Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
19/02/2025, 06:29
General
-
Target
Quote_2025-0770915101-UAE-25_pdf.exe
-
Size
669KB
-
MD5
88c611266f18f7db91d7755063429d75
-
SHA1
1b1086c2217f9a6bf743007a958eff87a0293bd8
-
SHA256
7ef76197f97772ab780fe7921992a6e95af21cba5d200302d47a5dbb7fde636e
-
SHA512
7e9cd2d6776fbca98c7e75c60cb37ea29d468c7b447d5e0f0c71636196ae603718827f0a4b0f64c10e2fce0afce877ec8983d8df8d8b86707552998584a7e2de
-
SSDEEP
12288:ZfZ6QaYTUyLt4y7Er2/YHVy6gzt2s+CBxpObgVMNkhtHXbai1P4dXO:ZIdIte2/Y1vgtB+YQbg+NotWiR4w
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quote_2025-0770915101-UAE-25_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quote_2025-0770915101-UAE-25_pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quote_2025-0770915101-UAE-25_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quote_2025-0770915101-UAE-25_pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37B
MD54fbe761fb296431fa2b2b2f1b2151773
SHA122b08baab25ba9367620747f559b8a9900d39f5e
SHA2564e71a5b2c04ec9db74bb59e1ee2caa7a68d4a393f81ab3bac48226919fa35a5b
SHA512822b45bc5c8745af9fb4abe43bc4ae74bf06cc24c8d9760cd0c619f5b5805a9cf46f1b1e0d1d082130573cc72c6f060232f117ac9e1544a84083fad197316a80
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
79.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
384KB
-
Filesize
79.0MB
-
Filesize
600KB
-
Filesize
7.7MB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
304KB
-
Filesize
176KB
-
Filesize
896KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
7.7MB