Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01-07-2024 05:58
General
-
Target
P0-ADFUK.bat.exe
-
Size
507KB
-
MD5
4978a40b38d64eae7beead95f608ff51
-
SHA1
b90c23fe02b0f70e22c584411497d2c19e26ca60
-
SHA256
f8f3812fda1d0d0d729de1e37d310a66df34b8e638dcb5da4ca2605dbb4db57e
-
SHA512
fcaab3ec2538d5946e8281a6b5ab6f2dfce5c2978cabbc0a33971f87f92967ff27bd855916762c1c4d1b588c29e8d9ab0fe7bc51baf240c6def3a6211b796198
-
SSDEEP
12288:c19+dlfwYKZWegBNCmmk7aJWjT1U0ML9JiPs:PdloYK7gLVmUblMp
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\P0-ADFUK.bat.exe"C:\Users\Admin\AppData\Local\Temp\P0-ADFUK.bat.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P0-ADFUK.bat.exe"C:\Users\Admin\AppData\Local\Temp\P0-ADFUK.bat.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsl4826.tmp\BgImage.dllFilesize
7KB
MD52d5f40ddc34e9dc8f43b5bf1f61301e3
SHA15ed3cd47affc4d55750e738581fce2b40158c825
SHA256785944e57e8e4971f46f84a07d82dee2ab4e14a68543d83bfe7be7d5cda83143
SHA512605cebcc480cb71ba8241782d89e030a5c01e1359accbde174cb6bdaf249167347ecb06e3781cb9b1cc4b465cef95f1663f0d9766ed84ebade87aa3970765b3e
-
C:\Users\Admin\AppData\Local\Temp\nsl4826.tmp\System.dllFilesize
12KB
MD512b140583e3273ee1f65016becea58c4
SHA192df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA256014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
SHA51249ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
-
C:\Users\Admin\AppData\Local\Temp\nsl4826.tmp\UserInfo.dllFilesize
4KB
MD590228dd140188ec0ca02f7f52e4c9a30
SHA16880d9aeec4c97c4b7718044c9c59b92379feaca
SHA25654bcf3d018734b884bd33a74a05eea0ac3c83501acbdb71ea8ec56ec9402a263
SHA5121a38b1ebb9e2440dd240c8cd2406261e21b544ed392f808d36f78590075f854d89e624589bfddabcace96b33a7f3084c7686351bd66ae07ec035bbef94ef8da2
-
C:\Users\Admin\AppData\Local\Temp\nsl4826.tmp\nsExec.dllFilesize
6KB
MD54a2f4fe4a3ad1de56ee6bf7dd4923963
SHA17cc68b94448c964fd99904e5784b059aed4d5daa
SHA25689b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde
SHA5124b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea
-
memory/3660-45-0x0000000077D85000-0x0000000077D86000-memory.dmpFilesize
4KB
-
memory/3660-49-0x0000000077CE1000-0x0000000077E01000-memory.dmpFilesize
1.1MB
-
memory/3660-47-0x00000000016E0000-0x0000000002B00000-memory.dmpFilesize
20.1MB
-
memory/3660-42-0x00000000016E0000-0x0000000002B00000-memory.dmpFilesize
20.1MB
-
memory/3660-44-0x0000000077D68000-0x0000000077D69000-memory.dmpFilesize
4KB
-
memory/3660-46-0x0000000000480000-0x00000000016D4000-memory.dmpFilesize
18.3MB
-
memory/5076-41-0x0000000074B45000-0x0000000074B46000-memory.dmpFilesize
4KB
-
memory/5076-43-0x00000000041D0000-0x00000000055F0000-memory.dmpFilesize
20.1MB
-
memory/5076-40-0x0000000077CE1000-0x0000000077E01000-memory.dmpFilesize
1.1MB
-
memory/5076-39-0x00000000041D0000-0x00000000055F0000-memory.dmpFilesize
20.1MB
-
memory/5076-54-0x00000000041D0000-0x00000000055F0000-memory.dmpFilesize
20.1MB