Overview

overview

10

Static

static

3

2e38ec7bb6...44.exe

windows7-x64

7

2e38ec7bb6...44.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e38ec7bb6b82799b0c016634cd39748b0ace2e889cf9fcdb5550f293a123344.exe

  • Size

    717KB

  • Sample

    240903-bvfhgashrm

  • MD5

    8d145a0a9e1675eacae38f75bd733a4d

  • SHA1

    cb83fb1a99a5969f5d73f2f4fe7baa1552f5503b

  • SHA256

    2e38ec7bb6b82799b0c016634cd39748b0ace2e889cf9fcdb5550f293a123344

  • SHA512

    39614bb76e55c3f0064de266cbfaa7232582ce078d3d06797839863ffb678b6dee438cf36a5f668b13cecc30ce096c36f623d302046e9c47b7b6e255f9785170

  • SSDEEP

    12288:YTNq+SR77qKz7eAhtWQ+tqMSPIUpsgTylZV5kaurAKyOgRRxye:YTcdaieAhtWXqMNUpNSZV5kae6Oc

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      2e38ec7bb6b82799b0c016634cd39748b0ace2e889cf9fcdb5550f293a123344.exe

    • Size

      717KB

    • MD5

      8d145a0a9e1675eacae38f75bd733a4d

    • SHA1

      cb83fb1a99a5969f5d73f2f4fe7baa1552f5503b

    • SHA256

      2e38ec7bb6b82799b0c016634cd39748b0ace2e889cf9fcdb5550f293a123344

    • SHA512

      39614bb76e55c3f0064de266cbfaa7232582ce078d3d06797839863ffb678b6dee438cf36a5f668b13cecc30ce096c36f623d302046e9c47b7b6e255f9785170

    • SSDEEP

      12288:YTNq+SR77qKz7eAhtWQ+tqMSPIUpsgTylZV5kaurAKyOgRRxye:YTcdaieAhtWXqMNUpNSZV5kae6Oc

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      014a3be4a7c1ccb217916dbf4f222bd1

    • SHA1

      9b4c41eb0e84886beb5591d8357155e27f9c68ed

    • SHA256

      09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

    • SHA512

      0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

    • SSDEEP

      48:S46+/iTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mMofjLl:zsuPbOBtWZBV8jAWiAJCdv2CmfL

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      564bb0373067e1785cba7e4c24aab4bf

    • SHA1

      7c9416a01d821b10b2eef97b80899d24014d6fc1

    • SHA256

      7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    • SHA512

      22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    • SSDEEP

      192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks