Overview

overview

10

Static

static

3

21a7f19500...86.exe

windows7-x64

10

21a7f19500...86.exe

windows10-1703-x64

8

21a7f19500...86.exe

windows10-2004-x64

8

21a7f19500...86.exe

windows11-21h2-x64

8

Resubmissions

10/07/2024, 19:23

240710-x3w13sxhqh 8

10/07/2024, 19:21

240710-x2ytaaxhma 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86

  • Size

    488KB

  • Sample

    240710-x2ytaaxhma

  • MD5

    60b3d713550cd09b16181971027e0df5

  • SHA1

    b5ffb312af1ebc5afd7c7b839fcbd1abaece6503

  • SHA256

    21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86

  • SHA512

    125132cceeb9256b6b64fcaf263187c218ec483296a7ab6cc820cb9ab4e096d0f8c9e064167df67c8fdb91cc9622021374629b8c6795e5d76de3a0c4781c6cab

  • SSDEEP

    12288:R0NwzUrQ2sgRZFh/rRAgYBNL3bHGwkuDvU3BbG:fzSQ25NBONLLQLRC

Score
10/10
guloaderdownloaderexecutionpersistence

Malware Config

Targets

    • Target

      21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86

    • Size

      488KB

    • MD5

      60b3d713550cd09b16181971027e0df5

    • SHA1

      b5ffb312af1ebc5afd7c7b839fcbd1abaece6503

    • SHA256

      21a7f19500a40c4302ccff91f9c4aa34b713cc07183cd83ca45852b6a00afd86

    • SHA512

      125132cceeb9256b6b64fcaf263187c218ec483296a7ab6cc820cb9ab4e096d0f8c9e064167df67c8fdb91cc9622021374629b8c6795e5d76de3a0c4781c6cab

    • SSDEEP

      12288:R0NwzUrQ2sgRZFh/rRAgYBNL3bHGwkuDvU3BbG:fzSQ25NBONLLQLRC

    Score
    10/10
    guloaderdownloaderexecutionpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks