Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 23:31

General

  • Target

    e126c11aec2897bd7959747e70bc85d4153abdadbe45344bb41771ced23f3228.exe

  • Size

    255KB

  • MD5

    a10619d494661c1f8ca180e53c5a11fd

  • SHA1

    1273e17b50d8d33078df02447fa9adaab255b459

  • SHA256

    e126c11aec2897bd7959747e70bc85d4153abdadbe45344bb41771ced23f3228

  • SHA512

    bc1383fa76765e77298ee35d4358bca8b2be7c310d7567f4d93c67790a0f6f03941f1301c11b78bfa5e178dc312ac3d0886417f705e5613f6f732b0b7f23b36a

  • SSDEEP

    3072:EbG7N2kDTHUpou5I/QGAhsCKgUbnVCP/+B9F9EbvwwgMvdOHcgW0SpC7Pn5r0K85:EbE/HUhO0XI9FWuMvG006yPnfTMR

Malware Config

Signatures

  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e126c11aec2897bd7959747e70bc85d4153abdadbe45344bb41771ced23f3228.exe
    "C:\Users\Admin\AppData\Local\Temp\e126c11aec2897bd7959747e70bc85d4153abdadbe45344bb41771ced23f3228.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:5100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\alnicoes.til

    Filesize

    27KB

    MD5

    01f3fac414b3a81f545e804d1f7b0f3a

    SHA1

    d60478c4400a7de9f00163514ed6942665e3eb93

    SHA256

    17b992a46911697778ab3c54ef42ad898bc3bc45f2ea83eda5249d2c8688647a

    SHA512

    5c6d00698a3ca44a123f31b2d011f6fb2f28a5c9eeb0cd58942005268753efde40503b4b9dbb8ca67ae613ae2252ae2f4a48920ab502be0166730229002128a4

  • C:\Users\Admin\AppData\Local\Temp\nsbA3D2.tmp\System.dll

    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • memory/5100-25-0x0000000004220000-0x0000000004320000-memory.dmp

    Filesize

    1024KB

  • memory/5100-26-0x0000000004220000-0x0000000004320000-memory.dmp

    Filesize

    1024KB