General

  • Target

    FRA.0038222.exe

  • Size

    896KB

  • Sample

    240523-t3vw8shc2t

  • MD5

    d5ca31fce0d54153f2072b81eb805a55

  • SHA1

    7ce0380bbe9a60e49cc2fca2ef20125d89e663d2

  • SHA256

    bc83149fc8a7767a3b7ea3841f87ccfb068f8430b08fccbc31a2e24684d6f269

  • SHA512

    8c456f221223ecd5fc2b804b4ce30fb568d04a74300f3a11a986c5fc9a5572ede41e6895d128af57ddc77c94bf4f99a2b00d49d1b87c82c3aa808cc8621d29cc

  • SSDEEP

    12288:aVcDbJfzoHFg6lIORVdsY46FBPSLJSO6s7O4lCkt0ywNQOWatBhP5:JDbJfzUu6vvdsedOJP6NwA7tTP

Score
10/10

Malware Config

Targets

    • Target

      FRA.0038222.exe

    • Size

      896KB

    • MD5

      d5ca31fce0d54153f2072b81eb805a55

    • SHA1

      7ce0380bbe9a60e49cc2fca2ef20125d89e663d2

    • SHA256

      bc83149fc8a7767a3b7ea3841f87ccfb068f8430b08fccbc31a2e24684d6f269

    • SHA512

      8c456f221223ecd5fc2b804b4ce30fb568d04a74300f3a11a986c5fc9a5572ede41e6895d128af57ddc77c94bf4f99a2b00d49d1b87c82c3aa808cc8621d29cc

    • SSDEEP

      12288:aVcDbJfzoHFg6lIORVdsY46FBPSLJSO6s7O4lCkt0ywNQOWatBhP5:JDbJfzUu6vvdsedOJP6NwA7tTP

    Score
    10/10
    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      b8992e497d57001ddf100f9c397fcef5

    • SHA1

      e26ddf101a2ec5027975d2909306457c6f61cfbd

    • SHA256

      98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

    • SHA512

      8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

    • SSDEEP

      192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks