Overview

overview

10

Static

static

3

z77EU17439...LD.exe

windows7-x64

6

z77EU17439...LD.exe

windows10-2004-x64

10

Retshandli...29.ps1

windows7-x64

8

Retshandli...29.ps1

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    z77EU17439-FT-MILKYLUXGOUDAMILD.exe
  • Size 391KB
  • Sample240429-xrhdjsag2v
  • SHA256 00db1acc412cdb3aa45f4d55c18785ae9e8c8d7d2dcfacd8306d1f79a5c20a8c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
guloaderdownloaderpersistence

Malware Config

Targets

    • Target
      z77EU17439-FT-MILKYLUXGOUDAMILD.exe
    • Size 391KB
    • SHA256 00db1acc412cdb3aa45f4d55c18785ae9e8c8d7d2dcfacd8306d1f79a5c20a8c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    persistenceguloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      Retshandlingerne29.Dat
    • Size 57KB
    • SHA256 af7a18872951b3eef11a71013231b42a2ef418191580cd16505cb8bd4dae8cde
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks