Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 22:17
Static task
static1
Behavioral task
behavioral1
Sample
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe
Resource
win10v2004-en-20220113
General
-
Target
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe
-
Size
92KB
-
MD5
232da2765bbf79ea4a51726285cb65d1
-
SHA1
8bd91761024047cd3360716cc68ebdcf604a1854
-
SHA256
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487
-
SHA512
7deacbcae42ab0c42e02af455091a254ab37beb5396be8db40a070ffb343c9f400906838d33e597196cbe22626d5789beac83cf0db39832cd4c6a7b407697002
Malware Config
Extracted
guloader
https://cdn-12.anonfile.com/RdO1lcdaod/77814bdf-1582785178/makave@popeorigin6_encrypted_4407DD0.bin
https://cdn.filesend.jp/private/hcmyj5nD6aJkDXptSilmcc1iHGLaXs0QTpyQDASA5AqNsWXFkzdNappNJ0_8-TEx/makave%40popeorigin6_encrypted_4407DD0.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/840-58-0x0000000000260000-0x000000000026D000-memory.dmp family_guloader behavioral1/memory/1664-63-0x0000000000090000-0x0000000000190000-memory.dmp family_guloader -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exeRegAsm.exepid process 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe 1664 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exedescription pid process target process PID 840 set thread context of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exepid process 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exepid process 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exedescription pid process target process PID 840 wrote to memory of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe PID 840 wrote to memory of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe PID 840 wrote to memory of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe PID 840 wrote to memory of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe PID 840 wrote to memory of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe PID 840 wrote to memory of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe PID 840 wrote to memory of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe PID 840 wrote to memory of 1664 840 d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe"C:\Users\Admin\AppData\Local\Temp\d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\d8eb1f8dd36d03fb77bd957204cac06f71c45b8bde7f7ea1a10f45bb3b259487.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/840-57-0x0000000076491000-0x0000000076493000-memory.dmpFilesize
8KB
-
memory/840-58-0x0000000000260000-0x000000000026D000-memory.dmpFilesize
52KB
-
memory/840-59-0x0000000077BD0000-0x0000000077D79000-memory.dmpFilesize
1.7MB
-
memory/840-60-0x0000000077DB0000-0x0000000077F30000-memory.dmpFilesize
1.5MB
-
memory/1664-63-0x0000000000090000-0x0000000000190000-memory.dmpFilesize
1024KB
-
memory/1664-64-0x0000000077BD0000-0x0000000077D79000-memory.dmpFilesize
1.7MB
-
memory/1664-65-0x0000000077DB0000-0x0000000077F30000-memory.dmpFilesize
1.5MB