Analysis

  • max time kernel
    149s
  • max time network
    277s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 17:16

General

  • Target

    PORUDZBENICA.exe

  • Size

    820KB

  • MD5

    5854b91e3d1ef91530f96c70c8425106

  • SHA1

    f6739b8f7d97012d8d21f94ef0116b860b120b9c

  • SHA256

    5fb792bb1793ff9314b4a3a4d3f8e267f9b833ae9467b42f0bd7df012de5d0f0

  • SHA512

    1fb6e0cf17dfef6945b11fc4d5faed2a926826b64be1a76add384dc51fcd1f0c76bb8e722bcc32e2b5d0d43e807132762048e48b8fdaf42def346b53dbd685d5

  • SSDEEP

    24576:TG+yYqTgm8Lt7VUD7LE8oy9jRKta3uja581CV:66eJKUD7L7o/aT

Malware Config

Signatures

  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe
    "C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe
      "C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsq9480.tmp\System.dll

    Filesize

    12KB

    MD5

    192639861e3dc2dc5c08bb8f8c7260d5

    SHA1

    58d30e460609e22fa0098bc27d928b689ef9af78

    SHA256

    23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

    SHA512

    6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

  • memory/396-23252-0x0000000000401000-0x0000000000404000-memory.dmp

    Filesize

    12KB

  • memory/396-23257-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/396-23251-0x0000000077B01000-0x0000000077C21000-memory.dmp

    Filesize

    1.1MB

  • memory/396-23264-0x0000000000401000-0x0000000000404000-memory.dmp

    Filesize

    12KB

  • memory/396-23241-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/396-23242-0x0000000001660000-0x00000000020C9000-memory.dmp

    Filesize

    10.4MB

  • memory/396-23243-0x0000000077B88000-0x0000000077B89000-memory.dmp

    Filesize

    4KB

  • memory/396-23244-0x0000000077BA5000-0x0000000077BA6000-memory.dmp

    Filesize

    4KB

  • memory/396-23254-0x0000000000401000-0x0000000000404000-memory.dmp

    Filesize

    12KB

  • memory/396-23249-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/396-23263-0x0000000001660000-0x00000000020C9000-memory.dmp

    Filesize

    10.4MB

  • memory/396-23262-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/396-23248-0x0000000001660000-0x00000000020C9000-memory.dmp

    Filesize

    10.4MB

  • memory/396-23253-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/396-23255-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/396-23256-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/396-23259-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/396-23258-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/4060-23238-0x0000000077B01000-0x0000000077C21000-memory.dmp

    Filesize

    1.1MB

  • memory/4060-23239-0x00000000747F5000-0x00000000747F6000-memory.dmp

    Filesize

    4KB

  • memory/4060-23240-0x0000000002F20000-0x0000000003989000-memory.dmp

    Filesize

    10.4MB

  • memory/4060-23237-0x0000000002F20000-0x0000000003989000-memory.dmp

    Filesize

    10.4MB