Analysis
-
max time kernel
3s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2024, 03:24
Static task
static1
Behavioral task
behavioral1
Sample
8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
General
-
Target
8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe
-
Size
545KB
-
MD5
af7981a2ac42f21ac4820f14bbb294b2
-
SHA1
51d83fde26f84015365231c9526cc26adf2e3bf0
-
SHA256
8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c
-
SHA512
866320fc0b724695cfa9e1abf2f673ab48150bdab109f30106bd838ca3ba6aa5e50eb554e217e2bec974065a5a0ecb735d65abc5c8493abe1d14537ca73c1ef1
-
SSDEEP
6144:lp+ggeIHjncXksyUHxAqJ1LGmg8EmDu7dRQ26RihUvqhEYGZtrLBU91BscRt1y/n:7XYvfs1c8JGRQ2UicttUjy82Ki5p
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
pid Process 380 8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"1⤵
- Loads dropped DLL
PID:380 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"2⤵PID:4952
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"2⤵PID:1932
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Users\Admin\AppData\Local\Temp\8e00826760dc9f5c25a3b538ba87d656c76b645135abf11bd55f5de81fc4273c.exe"2⤵PID:3096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4