Overview

overview

10

Static

static

3

643c1b8444...6c.exe

windows7-x64

7

643c1b8444...6c.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    643c1b8444da8c89fa83aed917307b6c.bat

  • Size

    933KB

  • Sample

    241106-kgb3kaxdpn

  • MD5

    643c1b8444da8c89fa83aed917307b6c

  • SHA1

    dda8fa31873ef7f27e22f712a2e0b6a7ae91a582

  • SHA256

    137742d1bb597a2818431b1634f38a9d93069afc1657955ef7144c152eb26f86

  • SHA512

    61636bf0eabf40ef8085a68170339184a73b7a3a528604853a75e577b549240de7a78a1c879757b510a13746184caf678d05e1e77c8c7a9241cbd7c2e2b87def

  • SSDEEP

    12288:2dD2EUL1JUodNF0bzjryAqlBGWcz+izP1niQPqDEfRuLCMrecszC/:wD2EK1JzW3jGxBGDaizPkY6/mMScs2

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      643c1b8444da8c89fa83aed917307b6c.bat

    • Size

      933KB

    • MD5

      643c1b8444da8c89fa83aed917307b6c

    • SHA1

      dda8fa31873ef7f27e22f712a2e0b6a7ae91a582

    • SHA256

      137742d1bb597a2818431b1634f38a9d93069afc1657955ef7144c152eb26f86

    • SHA512

      61636bf0eabf40ef8085a68170339184a73b7a3a528604853a75e577b549240de7a78a1c879757b510a13746184caf678d05e1e77c8c7a9241cbd7c2e2b87def

    • SSDEEP

      12288:2dD2EUL1JUodNF0bzjryAqlBGWcz+izP1niQPqDEfRuLCMrecszC/:wD2EK1JzW3jGxBGDaizPkY6/mMScs2

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      61f69388ae89d61a3d838cbcf81b4f82

    • SHA1

      e595c0236a373a6ac79c334dc183ee03ca8f8ecd

    • SHA256

      d65875bb4bc121f81384d55fde90dd9eb9ad1878cd8a02bcb5c8a933c3987a61

    • SHA512

      21d34738cc21c1ef6b0ef1ac53659cdab224bbc20ea983f9a952a2cb4b5785a07bb18c0acf22a0d12a94795e1fc6d314f442c923bb1a93b675edac8c6aacf469

    • SSDEEP

      48:im1CEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0JCof5dwe:F10pl9NLBAZuYtR0hd

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    • SHA1

      7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    • SHA256

      d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    • SHA512

      cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

    • SSDEEP

      192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks