Analysis
-
max time kernel
94s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08-09-2024 14:06
General
-
Target
567865678876.exe
-
Size
80KB
-
MD5
01c5bc40740792aa6d64b78fd8defc2d
-
SHA1
bc69541f4d615dbf30196a853e0207d983cc3eba
-
SHA256
11ccc998a4348adb77d7bb5088a5afe953be17352c04112ca61a5af544ba2eb8
-
SHA512
cbd14685bcd590d4e99ca2dee947dca2cf1349ec3917176c96a54d8899dc1cc6984ac4f5a3598c45f0080417237ae33ffc421cf15b6256e01e41dc3f55f2c60c
-
SSDEEP
768:OhpJR4pPWOc5Pbf10KOx2MXq8B5IntYbPVaUnOLEOzof8ekKifAhq:2J8RQzd0KlmBfzQyOLdE1LY
Score
10/10
Malware Config
Extracted
Family
guloader
C2
https://drive.google.com/uc?export=download&id=15ZM2G4UlQ9cotKEcr2i1E0v4gDrl-zp2
xor.base64
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\567865678876.exe"C:\Users\Admin\AppData\Local\Temp\567865678876.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
44KB