Analysis
-
max time kernel
94s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
04-02-2025 04:19
General
-
Target
9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa.exe
-
Size
562KB
-
MD5
ac95b030d070152383d1e7cb8848c666
-
SHA1
ecc1e3bbfb34901f7318f53bbf6a0de5ed7f2c13
-
SHA256
9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa
-
SHA512
f02a84ebe21348452b5ba67762f1ea3b3915a4b1e5a10d3cfa6b456371861384be5abc60123798371a92a59f5fd3ce1a0ee5f3c00e527110ee9e95d8ce087bb2
-
SSDEEP
12288:1k2kjT6WanMG0UCcmhcz218oAm3R3W6TRVZdMNd/:+T6BMSCcmv18oRR1ZdM7
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 10 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa.exe"C:\Users\Admin\AppData\Local\Temp\9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa.exe"C:\Users\Admin\AppData\Local\Temp\9915d5e510f38806933bfc362590ba12f31c0f003cf40a84b12a5f997b2959fa.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 10483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4048 -ip 40481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f1e9eed02db3a822a7ddef0c724e5f1f
SHA165864992f5b6c79c5efbefb5b1354648a8a86709
SHA2566dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df
SHA512c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
Filesize
4KB
MD52e7baf4f3c9f5830af25c66ecbe1dac4
SHA1275ee3d8faeef514ec71605788561bae14f3a48a
SHA25637346b6387f7d33a9eab62407f94cd716081eb80d7443db91b788479e6fcaf4c
SHA512a7900cc0e56998f9cd30b24584c15a8a533139cb01d16bf2046c1b1bf5ffbd67216aac69a83d1968206a99185f692bf21429622cbf53a9abbbf528ff21f7cb45
-
Filesize
84.9MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
84.9MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB