Analysis
-
max time kernel
91s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
20/02/2025, 06:12
General
-
Target
Udeladelsers21.exe
-
Size
789KB
-
MD5
0414f807264c86c53561dbac864a0a03
-
SHA1
31090a8c34e7c6f08f80f7dc9d08890fbed06498
-
SHA256
a97a7c59fd1240722e02c1fe6e0c604f00d144578f701c78c47efb5132759a0b
-
SHA512
3f64007953ef2cac2e8151176b8f7a1b5954bdd15404a4f79f3cfd3da74f1ce1113ca2ccd237056d59aa08fcc171d23d3a4644fbd1effcb9b8227f3eb07e8290
-
SSDEEP
12288:I2LyZBH9zpl/scMxT3iKJCcYpOPJbiHWQLq7uHkqx+9f9Rv5WimvSre:I2G/Lhflc3iHWgsuHxw3h4vV
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 6 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Udeladelsers21.exe"C:\Users\Admin\AppData\Local\Temp\Udeladelsers21.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Udeladelsers21.exe"C:\Users\Admin\AppData\Local\Temp\Udeladelsers21.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37B
MD5587121cabc408133538b692db9adfc83
SHA13ecfd3a31b43216b70b16f00fd40790e05911f69
SHA256585c10af27b175c5e18d58bc5bc93fb86413f57f6a914ac9efee9066d464f2eb
SHA512f7efb0ca8a8f2d3f3c6d4e0c4db64aa2ec4bae52cb0b187f1ef28607dcc62bd1e66c0e48df37965ef3469e13bdfd2468557336d44690a7a6d580bf994b044283
-
Filesize
5KB
MD5ab1db56369412fe8476fefffd11e4cc0
SHA1daad036a83b2ee2fa86d840a34a341100552e723
SHA2566f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
SHA5128d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
33.8MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
33.8MB
-
Filesize
33.8MB
-
Filesize
33.8MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
33.8MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB