General
-
Target
6647fa3e5d61d3eb83c211bbce13d04b0cc9af8eb76acaf321b2c47222f83880
-
Size
640KB
-
Sample
220131-19wknsdcf5
-
MD5
23b8e03d5f5b6f906006e43047e78ec1
-
SHA1
3cf86c620c188f02db1ddcce4b9552c4f2bd4dd4
-
SHA256
6647fa3e5d61d3eb83c211bbce13d04b0cc9af8eb76acaf321b2c47222f83880
-
SHA512
800fb8c37fb979b8b93796d2532c8cffc6e09a8586b62cd18bf424f8537e3bffab9a73718e323b6a74e7df09a2d44fb9b91757e405c41ed16a945d3fb494bfd2
Static task
static1
Behavioral task
behavioral1
Sample
6647fa3e5d61d3eb83c211bbce13d04b0cc9af8eb76acaf321b2c47222f83880.doc
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6647fa3e5d61d3eb83c211bbce13d04b0cc9af8eb76acaf321b2c47222f83880.doc
Resource
win10v2004-en-20220112
Malware Config
Extracted
guloader
https://drive.google.com/uc?export=download&id=1rZBJJ1UlUEUL4ybev4yCU57iLG3wWr5F
Targets
-
-
Target
6647fa3e5d61d3eb83c211bbce13d04b0cc9af8eb76acaf321b2c47222f83880
-
Size
640KB
-
MD5
23b8e03d5f5b6f906006e43047e78ec1
-
SHA1
3cf86c620c188f02db1ddcce4b9552c4f2bd4dd4
-
SHA256
6647fa3e5d61d3eb83c211bbce13d04b0cc9af8eb76acaf321b2c47222f83880
-
SHA512
800fb8c37fb979b8b93796d2532c8cffc6e09a8586b62cd18bf424f8537e3bffab9a73718e323b6a74e7df09a2d44fb9b91757e405c41ed16a945d3fb494bfd2
Score10/10-
Executes dropped EXE
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-