Overview

overview

10

Static

static

3

SeAH RFP_2...df.exe

windows7-x64

10

SeAH RFP_2...df.exe

windows10-2004-x64

8

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ge.dll

windows7-x64

1

$PLUGINSDI...ge.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    SeAH RFP_24-0676·pdf.exe
  • Size 475KB
  • Sample240701-p2z3casele
  • SHA256 3fc5e4d002e04269f2f674e6a2e98935df133ffe0f1fd54c817662d864c2f1b8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
guloadercollectiondownloaderexecution

Malware Config

Targets

    • Target
      SeAH RFP_24-0676·pdf.exe
    • Size 475KB
    • SHA256 3fc5e4d002e04269f2f674e6a2e98935df133ffe0f1fd54c817662d864c2f1b8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloadercollectiondownloaderexecution

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/Banner.dll
    • Size 4KB
    • SHA256 b935d14c32ad8e16055f7f5794ac3411e601c5ac93155afc623f25b08e2ab82e
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/BgImage.dll
    • Size 7KB
    • SHA256 6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 72b38e4cca0af336655d55501c4ea05080baaa9921a62a2d717afe90bb801004
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks