Overview

overview

10

Static

static

3

Hermaean.exe

windows7-x64

10

Hermaean.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ca204f398d0ca98eb3d2d76c2f05b382341fe416e761cf7e4ebb4c9db5593b5

  • Size

    959KB

  • Sample

    250210-pfe52s1qbl

  • MD5

    d545c41763960cad8d25f09410e1cce6

  • SHA1

    8deccb86bd19f75cc07ee30065c8a312c7f6fbc4

  • SHA256

    7ca204f398d0ca98eb3d2d76c2f05b382341fe416e761cf7e4ebb4c9db5593b5

  • SHA512

    95e13bef78431598956ce362466c7bd2f4d580e0cd420bd54f52c2b0b636e2dd72e7ad572682c3653959d310276c8cb146b2c6b2f64104452bb7452f39803e7f

  • SSDEEP

    12288:mNm7y4eqobiupR4BzoBraIlW0lvq52SfrIeT7fLPEwuamFq6fQoBsf0yHAenvYoF:Zbc/R4BzoJC9fseHfABFq6cf9JnHwTO

Score
10/10
guloadercollectiondiscoverydownloaderspywarestealer

Malware Config

Targets

    • Target

      Hermaean.exe

    • Size

      1.0MB

    • MD5

      a5350eaa7864ac06277c445e0f52f9d9

    • SHA1

      9a589f6dcbb0ee908a1665501b3e249a00c05db8

    • SHA256

      eab16fb9a96dba4a00c074dec9d6be01b5d93b680d69d230c21497fce96f9de5

    • SHA512

      19cbd739728359dff2932ee72bf923598fe523ed2c08fc3d42f4e535e94e8cd7b0c4165eb1f3e4b54ef96b403396571b9ce9d3042ceacb996237d78b3347e2d1

    • SSDEEP

      24576:NtLjOxH2phdL18qdTJhxEvGuw48Qw1J+FOZVKgyhz:NtLiwhd3dzxYfw4krkOZxy9

    Score
    10/10
    guloaderdiscoverydownloaderspywarestealercollection

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      7399323923e3946fe9140132ac388132

    • SHA1

      728257d06c452449b1241769b459f091aabcffc5

    • SHA256

      5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

    • SHA512

      d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

    • SSDEEP

      192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks