Analysis
-
max time kernel
136s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
29-07-2024 11:44
General
-
Target
CEMENTOS-DOC.exe
-
Size
60KB
-
MD5
b7974ace4e5436770ce9b63a315fab68
-
SHA1
43aed757f4864e1fab98d88faf690d84435d036e
-
SHA256
994655b2cfd0979f7b96ae1f4423510633a82adf92fa6486dfd2f3243e96618d
-
SHA512
287938f69f46de39ceeb2bc078dbc6b6e0850f0ad0df676717bd0dba31ae1be4492dbf584c3c816ef7368a1eb01b5ddcbabee7341efc8cfb66fd1503008927cd
-
SSDEEP
768:CZZ3hCu+e5MxzVZpXEewlIAc9BRYxLznw72c:0rCupIZZFrWIbW/c
Score
10/10
Malware Config
Extracted
Family
guloader
C2
https://drive.google.com/uc?export=download&id=1LmyqIluFJ5HoNT0VjWSvtPFmVfK-cvxy
xor.base64
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 1 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CEMENTOS-DOC.exe"C:\Users\Admin\AppData\Local\Temp\CEMENTOS-DOC.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
-
Filesize
1.1MB
-
Filesize
40KB