Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01-11-2024 06:18

General

  • Target

    FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.exe

  • Size

    729KB

  • MD5

    fb4e88fe6e801bd1770fa1b91ead7bfa

  • SHA1

    3739fd72191b66dce2213abf4ae610ede85efbca

  • SHA256

    c192c16aba9f5bb5ce6eca9e5fff24bbc290e5b820f94868466a61f6d0a2df8e

  • SHA512

    388e96504ab2590600349a91066882a2ce5f3acf74431ae4d6b02475e443a660eb9f374380159f46384ab401bcd56cff053eac4c553ddfd1b767bfa0ea8e9ad2

  • SSDEEP

    12288:DhoX5zcKxyCiN0DSNYCqbf07Ku7DdrJ++F6DJIG6pWu2PACkfwFLuz:Dw4U80DUY1bfyKQ9c+IDPhu2PAX7

Malware Config

Signatures

  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 524
      2⤵
      • Program crash
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\BooConf.ini

    Filesize

    45B

    MD5

    8b9fc0443d7e48145e2d4b37afb2d37b

    SHA1

    64a5718a478a38ac262d2e46da81d0e88c122a0f

    SHA256

    4f743978ead44260f895c983689d718e31ca826161c447d205021a9d3e010afa

    SHA512

    5126da1d29f662465241c8b51b95783df3f88c8feb8bb1b65dcf354738c48aab4bfb6c0035dfe6b40fa03ae5aaba8f72f1c31343aec7d4edb9c6ebcc773cc3d3

  • \Users\Admin\AppData\Local\Temp\nsyE457.tmp\System.dll

    Filesize

    11KB

    MD5

    c61501f07cf09bcfcdfe4cc8a1ebbbe3

    SHA1

    e8581b4359651b857646ae727efaaef372daa0fc

    SHA256

    7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55

    SHA512

    9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24

  • memory/628-27-0x0000000003990000-0x0000000005C56000-memory.dmp

    Filesize

    34.8MB

  • memory/628-28-0x0000000003990000-0x0000000005C56000-memory.dmp

    Filesize

    34.8MB