Overview

overview

10

Static

static

3d8a752867...b9.exe

windows7-x64

10

3d8a752867...b9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2023 08:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d8a7528674d15019fad9af9aa35b68cb3f40d10714537e795762ad63dc50cb9.exe

  • Size

    123KB

  • MD5

    eb0ccaa4b2d09b78f4c9e57adb1bd9af

  • SHA1

    269bb16741eff37c35f73d818749ac4a14c172b5

  • SHA256

    3d8a7528674d15019fad9af9aa35b68cb3f40d10714537e795762ad63dc50cb9

  • SHA512

    ba94a4e50ef8864043f0e1dbe3e63dde1d1968987a4731a1ada0e6214bb69b5d741a478c7361a67e69788f621a1aed6f37248553f3af0cfca6681041e64ed359

  • SSDEEP

    3072:WuxVUg3yGDRb8lc7ui5Qq9RfO+KtuqIPDCpAYIbTrPl+aI3:JgORay1k4WuPN+aI3

Score
10/10
guloaderdiscoverydownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d8a7528674d15019fad9af9aa35b68cb3f40d10714537e795762ad63dc50cb9.exe
    "C:\Users\Admin\AppData\Local\Temp\3d8a7528674d15019fad9af9aa35b68cb3f40d10714537e795762ad63dc50cb9.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:1436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsaEA02.tmp\System.dll
    Filesize

    12KB

    MD5

    564bb0373067e1785cba7e4c24aab4bf

    SHA1

    7c9416a01d821b10b2eef97b80899d24014d6fc1

    SHA256

    7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    SHA512

    22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    Download Submit
  • memory/1436-133-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download
  • memory/1436-134-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download
  • memory/1436-135-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download