Overview

overview

10

Static

static

QUOTATIONs...CO.doc

windows7_x64

10

QUOTATIONs...CO.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATIONs280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.doc

  • Size

    1.9MB

  • Sample

    210421-dpwwd8gwb6

  • MD5

    3ccbb98251c07cf9155261016b6134f5

  • SHA1

    06765b39eb5c9398a068b6815c7feffd2850f97d

  • SHA256

    d5bf70022cddc5dcc04a74847b34876badd532ece66a09b46d4d81c2e0fb7b4f

  • SHA512

    331e6b598f714acacc34f95b99aa60f46c6cbca793a6a8bdc361cbb647708c7de61168cbcbf4f5c5098d0232432d51ab3289684101cab077fef01d81c4f85238

Score
10/10
guloaderdownloaderguloader

Malware Config

Targets

    • Target

      QUOTATIONs280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.doc

    • Size

      1.9MB

    • MD5

      3ccbb98251c07cf9155261016b6134f5

    • SHA1

      06765b39eb5c9398a068b6815c7feffd2850f97d

    • SHA256

      d5bf70022cddc5dcc04a74847b34876badd532ece66a09b46d4d81c2e0fb7b4f

    • SHA512

      331e6b598f714acacc34f95b99aa60f46c6cbca793a6a8bdc361cbb647708c7de61168cbcbf4f5c5098d0232432d51ab3289684101cab077fef01d81c4f85238

    Score
    10/10
    guloaderdownloaderguloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Guloader Payload

      guloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks