Analysis
-
max time kernel
149s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2024 17:16
Static task
static1
Behavioral task
behavioral1
Sample
PORUDZBENICA.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
PORUDZBENICA.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
PORUDZBENICA.exe
-
Size
820KB
-
MD5
5854b91e3d1ef91530f96c70c8425106
-
SHA1
f6739b8f7d97012d8d21f94ef0116b860b120b9c
-
SHA256
5fb792bb1793ff9314b4a3a4d3f8e267f9b833ae9467b42f0bd7df012de5d0f0
-
SHA512
1fb6e0cf17dfef6945b11fc4d5faed2a926826b64be1a76add384dc51fcd1f0c76bb8e722bcc32e2b5d0d43e807132762048e48b8fdaf42def346b53dbd685d5
-
SSDEEP
24576:TG+yYqTgm8Lt7VUD7LE8oy9jRKta3uja581CV:66eJKUD7L7o/aT
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
pid Process 4060 PORUDZBENICA.exe 4060 PORUDZBENICA.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 396 PORUDZBENICA.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4060 PORUDZBENICA.exe 396 PORUDZBENICA.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4060 set thread context of 396 4060 PORUDZBENICA.exe 97 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\customization.rom PORUDZBENICA.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\primy.ini PORUDZBENICA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PORUDZBENICA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PORUDZBENICA.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe 396 PORUDZBENICA.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4060 PORUDZBENICA.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4060 wrote to memory of 396 4060 PORUDZBENICA.exe 97 PID 4060 wrote to memory of 396 4060 PORUDZBENICA.exe 97 PID 4060 wrote to memory of 396 4060 PORUDZBENICA.exe 97 PID 4060 wrote to memory of 396 4060 PORUDZBENICA.exe 97 PID 4060 wrote to memory of 396 4060 PORUDZBENICA.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"C:\Users\Admin\AppData\Local\Temp\PORUDZBENICA.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5192639861e3dc2dc5c08bb8f8c7260d5
SHA158d30e460609e22fa0098bc27d928b689ef9af78
SHA25623d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
SHA5126e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc