Overview

overview

10

Static

static

3

bfe4aabcee...18.exe

windows7-x64

10

bfe4aabcee...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 02:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    bfe4aabcee56d9ea66622617e6a5fe4b_JaffaCakes118.exe

  • Size

    120KB

  • MD5

    bfe4aabcee56d9ea66622617e6a5fe4b

  • SHA1

    d42ea0954d9bf83a12a85ad01543a157099de63c

  • SHA256

    0512c8c515096734e33d52d39d554b683466183859b968f3c3fc525be6acd69e

  • SHA512

    e578ba6907d916bb4604c2c68250b624c41f2ece9a07270c79ae3487288eca970ca5cf14f0adc625e1341fac73cebdc3b837daa08877574bc9d848ade65044b3

  • SSDEEP

    1536:wbzdIV2eDCsbvzlJAF4aSeH6iRNKipxXJT4r4580MFO/1aqY990:EZemaIF5OSzTHDME//Y990

Score
10/10
guloaderdiscoverydownloaderguloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1v78PFto3JJf_8bTs6JiFNPTELOwzYfT0

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Guloader payload 2 IoCs
    guloader
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfe4aabcee56d9ea66622617e6a5fe4b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bfe4aabcee56d9ea66622617e6a5fe4b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:116
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\bfe4aabcee56d9ea66622617e6a5fe4b_JaffaCakes118.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:4836

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/116-2-0x00000000022D0000-0x00000000022D8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/116-3-0x0000000077C11000-0x0000000077D31000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/116-16-0x00000000022D0000-0x00000000022D8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/116-17-0x00000000022D0000-0x00000000022D8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/4836-5-0x0000000077C11000-0x0000000077D31000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/4836-4-0x0000000000FC0000-0x00000000010C0000-memory.dmp

          Filesize

          1024KB

          Download