Managed XDR

cldownloader.exe — malware analysis report

File info

Filename
cldownloader.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
File size
1.4 MB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
d4e38a1f854d3e57172f4dd4f7d317d2209e193b
SHA256
00000706ea83515d9e97836d58ac1d3bf5fb973a0a8ddc0ec91d82c345eab922
MD5
491e2a4c4fa0b8e1904362bdd3ff569f

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1036.001 invalid_authenticode: Digital signature of the executable file has failed the verification
T1564.001 stealth_file: Creates hidden or system files
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1552 infostealer_browser: Retrieves personal information from local Internet browsers
T1503 infostealer_browser: Retrieves personal information from local Internet browsers
T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1518 recon_programs: Collects information about installed programs
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antivm_queries_computername: Retrieves the computer name
T1135 server_share_info: Retrieves information about each shared resource on a server

Command and Control

T1095 network_icmp: Creates ICMP traffic
T1071.001 network_cnc_http: Suspicious HTTP traffic
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_openurl: Performs HTTP/HTTPS-requests using InternetOpenUrl
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

create_rpc_bindings: Creates RPC connection
require_administrator: Requests administrator privileges
has_pdb: This executable file has a PDB path
creates_exe: Creates executable files in the file system
origin_langid: Unconventional language of the executable file
creates_in_programdata: Creates files in the ProgramData directory
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
writes_data: Writes big amount of data to disk
pe_overlay: PE file contains overlay
suricata_alert: Malicious traffic detected
yara_rules: Static rules