Overview

overview

10

Static

static

b0d8884661...4a.exe

windows7-x64

10

b0d8884661...4a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    63s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2023 08:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b0d88846614ad702392ab9d22b7e404159c663a861f8137c3e5aab433a5df74a.exe

  • Size

    123KB

  • MD5

    60b711f18a8e00964584e018cdf7cbf1

  • SHA1

    98c0201d83cfceb4cde69cef351b49b3415ef9fb

  • SHA256

    b0d88846614ad702392ab9d22b7e404159c663a861f8137c3e5aab433a5df74a

  • SHA512

    cafe00054883217d6106010d4e28c060d6a53270699db16314f39894bf1bec3c6e79fdde93a5979330ae706b0c01cb64b16633dd6d820e84768d7b9b4542d8f3

  • SSDEEP

    3072:WuxVUg3yGDRb8lc7uRh4X24XscoffenET8lIbPzXt:JgORaBhE24Xkf2E3Pz9

Score
10/10
guloaderdiscoverydownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0d88846614ad702392ab9d22b7e404159c663a861f8137c3e5aab433a5df74a.exe
    "C:\Users\Admin\AppData\Local\Temp\b0d88846614ad702392ab9d22b7e404159c663a861f8137c3e5aab433a5df74a.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsrBAF3.tmp\System.dll
    Filesize

    12KB

    MD5

    564bb0373067e1785cba7e4c24aab4bf

    SHA1

    7c9416a01d821b10b2eef97b80899d24014d6fc1

    SHA256

    7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    SHA512

    22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    Download Submit
  • memory/2432-133-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download
  • memory/2432-134-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download
  • memory/2432-135-0x0000000000400000-0x0000000000485000-memory.dmp
    Filesize

    532KB

    Download