Analysis

  • max time kernel
    19s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2024 14:25

General

  • Target

    FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.pif.exe

  • Size

    729KB

  • MD5

    fb4e88fe6e801bd1770fa1b91ead7bfa

  • SHA1

    3739fd72191b66dce2213abf4ae610ede85efbca

  • SHA256

    c192c16aba9f5bb5ce6eca9e5fff24bbc290e5b820f94868466a61f6d0a2df8e

  • SHA512

    388e96504ab2590600349a91066882a2ce5f3acf74431ae4d6b02475e443a660eb9f374380159f46384ab401bcd56cff053eac4c553ddfd1b767bfa0ea8e9ad2

  • SSDEEP

    12288:DhoX5zcKxyCiN0DSNYCqbf07Ku7DdrJ++F6DJIG6pWu2PACkfwFLuz:Dw4U80DUY1bfyKQ9c+IDPhu2PAX7

Malware Config

Signatures

  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.pif.exe
    "C:\Users\Admin\AppData\Local\Temp\FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.pif.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 536
      2⤵
      • Program crash
      PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsu4201.tmp\System.dll

    Filesize

    11KB

    MD5

    c61501f07cf09bcfcdfe4cc8a1ebbbe3

    SHA1

    e8581b4359651b857646ae727efaaef372daa0fc

    SHA256

    7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55

    SHA512

    9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24

  • memory/2380-27-0x0000000003490000-0x0000000005756000-memory.dmp

    Filesize

    34.8MB

  • memory/2380-28-0x0000000003490000-0x0000000005756000-memory.dmp

    Filesize

    34.8MB