Overview

overview

10

Static

static

1

Rfq_last_q...00.cmd

windows7-x64

10

Rfq_last_q...00.cmd

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    02092024_1400_02092024_Rfq_last_quater_product_purchase_order_import_list_2024_000000.7z
  • Size 2KB
  • Sample240902-ra9htasfng
  • SHA256 1dc7435dee3d361dd7de77f4b0795c28e2d4f73a4b16132822260002742e5096
  • MD5 SHA1 SHA512
Score
10/10
guloaderdiscoverydownloaderexecutionpersistence

Malware Config

Targets

    • Target
      Rfq_last_quater_product_purchase_order_import_list_2024_000000.cmd
    • Size 4KB
    • SHA256 a16e6ab8d42469af04bbab862b8676b048cd5a597c4bd2691e604ff36b532958
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloaderdiscoverydownloaderexecutionpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks