Analysis
-
max time kernel
299s -
max time network
295s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:44
Static task
static1
Behavioral task
behavioral1
Sample
AWB DHL 0029301.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
AWB DHL 0029301.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
AWB DHL 0029301.exe
-
Size
760KB
-
MD5
e66902c532dd0fd4f019200e4599f17c
-
SHA1
6306e266e3d9dcd3671aa81f77bb7502e3ae76ff
-
SHA256
81c7f5b291b1fcd6d64f7f12208b0134a8462f156dbda97188ec0ba5ff869478
-
SHA512
bfc0fb98f0921f370e55fc8d9ad8cd79c0280e0de9e6a49fb28cac5eebdf28e6bf14c5f1b94c23405dd387e5495c5f754568b20600ee7fd449a123a14a3b756d
-
SSDEEP
12288:9s6eULcXcekO8cHzf2l4t5musvXsD6En3kV117Dd:MMetHzf2l4KvXgn3kJ7Dd
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 6 IoCs
pid Process 1792 AWB DHL 0029301.exe 1792 AWB DHL 0029301.exe 1792 AWB DHL 0029301.exe 1792 AWB DHL 0029301.exe 1792 AWB DHL 0029301.exe 1792 AWB DHL 0029301.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1792 AWB DHL 0029301.exe 2684 AWB DHL 0029301.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1792 set thread context of 2684 1792 AWB DHL 0029301.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWB DHL 0029301.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWB DHL 0029301.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1792 AWB DHL 0029301.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2684 1792 AWB DHL 0029301.exe 30 PID 1792 wrote to memory of 2684 1792 AWB DHL 0029301.exe 30 PID 1792 wrote to memory of 2684 1792 AWB DHL 0029301.exe 30 PID 1792 wrote to memory of 2684 1792 AWB DHL 0029301.exe 30 PID 1792 wrote to memory of 2684 1792 AWB DHL 0029301.exe 30 PID 1792 wrote to memory of 2684 1792 AWB DHL 0029301.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB DHL 0029301.exe"C:\Users\Admin\AppData\Local\Temp\AWB DHL 0029301.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\AWB DHL 0029301.exe"C:\Users\Admin\AppData\Local\Temp\AWB DHL 0029301.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5174708997758321cf926b69318c6c3f5
SHA1645488089bf320f6864e0d0bc284c85216e56fbd
SHA256f577b66492e97c7b8bf515398d8deb745abafd74f56fc03e67fce248ebbeb873
SHA512214433597e04ca1ff9b4fe092d5d2997707a7c56f0f82c85d586088a200e4455028f3b9427d87b4f06f9252557d5be4b7a9138ea6a8d045df6209421fd8ca054
-
Filesize
11KB
MD50ff2d70cfdc8095ea99ca2dabbec3cd7
SHA110c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA256982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
SHA512cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e