Overview

overview

10

Static

static

3

TERMENII C...at.exe

windows7-x64

7

TERMENII C...at.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TERMENII CONTRACTULUI-pdf.bat.exe

  • Size

    925KB

  • Sample

    241106-swwphsvndq

  • MD5

    45ade5a7d2ba48cc791547736965f440

  • SHA1

    37fb98d6b79231cdaf6b4b6f88f38e575a67742f

  • SHA256

    acdda22ea40a289e3a1ff725de7a933415bf6c143dc60cdb296fe17d36d894ac

  • SHA512

    d89fec7cd5d4c0868daa57eaae1fb92b899ec2cf26ddefe0267da8f347b99aece88b8d7901af8dff6d815c3e69cff657573663cf8a07693fb64c1f3f6ad116e7

  • SSDEEP

    24576:wD2EKyq5H7X3y6MBGYrNizPkY6/mMScs2:wD2EKyGH7ny6MBBizPo/mMScs2

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      TERMENII CONTRACTULUI-pdf.bat.exe

    • Size

      925KB

    • MD5

      45ade5a7d2ba48cc791547736965f440

    • SHA1

      37fb98d6b79231cdaf6b4b6f88f38e575a67742f

    • SHA256

      acdda22ea40a289e3a1ff725de7a933415bf6c143dc60cdb296fe17d36d894ac

    • SHA512

      d89fec7cd5d4c0868daa57eaae1fb92b899ec2cf26ddefe0267da8f347b99aece88b8d7901af8dff6d815c3e69cff657573663cf8a07693fb64c1f3f6ad116e7

    • SSDEEP

      24576:wD2EKyq5H7X3y6MBGYrNizPkY6/mMScs2:wD2EKyGH7ny6MBBizPo/mMScs2

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      61f69388ae89d61a3d838cbcf81b4f82

    • SHA1

      e595c0236a373a6ac79c334dc183ee03ca8f8ecd

    • SHA256

      d65875bb4bc121f81384d55fde90dd9eb9ad1878cd8a02bcb5c8a933c3987a61

    • SHA512

      21d34738cc21c1ef6b0ef1ac53659cdab224bbc20ea983f9a952a2cb4b5785a07bb18c0acf22a0d12a94795e1fc6d314f442c923bb1a93b675edac8c6aacf469

    • SSDEEP

      48:im1CEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0JCof5dwe:F10pl9NLBAZuYtR0hd

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    • SHA1

      7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    • SHA256

      d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    • SHA512

      cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

    • SSDEEP

      192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks