Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
08/08/2023, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
3e126300aea902a20d883fa4eff7d5c00705fd8c5ee845246a04684e8bd73a22.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3e126300aea902a20d883fa4eff7d5c00705fd8c5ee845246a04684e8bd73a22.exe
Resource
win10v2004-20230703-en
General
-
Target
3e126300aea902a20d883fa4eff7d5c00705fd8c5ee845246a04684e8bd73a22.exe
-
Size
140KB
-
MD5
9771203ca5a36cf742a09c58008e1d48
-
SHA1
b83e5dad16f610c336ae049f7b7c4fe79fd99720
-
SHA256
3e126300aea902a20d883fa4eff7d5c00705fd8c5ee845246a04684e8bd73a22
-
SHA512
5a1b66ab79062b1a7b6067cd6a0d0abcedb7c2cbe3dc9e3b39fedc7682de6b17ed4931ededf149a98b013f445deb99ec8e80c7ff03e555c7c9efc693539db618
-
SSDEEP
3072:c5CCbi+/47tQatuMBmrBeMn5m4vvt6g58:Wi+/g/tuMQlzVntV
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 3e126300aea902a20d883fa4eff7d5c00705fd8c5ee845246a04684e8bd73a22.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2568 3e126300aea902a20d883fa4eff7d5c00705fd8c5ee845246a04684e8bd73a22.exe