Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 20:39
General
-
Target
f989b3a6a8dfa3cb2de35ed0037863ba9ac2d48ea5ab411ca5ee3b6b35fcfeb5.exe
-
Size
96KB
-
MD5
e2777087ae21f30e48b870933f7d21df
-
SHA1
ccbadd732111ab1fd9c75278176e2b592080811f
-
SHA256
f989b3a6a8dfa3cb2de35ed0037863ba9ac2d48ea5ab411ca5ee3b6b35fcfeb5
-
SHA512
27768811dfe75a765277ad13774c679301c6b88c063d7125d06704522363eaa42539bc928c88d5fb765900746fe06d47e8b75a31abe8c4641df34ddb45e50a80
Score
10/10
Malware Config
Extracted
Family
guloader
C2
http://172.93.162.253/bin_XWGtFJzI218.bin
xor.base64
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader Payload 1 IoCs
-
Checks QEMU agent state file 2 TTPs 1 IoCs
Checks state file used by QEMU agent, possibly to detect virtualization.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f989b3a6a8dfa3cb2de35ed0037863ba9ac2d48ea5ab411ca5ee3b6b35fcfeb5.exe"C:\Users\Admin\AppData\Local\Temp\f989b3a6a8dfa3cb2de35ed0037863ba9ac2d48ea5ab411ca5ee3b6b35fcfeb5.exe"1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1268-61-0x00000000002B0000-0x00000000002BD000-memory.dmpFilesize
52KB