Analysis
-
max time kernel
13s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-11-2024 14:27
General
-
Target
f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe
-
Size
810KB
-
MD5
f7fc33c3bcded454047a6bfaf99f1452
-
SHA1
a23a2448f373a4319fc0722b72595815d27c62c6
-
SHA256
f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb
-
SHA512
0211b32321c50653fbf67190cd24455d997016f7cc9fe7e86457dfeda647ba326c2e0c2fa5d352a98ef4ec82724cd7ab50dc9988cb7e354f99623e0aa6740d29
-
SSDEEP
24576:pG+yftcZ0DbBTVsVQ7LE8oy9jRKta3uja581Cj:wPcZ0BuO7L7o/a5
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe"C:\Users\Admin\AppData\Local\Temp\f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe"C:\Users\Admin\AppData\Local\Temp\f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 10763⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5644 -ip 56441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5192639861e3dc2dc5c08bb8f8c7260d5
SHA158d30e460609e22fa0098bc27d928b689ef9af78
SHA25623d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
SHA5126e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
-
Filesize
33B
MD576d9175a3db7407eb0bfc3c07ddcd9d2
SHA172071127e9a44935cb02650ed715ccaf6a8f8418
SHA2561f7119996dd17af05bf05e497104715bbbc3909676afa4329fbd59502be1a1a5
SHA5125032dab71e70a4bd1dad2f5cf9380e0097be7993bc46886fed6e4bdd8781f2b10d31338d90d0dc5804665bda2cbfe93f1172250e1a8ab7c9118baf9f156e3c69
-
Filesize
13.7MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
13.7MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
13.7MB
-
Filesize
13.7MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB