Overview

overview

10

Static

static

3

Purchase O...65.exe

windows7-x64

7

Purchase O...65.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Tikoor/Fel...-0.dll

windows10-2004-x64

3

Tikoor/Fel...k.html

windows7-x64

3

Tikoor/Fel...k.html

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5fd01c7a6dbd66ff408e499a58d9ea92cde839e4d331eb1dfa3503472be08972.zip

  • Size

    368KB

  • Sample

    241129-p4sfaawncw

  • MD5

    5580616e41c8736dfe2a25f70eb41f7b

  • SHA1

    febca092f10e20d4b4aea9318207ee32282294d7

  • SHA256

    a02a9471808b56743d86a8420198f0c94a39cf2aa56f4db9cdd21c091c97b436

  • SHA512

    f2a82d98e3a346437941e0a697854a89a67e889b35f6b4cb9d20927bcf844c5f986fcd45f42813e5d850e7ccfc76485e9cbff0542b0706ab5878652ea7437f33

  • SSDEEP

    6144:LGcyehs1pOyORG4Wp9kWU9mvbb6DWemsCf3gFZqTvIzWXxwO0ZN3ZBDq5TyASM:XNsNOc4WYWU9mDb6lDCYFZq4WXxV0lBo

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      Purchase Order 291765.exe

    • Size

      590KB

    • MD5

      d1c1b8a2281aef064c89254a6dae6784

    • SHA1

      97db63131a4e9e6ae649cfb32c4038577d62feb0

    • SHA256

      7b8714bdeaf6cd6803078d5b21af1afd9dccecf13456bdb4c879a63c4683a374

    • SHA512

      0adab21b0b33dd2138f9814afdb563478bd9e92fa2125d26a6b52d64a3bb0724bb89e5bf2d7728dbc657fcf1b1b02cb640f9e99980c92e466afe225f59622859

    • SSDEEP

      12288:XgDX/G7k2F1axoSAtT/ljZhsQTNnNE3pKPuQHhFJUBZTsSHz:A/ak2F1aiSAtT/l12gnC3pO3HHaBZAST

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      a4dd044bcd94e9b3370ccf095b31f896

    • SHA1

      17c78201323ab2095bc53184aa8267c9187d5173

    • SHA256

      2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

    • SHA512

      87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

    • SSDEEP

      192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Tikoor/Feltstrrelser/Ribozos/Quartus/api-ms-win-core-errorhandling-l1-1-0.dll

    • Size

      17KB

    • MD5

      d91bf81cf5178d47d1a588b0df98eb24

    • SHA1

      75f9f2da06aa2735906b1c572dd556a3c30e7717

    • SHA256

      f8e3b45fd3e22866006f16a9e73e28b5e357f31f3c275b517692a5f16918b492

    • SHA512

      93d1b0d226e94235f1b32d42f6c1b95fadfaf103b8c1782423d2c5a4836102084fb53f871e3c434b85f0288e47f44345138de54ea5f982ca3e8bbf2d2bea0706

    • SSDEEP

      192:cnmxD3jW1hWiRcvHCjdks/nGfe4pBjSYrteMMPiW5RKTt3E2sVWQ4GWCxMfqnaj9:cn4W1hWiQim0GftpBj9eXm3SR6lPp/

    Score
    3/10
    discovery
    behavioral5

    • Target

      Tikoor/Feltstrrelser/Ribozos/Quartus/vsock.sys

    • Size

      1KB

    • MD5

      5343c1a8b203c162a3bf3870d9f50fd4

    • SHA1

      04b5b886c20d88b57eea6d8ff882624a4ac1e51d

    • SHA256

      dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

    • SHA512

      e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949

    Score
    3/10
    discovery
    behavioral6behavioral7

MITRE ATT&CK Enterprise v15

Tasks