc process File opened for modification C:\Windows\reassigned\sandi.ini Jailkeeper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Jailkeeper.exepid process 2624 Jailkeeper.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Jailkeeper.exedescription pid process target process PID 2624 wrote to memory of 1248 2624 Jailkeeper.exe Jailkeeper.exe PID 2624 wrote to memory of 1248 2624 Jailkeeper.exe Jailkeeper.exe PID 2624 wrote to memory of 1248 2624 Jailkeeper.exe Jailkeeper.exe PID 2624 wrote to memory of 1248 2624 Jailkeeper.exe Jailkeeper.exe PID 2624 wrote to memory of 1248 2624 Jailkeeper.exe Jailkeeper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jailkeeper.exe"C:\Users\Admin\AppData\Local\Temp\Jailkeeper.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Jailkeeper.exe"C:\Users\Admin\AppData\Local\Temp\Jailkeeper.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsl4A49.tmp\System.dllFilesize
11KB
MD555a26d7800446f1373056064c64c3ce8
SHA180256857e9a0a9c8897923b717f3435295a76002
SHA256904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
SHA51204b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
-
memory/1248-27-0x0000000001700000-0x000000000254A000-memory.dmpFilesize
14.3MB
-
memory/1248-28-0x0000000077858000-0x0000000077859000-memory.dmpFilesize
4KB
-
memory/1248-29-0x0000000077875000-0x0000000077876000-memory.dmpFilesize
4KB
-
memory/1248-31-0x00000000004A0000-0x00000000016F4000-memory.dmpFilesize
18.3MB
-
memory/1248-32-0x0000000001700000-0x000000000254A000-memory.dmpFilesize
14.3MB
-
memory/1248-34-0x00000000777D1000-0x00000000778F1000-memory.dmpFilesize
1.1MB
-
memory/2624-24-0x0000000004B70000-0x00000000059BA000-memory.dmpFilesize
14.3MB
-
memory/2624-25-0x00000000777D1000-0x00000000778F1000-memory.dmpFilesize
1.1MB
-
memory/2624-26-0x0000000010004000-0x0000000010005000-memory.dmpFilesize
4KB
-
memory/2624-30-0x0000000004B70000-0x00000000059BA000-memory.dmpFilesize
14.3MB
-
memory/2624-39-0x0000000004B70000-0x00000000059BA000-memory.dmpFilesize
14.3MB