Analysis
-
max time kernel
15s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-11-2024 06:36
General
-
Target
Calyciform.exe
-
Size
418KB
-
MD5
0b813c3349387a69277d7f8a0d20fe3d
-
SHA1
d0c4aa5fffba33d1f7c9c184cd3acb90f6a75650
-
SHA256
d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad
-
SHA512
d3b46abc8583f2a12c4e202392e97679147c5d1a691e1525bcf771f89902902740e503f5856574c5e7b8ad1303036485193f48f989201cf25a1ca08c79dc8c34
-
SSDEEP
12288:F4FAe+jtbt1JcAfGWpfnuayZzCeFPEG6w//j:YAe+jtbt1JcAlnnGC+R/j
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Calyciform.exe"C:\Users\Admin\AppData\Local\Temp\Calyciform.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5b0c77267f13b2f87c084fd86ef51ccfc
SHA1f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA256a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
SHA512f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
-
Filesize
14.8MB
-
Filesize
14.8MB