Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-12-2024 14:12
General
-
Target
$70k MT 30JAN.exe
-
Size
68KB
-
MD5
46bbf5e855bc75bac0102f64ef89d020
-
SHA1
9ae433aa63784d9ca7d614859bdd27fd1f377b68
-
SHA256
f51c1470741a6272f90a147fc717bbbc8808a92107e7c16f7c1ff57c69ee2791
-
SHA512
30072e2a142563d111d3671f055da9a9ed075ae9f6809bbb85136d923112d3b4e4d9d877f6fb470d0170823ef219e70a0400ef868e9454d340055e83aa5e0599
-
SSDEEP
768:kQOK55sy7IbEfUMMuqe+bQ8u4OK55sy7IbEfUM:kXKn95InnbQ8GKn95
Score
10/10
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$70k MT 30JAN.exe"C:\Users\Admin\AppData\Local\Temp\$70k MT 30JAN.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\$70k MT 30JAN.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
36KB
-
Filesize
856KB
-
Filesize
1.0MB
-
Filesize
36KB
-
Filesize
36KB