Analysis
-
max time kernel
93s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order Purchase Order Purchase Order Purchase Order.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Purchase Order Purchase Order Purchase Order Purchase Order.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Purchase Order Purchase Order Purchase Order Purchase Order.exe
-
Size
707KB
-
MD5
b9a03fb0c2c7f23a1e4ccb0d79c5053c
-
SHA1
4d87c4ed89d8b92f2b6849dc6af6a8850f8e5e7c
-
SHA256
099369eb025c3e23b6669c872ac2572e7bc4ba9200eb4d6318284983ddb78e3f
-
SHA512
7b39c7eb08b12f947a2f5fb79f91a7c8fb738fa14c2539db55f207754438f5b340d5ae5219ec1ea6861cb72aad32e04d2b701cc6a34c098e0a780db3607be3d2
-
SSDEEP
12288:d35ol8MJEBhQRtZZbhhLSbWJgU8UFJ6UibZP9/I7TAWWtQnm:d3kJEBORt7b3Oa2Udi9P9yTB0Qnm
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
pid Process 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4008 set thread context of 436 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe 93 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\nomarch\gratiales.ini Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\Gullis.lnk Purchase Order Purchase Order Purchase Order Purchase Order.exe File opened for modification C:\Windows\Fonts\Gullis.lnk Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Purchase Order Purchase Order Purchase Order Purchase Order.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe 436 Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4008 wrote to memory of 436 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe 93 PID 4008 wrote to memory of 436 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe 93 PID 4008 wrote to memory of 436 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe 93 PID 4008 wrote to memory of 436 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe 93 PID 4008 wrote to memory of 436 4008 Purchase Order Purchase Order Purchase Order Purchase Order.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Purchase Order Purchase Order Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Purchase Order Purchase Order Purchase Order.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order Purchase Order Purchase Order Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Purchase Order Purchase Order Purchase Order.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
Filesize
1KB
MD5955d040ac661a1077248766694da6e1f
SHA1d6b227c31e29cde880bcddbf2003647a8eacd696
SHA25642ee8b020affe3880a95de2dae547216a222fa719db844a59aa065e714a71ca5
SHA5120e23361f919814b55a3ec9f2c52a5559d63830639d81c0d45cde7d0bb36434ae102d260f2a91f1930ff8bdbf16b6c5daeefc02f670985e62b8fbdaa4076dbf6e