Analysis

  • max time kernel
    299s
  • max time network
    298s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2024 01:39

General

  • Target

    PO.exe

  • Size

    760KB

  • MD5

    e66902c532dd0fd4f019200e4599f17c

  • SHA1

    6306e266e3d9dcd3671aa81f77bb7502e3ae76ff

  • SHA256

    81c7f5b291b1fcd6d64f7f12208b0134a8462f156dbda97188ec0ba5ff869478

  • SHA512

    bfc0fb98f0921f370e55fc8d9ad8cd79c0280e0de9e6a49fb28cac5eebdf28e6bf14c5f1b94c23405dd387e5495c5f754568b20600ee7fd449a123a14a3b756d

  • SSDEEP

    12288:9s6eULcXcekO8cHzf2l4t5musvXsD6En3kV117Dd:MMetHzf2l4KvXgn3kJ7Dd

Malware Config

Signatures

  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 10 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO.exe
    "C:\Users\Admin\AppData\Local\Temp\PO.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\PO.exe
      "C:\Users\Admin\AppData\Local\Temp\PO.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsa9413.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    174708997758321cf926b69318c6c3f5

    SHA1

    645488089bf320f6864e0d0bc284c85216e56fbd

    SHA256

    f577b66492e97c7b8bf515398d8deb745abafd74f56fc03e67fce248ebbeb873

    SHA512

    214433597e04ca1ff9b4fe092d5d2997707a7c56f0f82c85d586088a200e4455028f3b9427d87b4f06f9252557d5be4b7a9138ea6a8d045df6209421fd8ca054

  • C:\Users\Admin\AppData\Local\Temp\nsa9413.tmp\System.dll

    Filesize

    11KB

    MD5

    0ff2d70cfdc8095ea99ca2dabbec3cd7

    SHA1

    10c51496d37cecd0e8a503a5a9bb2329d9b38116

    SHA256

    982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

    SHA512

    cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

  • memory/468-41-0x00000000777F8000-0x00000000777F9000-memory.dmp

    Filesize

    4KB

  • memory/468-45-0x0000000077771000-0x0000000077891000-memory.dmp

    Filesize

    1.1MB

  • memory/468-44-0x00000000004B0000-0x0000000001704000-memory.dmp

    Filesize

    18.3MB

  • memory/468-43-0x0000000001710000-0x000000000291A000-memory.dmp

    Filesize

    18.0MB

  • memory/468-42-0x0000000077815000-0x0000000077816000-memory.dmp

    Filesize

    4KB

  • memory/468-40-0x0000000001710000-0x000000000291A000-memory.dmp

    Filesize

    18.0MB

  • memory/1668-36-0x0000000077771000-0x0000000077891000-memory.dmp

    Filesize

    1.1MB

  • memory/1668-39-0x0000000004240000-0x000000000544A000-memory.dmp

    Filesize

    18.0MB

  • memory/1668-37-0x0000000004240000-0x000000000544A000-memory.dmp

    Filesize

    18.0MB

  • memory/1668-38-0x0000000010004000-0x0000000010005000-memory.dmp

    Filesize

    4KB

  • memory/1668-35-0x0000000004240000-0x000000000544A000-memory.dmp

    Filesize

    18.0MB