Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 23:26
Static task
static1
Behavioral task
behavioral1
Sample
Masonic.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Masonic.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Masonic.exe
-
Size
366KB
-
MD5
ce5a7f35800a959fd70c2795435033d0
-
SHA1
dbc2b1e8abeaa29d0c88c03ae8f3ec6662750bf7
-
SHA256
375eb2835d2d093d9ec26dfc20d6d560b475ba7d462673bb3a5e53edc7beb38a
-
SHA512
e5a8da201ad7a194b76a3d0d55f246cac373216178514cff3d5c2afecd8777a7e41e0311582dc71c8565314002d36c73837437aa6e853bf5376e5070a80acf4d
-
SSDEEP
6144:Ewq3Np8RBcKsECowfQixykTI0sndnMlneyTZeLG4t6bkAPGM00gKpcgw:EzIRBcKMfQMj+DE8LkwOKgw
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
pid Process 2340 Masonic.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Incendiary\Titreredes\Microfauna.Lau Masonic.exe File opened for modification C:\Windows\SysWOW64\Kunstmuseets\Saml\Transilluminating.Bug Masonic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Masonic.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5