Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:46
Static task
static1
Behavioral task
behavioral1
Sample
f7a4ab43ac7b75fa7708fcc5901d463225187fcfcb11d7e871ab854075e090f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f7a4ab43ac7b75fa7708fcc5901d463225187fcfcb11d7e871ab854075e090f4.exe
Resource
win10v2004-20220812-en
General
-
Target
f7a4ab43ac7b75fa7708fcc5901d463225187fcfcb11d7e871ab854075e090f4.exe
-
Size
100KB
-
MD5
ffe86f47459e2f515445d1e218925174
-
SHA1
cc1e32683f665568b4a5d49d465fa565d5d5febd
-
SHA256
f7a4ab43ac7b75fa7708fcc5901d463225187fcfcb11d7e871ab854075e090f4
-
SHA512
6289c762a259144b31f5bf374a2c05da31c0e60b655c61ac63bcc63cac75e20eea0a5d6e4d11b8f6bfddee5e3e946bd26dabf4ae80c98311b09fe614229bc80e
-
SSDEEP
1536:m2AOu4dZGWZD9qmahnNpLdhUNmWJ5s6yEh8/V7v70h/N:mau8qmopQNJrNh8A
Malware Config
Extracted
guloader
http://185.161.211.58/Maly%20nanocre%202021_RbDlvErWAV133.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-56-0x0000000000240000-0x000000000024C000-memory.dmp family_guloader -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f7a4ab43ac7b75fa7708fcc5901d463225187fcfcb11d7e871ab854075e090f4.exepid process 2036 f7a4ab43ac7b75fa7708fcc5901d463225187fcfcb11d7e871ab854075e090f4.exe