Overview

overview

10

Static

static

3

Draft HAWB.pdf.scr

windows7-x64

10

Draft HAWB.pdf.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-07-2024 10:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Draft HAWB.pdf.scr

  • Size

    116KB

  • MD5

    f3f56b99541ffaf22e58c42356d2d9f9

  • SHA1

    2fba8478a48e39df1cf52219ee2517af1bc0214a

  • SHA256

    61fa5ce594de537f26b6fe0da3ff9fec603df1af27c2b2ba89f2ee4a6c981e18

  • SHA512

    1bc479a4dae2afd854eb3e4bbe3b97fa401c4dd71dfc1e571d5a1a3d9eb14056e126d3375a637c1543a798b389df4205c3748b11761d62362d56abd11288c467

  • SSDEEP

    768:czNgrXUKsxOymfSXYr+sR6o+livTlTTTTRvVHOYTTTT4P/9gTTTTTTTTTTTTTTT9:czNguCfEu6s/VC9hUEBxc6hRi

Score
10/10
guloaderdiscoverydownloaderguloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1lwFHDodmljwVaOpWn8UOCTmaZ6GPgsim

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Guloader payload 2 IoCs
    guloader
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Draft HAWB.pdf.scr
    "C:\Users\Admin\AppData\Local\Temp\Draft HAWB.pdf.scr" /S
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\Draft HAWB.pdf.scr" /S
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:1416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1416-4-0x0000000000F00000-0x0000000001000000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1416-5-0x0000000077C31000-0x0000000077D51000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/4392-2-0x00000000020A0000-0x00000000020AA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4392-3-0x0000000077C31000-0x0000000077D51000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/4392-16-0x00000000020A0000-0x00000000020AA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4392-17-0x00000000020A0000-0x00000000020AA000-memory.dmp

    Filesize

    40KB

    Download