Overview

overview

10

Static

static

3

28dbe1a424...1d.exe

windows7-x64

10

28dbe1a424...1d.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Funktionrg...an.dll

windows7-x64

3

Funktionrg...an.dll

windows10-2004-x64

3

Funktionrg...mp.dll

windows7-x64

1

Funktionrg...mp.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-11-2024 16:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe

  • Size

    242KB

  • MD5

    bd85503dd4bb3ccd9c6c294d3767d8e6

  • SHA1

    d98455443474b9aef06f1bff242a52e8bb4ec6d0

  • SHA256

    28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d

  • SHA512

    b6eeaa15f7c6573ec15208bc071d1d953404c7bd3cd06e4bd0cb2ab93e7678eb2c7425c7fe317c5f0e7f5fc9145cb14686c8157b5a0ab0b6e8a00bd6b0e2972d

  • SSDEEP

    6144:oIw3gEzFzShNZA1lZqrq6DHSCf7NVMf/WB/UvuEIN:jA2Ha172xSE7LMXWlUvuES

Score
10/10
guloaderdiscoverydownloaderpersistence

Malware Config

Signatures

  • Guloader family
    guloader
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 49 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe
    "C:\Users\Admin\AppData\Local\Temp\28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Users\Admin\AppData\Local\Temp\28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe"
      2⤵
        PID:1880
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
        "C:\Users\Admin\AppData\Local\Temp\28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe"
        2⤵
          PID:1608
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
          "C:\Users\Admin\AppData\Local\Temp\28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe"
          2⤵
            PID:1564
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
            "C:\Users\Admin\AppData\Local\Temp\28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe"
            2⤵
              PID:1188
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
              "C:\Users\Admin\AppData\Local\Temp\28dbe1a424619df840d06cebb87f8d08649a37db58e1c2e51ab25c84aa31701d.exe"
              2⤵
              • Checks QEMU agent file
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:3940

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsf7ACF.tmp\System.dll
            Filesize

            11KB

            MD5

            9625d5b1754bc4ff29281d415d27a0fd

            SHA1

            80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

            SHA256

            c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

            SHA512

            dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

            Download Submit

          • memory/3940-159-0x0000000000E00000-0x0000000001B1E000-memory.dmp

            Filesize

            13.1MB

            Download

          • memory/3940-160-0x0000000077B88000-0x0000000077B89000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3940-162-0x0000000077B01000-0x0000000077C21000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/3940-163-0x0000000000E00000-0x0000000001B1E000-memory.dmp

            Filesize

            13.1MB

            Download

          • memory/3940-164-0x0000000000400000-0x000000000062B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4164-154-0x0000000003380000-0x000000000409E000-memory.dmp

            Filesize

            13.1MB

            Download

          • memory/4164-155-0x0000000003380000-0x000000000409E000-memory.dmp

            Filesize

            13.1MB

            Download

          • memory/4164-156-0x0000000077B01000-0x0000000077C21000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/4164-157-0x0000000010004000-0x0000000010005000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4164-158-0x0000000010000000-0x0000000010006000-memory.dmp

            Filesize

            24KB

            Download