Analysis
-
max time kernel
11s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 09:25
General
-
Target
PORUDZBENICA.exe
-
Size
820KB
-
MD5
5854b91e3d1ef91530f96c70c8425106
-
SHA1
f6739b8f7d97012d8d21f94ef0116b860b120b9c
-
SHA256
5fb792bb1793ff9314b4a3a4d3f8e267f9b833ae9467b42f0bd7df012de5d0f0
-
SHA512
1fb6e0cf17dfef6945b11fc4d5faed2a926826b64be1a76add384dc51fcd1f0c76bb8e722bcc32e2b5d0d43e807132762048e48b8fdaf42def346b53dbd685d5
-
SSDEEP
24576:TG+yYqTgm8Lt7VUD7LE8oy9jRKta3uja581CV:66eJKUD7L7o/aT
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5192639861e3dc2dc5c08bb8f8c7260d5
SHA158d30e460609e22fa0098bc27d928b689ef9af78
SHA25623d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
SHA5126e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
-
Filesize
33B
MD576d9175a3db7407eb0bfc3c07ddcd9d2
SHA172071127e9a44935cb02650ed715ccaf6a8f8418
SHA2561f7119996dd17af05bf05e497104715bbbc3909676afa4329fbd59502be1a1a5
SHA5125032dab71e70a4bd1dad2f5cf9380e0097be7993bc46886fed6e4bdd8781f2b10d31338d90d0dc5804665bda2cbfe93f1172250e1a8ab7c9118baf9f156e3c69
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
10.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.4MB
-
Filesize
1.1MB
-
Filesize
10.4MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
10.4MB
-
Filesize
10.4MB