Overview

overview

10

Static

static

440dadf7bd...2a.exe

windows7-x64

10

440dadf7bd...2a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2023 08:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    440dadf7bdae3e28af8681f2f8ca9d5c4821a95ffc46119d7240eaf3fa01932a.exe

  • Size

    123KB

  • MD5

    a9dfbf6414576da8cd0d54f2dae807be

  • SHA1

    56c7034aef6f9e53b1a9f7665f8e021b791df0d1

  • SHA256

    440dadf7bdae3e28af8681f2f8ca9d5c4821a95ffc46119d7240eaf3fa01932a

  • SHA512

    b69b4ff9ac0fd662b1b5b9885e1217a0292719232b407e7ca79760465841810e66f2a5838a0f23f97d1460e777069a331b06d4b45532413d28b52081b595a2a0

  • SSDEEP

    3072:WuxVUg3yGDRb8lc7uoZd4AQdFttdOsc09aarq3gmHRIbWDT3:JgORaz/d3tdP9aJgI0wb

Score
10/10
guloaderdiscoverydownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\440dadf7bdae3e28af8681f2f8ca9d5c4821a95ffc46119d7240eaf3fa01932a.exe
    "C:\Users\Admin\AppData\Local\Temp\440dadf7bdae3e28af8681f2f8ca9d5c4821a95ffc46119d7240eaf3fa01932a.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsnB12F.tmp\System.dll
    Filesize

    12KB

    MD5

    564bb0373067e1785cba7e4c24aab4bf

    SHA1

    7c9416a01d821b10b2eef97b80899d24014d6fc1

    SHA256

    7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    SHA512

    22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    Download Submit
  • memory/1748-133-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download
  • memory/1748-134-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download
  • memory/1748-135-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download