Overview
overview
10Static
static
3SeAH RFP_2...df.exe
windows7-x64
10SeAH RFP_2...df.exe
windows10-2004-x64
8$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
SeAH RFP_24-0676·pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SeAH RFP_24-0676·pdf.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240611-en
General
-
Target
SeAH RFP_24-0676·pdf.exe
-
Size
475KB
-
MD5
8951c491b26675b308464af7a29567bd
-
SHA1
883bd6d014e3baf9141b304519fc34eef20eb41f
-
SHA256
3fc5e4d002e04269f2f674e6a2e98935df133ffe0f1fd54c817662d864c2f1b8
-
SHA512
48f909538c8d04839c4a3a0327774e92070a79872231f360a1ce9a4a60ea0f8a7c0bc273787bf0ee07608fabaa56fdf66ca468a1501ecc09e45ed2943ea91134
-
SSDEEP
12288:/qgowhL+Pylw1QeQMQukEsvs5uT8JGjD8WpyLk8n:xR+a3M0ee8JG38lr
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Loads dropped DLL 3 IoCs
Processes:
SeAH RFP_24-0676·pdf.exepid process 1520 SeAH RFP_24-0676·pdf.exe 1520 SeAH RFP_24-0676·pdf.exe 1520 SeAH RFP_24-0676·pdf.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
wab.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wab.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook wab.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wab.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
Processes:
SeAH RFP_24-0676·pdf.exedescription ioc process File created C:\Windows\SysWOW64\energetiskes\Physicianer223.lnk SeAH RFP_24-0676·pdf.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
wab.exepid process 2488 wab.exe 2488 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2616 powershell.exe 2488 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2616 set thread context of 2488 2616 powershell.exe wab.exe -
Drops file in Program Files directory 3 IoCs
Processes:
SeAH RFP_24-0676·pdf.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\eduard.lyz SeAH RFP_24-0676·pdf.exe File opened for modification C:\Program Files (x86)\Common Files\yeastless.Rus SeAH RFP_24-0676·pdf.exe File opened for modification C:\Program Files (x86)\Common Files\Marrowless\Mutated.ini SeAH RFP_24-0676·pdf.exe -
Drops file in Windows directory 1 IoCs
Processes:
SeAH RFP_24-0676·pdf.exedescription ioc process File opened for modification C:\Windows\schematizers.roa SeAH RFP_24-0676·pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepid process 2616 powershell.exe 2616 powershell.exe 2616 powershell.exe 2616 powershell.exe 2616 powershell.exe 2616 powershell.exe 2616 powershell.exe 2616 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2616 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2616 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
SeAH RFP_24-0676·pdf.exepowershell.exedescription pid process target process PID 1520 wrote to memory of 2616 1520 SeAH RFP_24-0676·pdf.exe powershell.exe PID 1520 wrote to memory of 2616 1520 SeAH RFP_24-0676·pdf.exe powershell.exe PID 1520 wrote to memory of 2616 1520 SeAH RFP_24-0676·pdf.exe powershell.exe PID 1520 wrote to memory of 2616 1520 SeAH RFP_24-0676·pdf.exe powershell.exe PID 2616 wrote to memory of 2488 2616 powershell.exe wab.exe PID 2616 wrote to memory of 2488 2616 powershell.exe wab.exe PID 2616 wrote to memory of 2488 2616 powershell.exe wab.exe PID 2616 wrote to memory of 2488 2616 powershell.exe wab.exe PID 2616 wrote to memory of 2488 2616 powershell.exe wab.exe PID 2616 wrote to memory of 2488 2616 powershell.exe wab.exe -
outlook_office_path 1 IoCs
Processes:
wab.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wab.exe -
outlook_win_path 1 IoCs
Processes:
wab.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SeAH RFP_24-0676·pdf.exe"C:\Users\Admin\AppData\Local\Temp\SeAH RFP_24-0676·pdf.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Nervish=Get-Content 'C:\Users\Admin\AppData\Local\Temp\overmandede\Metran\menubilledet\Airbill\Matriherital.Dem230';$Riptide=$Nervish.SubString(71344,3);.$Riptide($Nervish)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\overmandede\Metran\menubilledet\Airbill\Matriherital.Dem230Filesize
69KB
MD5d0e6726fc557c049a1dfd82c836f7616
SHA1b66f1491354cdcf555412e4b18387c993c0c005d
SHA2563a31ac511e35678ba9ec6e4a561c4a33af4bd639f5f8f8cc07a20b6957d73922
SHA512444858aa6db36f3b551239285a0c9463339874b459a54c376fdbc23a353948764a4c6b18d2e89dcdbf0ca8e8a5a8696c6b78f27ae3109156a679b92f9d3c53b9
-
C:\Users\Admin\AppData\Local\Temp\overmandede\Metran\menubilledet\Airbill\trichocephaliasis.SafFilesize
325KB
MD5d55eac0172b4c851f20c0be7e83a51cb
SHA1d62eb151865d4eac3dbdd078fc62e96fb8cce4d9
SHA2562784f2fe1ae608c1dcbef0dd4dd9d712507dd947015ed0113776ea8e63ace910
SHA512fef7d84f1ae4dc95762b97065363fc0034d06ad6a01aea1842e4483d5cc22e8bde845677846f68d93fcad037f2fae2ea2701b594d2ebbc63f03036cc529d354f
-
\Users\Admin\AppData\Local\Temp\nsi2405.tmp\Banner.dllFilesize
4KB
MD5843657eaf7240b695624dcf38bb0eb31
SHA1ca99a44e737fdeaab56f864ce1ef15a57d2eec90
SHA256b935d14c32ad8e16055f7f5794ac3411e601c5ac93155afc623f25b08e2ab82e
SHA5127773d9f6bbd17253d1c96ce225b2f9d3673969b38177afef236d1c5d4aabaae2c07793e07c34f0281ec3b859ae955e83bfe43a598ce7cc6c893ec8c9604f5de3
-
\Users\Admin\AppData\Local\Temp\nsi2405.tmp\BgImage.dllFilesize
7KB
MD5a98576f0d6b35b466cb881860977fdbc
SHA128b3dbbd76f15c876b98dce523100aa3256d193a
SHA2566cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
SHA51229225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c
-
\Users\Admin\AppData\Local\Temp\nsi2405.tmp\nsDialogs.dllFilesize
9KB
MD52c84faebfda2abe3b16fdf374df4272f
SHA1a5b0258a94e0440aefe1ef320e62e7a9a1c8bb40
SHA25672b38e4cca0af336655d55501c4ea05080baaa9921a62a2d717afe90bb801004
SHA512207164cc6914c59d9f4f3b8ae97628c544093ba6ecda9f8da351f453cd97e03be7a640264b8686b2d5e6f3c787f4df1d8a1ebc8e51fd788a97460cd981cc015e
-
memory/2488-60-0x0000000000590000-0x0000000004B52000-memory.dmpFilesize
69.8MB
-
memory/2488-38-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/2616-28-0x0000000073641000-0x0000000073642000-memory.dmpFilesize
4KB
-
memory/2616-32-0x0000000073640000-0x0000000073BEB000-memory.dmpFilesize
5.7MB
-
memory/2616-31-0x0000000073640000-0x0000000073BEB000-memory.dmpFilesize
5.7MB
-
memory/2616-36-0x0000000006630000-0x000000000ABF2000-memory.dmpFilesize
69.8MB
-
memory/2616-37-0x0000000073640000-0x0000000073BEB000-memory.dmpFilesize
5.7MB
-
memory/2616-29-0x0000000073640000-0x0000000073BEB000-memory.dmpFilesize
5.7MB
-
memory/2616-30-0x0000000073640000-0x0000000073BEB000-memory.dmpFilesize
5.7MB