Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 19:32
General
-
Target
New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe
-
Size
524KB
-
MD5
d7dfbeafd73680ece456544358ff4ae8
-
SHA1
8bfae1107957528a267642e1de35cd706e21239f
-
SHA256
eeab9fb352cb6be16656c5e2432f3c7d1e4fdcde4b0053cc13110b35bcad3be9
-
SHA512
a9b0e71b53dfa3805c6e86f8f773eb1fa6b0a6d79e9ba41cbec9007393c8e7a3826007bd44251ecabbe90f770cb8bf0c5dd551834b05fc20138f28b56a9e85a5
-
SSDEEP
6144:wYa6WLKRTIXwlWVwV7j3qKWOY+LF0EUFbPkhw56R/SI2BLfYi4K5+Q8cfVFa23Qn:wY0FQEU7RKDBSxSTtvGctF1oC2WzS
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe"C:\Users\Admin\AppData\Local\Temp\New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe"C:\Users\Admin\AppData\Local\Temp\New_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_OrderNew_Order.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
18.3MB
-
Filesize
43.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
43.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
43.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
43.3MB