Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2024 06:18

General

  • Target

    FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.exe

  • Size

    729KB

  • MD5

    fb4e88fe6e801bd1770fa1b91ead7bfa

  • SHA1

    3739fd72191b66dce2213abf4ae610ede85efbca

  • SHA256

    c192c16aba9f5bb5ce6eca9e5fff24bbc290e5b820f94868466a61f6d0a2df8e

  • SHA512

    388e96504ab2590600349a91066882a2ce5f3acf74431ae4d6b02475e443a660eb9f374380159f46384ab401bcd56cff053eac4c553ddfd1b767bfa0ea8e9ad2

  • SSDEEP

    12288:DhoX5zcKxyCiN0DSNYCqbf07Ku7DdrJ++F6DJIG6pWu2PACkfwFLuz:Dw4U80DUY1bfyKQ9c+IDPhu2PAX7

Malware Config

Signatures

  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Users\Admin\AppData\Local\Temp\FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsx8C72.tmp\System.dll

    Filesize

    11KB

    MD5

    c61501f07cf09bcfcdfe4cc8a1ebbbe3

    SHA1

    e8581b4359651b857646ae727efaaef372daa0fc

    SHA256

    7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55

    SHA512

    9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24

  • memory/764-28-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/764-30-0x0000000001660000-0x0000000003926000-memory.dmp

    Filesize

    34.8MB

  • memory/764-37-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/764-38-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/764-39-0x0000000001660000-0x0000000003926000-memory.dmp

    Filesize

    34.8MB

  • memory/764-40-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/764-44-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

  • memory/3552-25-0x0000000004540000-0x0000000006806000-memory.dmp

    Filesize

    34.8MB

  • memory/3552-26-0x00000000776E1000-0x0000000077801000-memory.dmp

    Filesize

    1.1MB

  • memory/3552-27-0x0000000074545000-0x0000000074546000-memory.dmp

    Filesize

    4KB

  • memory/3552-29-0x0000000004540000-0x0000000006806000-memory.dmp

    Filesize

    34.8MB