Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
25/07/2024, 15:34
General
-
Target
ACINACEOUS.exe
-
Size
124KB
-
MD5
246d2cc9a5452ba99a079d06d11011b5
-
SHA1
f2a1e04e91de8e10eb62dde7cc6d932b3a3cf294
-
SHA256
c3986fbb4678bbdd6b8cd2b850bdeff03ebf9cbe4226c5107bd059459510ced7
-
SHA512
b4dd6893c090c347f03160158292ca54c6d35a72a6e81d527b77c69b56e4d44f17de754bac816860b617db9bb443db088aaa01ec34b5e51e0a4423fef6b9dcdb
-
SSDEEP
1536:1pGPwzxA4k4gpX2F7rg/afm5yw2euHXjr+JnxjyCQq8nvls:1g4EU7r6afm5ywkO65e
Score
10/10
Malware Config
Extracted
Family
guloader
C2
https://drive.google.com/uc?export=download&id=12gFK6qzFV_ZNQm5z-4O5m7KVXdF87z79
xor.base64
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ACINACEOUS.exe"C:\Users\Admin\AppData\Local\Temp\ACINACEOUS.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
44KB