Overview

overview

10

Static

static

3

Assistentu...ne.exe

windows7-x64

10

Assistentu...ne.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Assistentuddannelserne.exe

  • Size

    652KB

  • Sample

    240611-w52hxaxajk

  • MD5

    5edee175c5003771dea841893ea46602

  • SHA1

    14b96459dff641245aea6dacd34512830d945ee2

  • SHA256

    d564eb94afb174fe3b854de086eda2a4e015d778a9aea9806e79f82044eac74e

  • SHA512

    f16f409fa299352007cc5a78950590542c6d846263f5c25b0d80ac32f3b7f92fae2deafb360d1ee6adb73fbbfcc9f0341f730703febf1c0a7013ff4bef7cfb81

  • SSDEEP

    12288:8bzbPZYc4aWV/8RxQM6ybpC2ZQt57tEwV3cyiqr7pDggHIMjbTJ+c:8bzbKc4NUP/dpC2ZQbJ53/XNr

Score
10/10
guloaderdownloader

Malware Config

Targets

    • Target

      Assistentuddannelserne.exe

    • Size

      652KB

    • MD5

      5edee175c5003771dea841893ea46602

    • SHA1

      14b96459dff641245aea6dacd34512830d945ee2

    • SHA256

      d564eb94afb174fe3b854de086eda2a4e015d778a9aea9806e79f82044eac74e

    • SHA512

      f16f409fa299352007cc5a78950590542c6d846263f5c25b0d80ac32f3b7f92fae2deafb360d1ee6adb73fbbfcc9f0341f730703febf1c0a7013ff4bef7cfb81

    • SSDEEP

      12288:8bzbPZYc4aWV/8RxQM6ybpC2ZQt57tEwV3cyiqr7pDggHIMjbTJ+c:8bzbKc4NUP/dpC2ZQbJ53/XNr

    Score
    10/10
    guloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks