Overview
overview
10Static
static
3SecuriteIn...14.exe
windows7-x64
10SecuriteIn...14.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3CommApi.dll
windows7-x64
1CommApi.dll
windows10-2004-x64
1CustomHotk...in.dll
windows7-x64
1CustomHotk...in.dll
windows10-2004-x64
1Gajim.exe
windows7-x64
1Gajim.exe
windows10-2004-x64
1NMPluginBase.dll
windows7-x64
3NMPluginBase.dll
windows10-2004-x64
3System.Pri...nq.dll
windows7-x64
1System.Pri...nq.dll
windows10-2004-x64
1agRichEdit.dll
windows7-x64
3agRichEdit.dll
windows10-2004-x64
3dbdata.dll
windows7-x64
1dbdata.dll
windows10-2004-x64
1lang-1025.dll
windows7-x64
1lang-1025.dll
windows10-2004-x64
1libtiff-5.dll
windows7-x64
1libtiff-5.dll
windows10-2004-x64
1uUDFImporter.dll
windows7-x64
3uUDFImporter.dll
windows10-2004-x64
3vsocklib_x86.dll
windows7-x64
3vsocklib_x86.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 12:47
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetect.malware2.29314.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetect.malware2.29314.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
CommApi.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
CommApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
CustomHotkeyPlugin.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
CustomHotkeyPlugin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Gajim.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Gajim.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
NMPluginBase.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
NMPluginBase.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
System.Private.Xml.Linq.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
System.Private.Xml.Linq.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
agRichEdit.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
agRichEdit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
dbdata.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
dbdata.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
lang-1025.dll
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
lang-1025.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
libtiff-5.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
libtiff-5.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
uUDFImporter.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
uUDFImporter.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
vsocklib_x86.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
vsocklib_x86.dll
Resource
win10v2004-20241007-en
General
-
Target
SecuriteInfo.com.W32.AIDetect.malware2.29314.exe
-
Size
1.5MB
-
MD5
f92e0ebfee5c601f8db1fb2f111391e9
-
SHA1
7adeb14e628937f7b7e8da540ef26bd9d7eb539b
-
SHA256
bc109946b539e33604fe85e4c060c616017facb443d8b8e0805f5911d00b6d4a
-
SHA512
cd975312a67d1cd709dc3b93bcd06cb0fd8c6ac0428a14042462cd535de5c430226c37c26abb23e005e745319ce9366c29eecf91d32c4a3bb57dbc4d8d74e4c6
-
SSDEEP
24576:Pb/mS5ptSQE9Ht6g0X2bFcxjizw9HEBNfC3/h8chBY9j9PFUW8mFfB:T/NrtV6t6ibWxX9Hes3/dBYfPF58mFZ
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
pid Process 2140 SecuriteInfo.com.W32.AIDetect.malware2.29314.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecuriteInfo.com.W32.AIDetect.malware2.29314.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88