Analysis

  • max time kernel
    93s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2025, 05:25

General

  • Target

    d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562.exe

  • Size

    1003KB

  • MD5

    44ca4d83095d7f0372c1eab439f633be

  • SHA1

    b90fdcf957fc294917a047608bb2188a1596e5e7

  • SHA256

    d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562

  • SHA512

    d81d6e6b625aae8bfce7a5972d6b5e41e101c330f1ca5221333d90013c1c1ded2cddede20aad64f61bb9e645068d28eeb256cceadb307bf49c3b284c98dd5ad3

  • SSDEEP

    24576:9jwKCNm+hbhARlNsfvUdQQIhf2cwCZLiSWfQOEy5Yx7tXv:V1CIMhKHdP3zCxHlhyqx7t/

Malware Config

Signatures

  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562.exe
    "C:\Users\Admin\AppData\Local\Temp\d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:996
    • C:\Users\Admin\AppData\Local\Temp\d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562.exe
      "C:\Users\Admin\AppData\Local\Temp\d7aca08687c1ffc0b01ad90f5500c968796bebf8b60995363c8d7c19be48c562.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2836
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2288
        3⤵
        • Program crash
        PID:952
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2836 -ip 2836
    1⤵
      PID:3516

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsiCE00.tmp\System.dll

            Filesize

            12KB

            MD5

            0d7ad4f45dc6f5aa87f606d0331c6901

            SHA1

            48df0911f0484cbe2a8cdd5362140b63c41ee457

            SHA256

            3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

            SHA512

            c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

          • memory/996-13-0x00000000032E0000-0x00000000063DB000-memory.dmp

            Filesize

            49.0MB

          • memory/996-14-0x0000000077E31000-0x0000000077F51000-memory.dmp

            Filesize

            1.1MB

          • memory/996-15-0x0000000074B25000-0x0000000074B26000-memory.dmp

            Filesize

            4KB

          • memory/996-16-0x00000000032E0000-0x00000000063DB000-memory.dmp

            Filesize

            49.0MB

          • memory/996-17-0x00000000032E0000-0x00000000063DB000-memory.dmp

            Filesize

            49.0MB

          • memory/2836-18-0x00000000016E0000-0x00000000047DB000-memory.dmp

            Filesize

            49.0MB

          • memory/2836-28-0x0000000000480000-0x00000000016D4000-memory.dmp

            Filesize

            18.3MB

          • memory/2836-32-0x00000000016E0000-0x00000000047DB000-memory.dmp

            Filesize

            49.0MB

          • memory/2836-33-0x0000000000480000-0x00000000016D4000-memory.dmp

            Filesize

            18.3MB

          • memory/2836-34-0x0000000000480000-0x000000000049E000-memory.dmp

            Filesize

            120KB

          • memory/2836-35-0x0000000037560000-0x0000000037B04000-memory.dmp

            Filesize

            5.6MB

          • memory/2836-36-0x0000000037B10000-0x0000000037BAC000-memory.dmp

            Filesize

            624KB

          • memory/2836-38-0x00000000016E0000-0x00000000047DB000-memory.dmp

            Filesize

            49.0MB