Analysis
-
max time kernel
79s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 16:56
General
-
Target
rNuevo_Pedido_129149.exe
-
Size
750KB
-
MD5
5c64ce5f7c6b88767f77b788a4fb5b19
-
SHA1
05cf5307feb87910eef79cec65ee8ab1613e28a9
-
SHA256
8d9cacf5c0689e332f4e043117ecdc533edf1b52b65179885ceb284ff706a6fe
-
SHA512
25caeddc9d0c42b0ab1d7f6d81303c3b44be9adb3ce5e1ac49f3c78b5cd98c6f05ff07c49c0b79b2d140cb520a0f7bfbf1a7ffe549018417dd1ac44e25c0e045
-
SSDEEP
12288:AuO/1lVnS6t0bXm0Uf+2Pvmj8vZ8piCM3dj3DcLIPDgMlXZo+LLhz78q6TMmC93V:Q/1lYFLmVft2j15MNj3wLsA+f54qQMmM
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rNuevo_Pedido_129149.exe"C:\Users\Admin\AppData\Local\Temp\rNuevo_Pedido_129149.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rNuevo_Pedido_129149.exe"C:\Users\Admin\AppData\Local\Temp\rNuevo_Pedido_129149.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38B
MD5a0d91a2f9acb4dec3b5260aba27839c4
SHA18a9037c691a2bdeebcab8bf3d4c954e62aca9207
SHA256773cd6fba7d53550b4c41aa889e330b744a7a579df2bb02212773b67e72f5844
SHA512d3df7852aea197e901c787cd8d943faaa30ee9a6678c4853ed0bb494679897854e4e7556f420f1c176443a485cf1e02e0b4bff86f8da4017a053362b2c9a0608
-
Filesize
12KB
MD512b140583e3273ee1f65016becea58c4
SHA192df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA256014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
SHA51249ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
-
Filesize
850B
MD5b56043557b75f6cbd42fa1c1e40783f1
SHA1260a58c95b702809cf2052d726dfa845e6031e7c
SHA256ac5b7c1449548986e2565845069b9802432241b97b19a95e5e4b91d853d19bda
SHA5124027eb73ee9cbfb26211dac285ccba4f389e04dc56ae9bb3286d2ce56200112387eb81f24bd3bd129f8a13ff7b9b27ef2cf74713f4ffc34843abe591cc182753
-
Filesize
20.8MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
20.8MB
-
Filesize
20.8MB
-
Filesize
20.8MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
20.8MB