Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
28/03/2025, 05:33
General
-
Target
Payroll List_pdf.bat.exe
-
Size
852KB
-
MD5
55c905a0ec317664371b8ae3962d90cc
-
SHA1
1cc73aeb68495a320d14b23c720d47167989b214
-
SHA256
2edffaa16ba62436a4744e31d76dfaba8748534e4d6c752ca5b11949c25a4a7a
-
SHA512
289368437de4ee377c7c63bf4ebcc4eb0cf1555b2dc780fa14638b06855322a9aa50527e02d3444f3886d6264bb0a2e3c384520721145c2570647f90ead16227
-
SSDEEP
12288:JUjfTWyZA97KB+qmoSMfuiJp9vj/Xd53WiLwfheEAql6oIkJ/0DrQ:JUjfTsKB+a/f3Z53tLMGtQkQ
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payroll List_pdf.bat.exe"C:\Users\Admin\AppData\Local\Temp\Payroll List_pdf.bat.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payroll List_pdf.bat.exe"C:\Users\Admin\AppData\Local\Temp\Payroll List_pdf.bat.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44B
MD56644a29c4fcb5c51650383ac2625163a
SHA175de5a6b73cd9bc47af952ad60679535cf768b27
SHA2560d9e8205fb30192bec64aa7c4d7a0c9d98e469f6739aa321d3b85da16caa8abc
SHA5122e6a476b3045a543a322332b2eb9d261002c3a278dc408b9eb5af3e4b136fe1b783c3091ce5edaaa7f3c8d2bffab714408bb23ae2e135cd034e1ff02ef36302a
-
Filesize
11KB
MD58b3830b9dbf87f84ddd3b26645fed3a0
SHA1223bef1f19e644a610a0877d01eadc9e28299509
SHA256f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
SHA512d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
-
Filesize
1.7MB
-
Filesize
22.3MB
-
Filesize
22.3MB
-
Filesize
16.4MB
-
Filesize
22.3MB
-
Filesize
1.0MB
-
Filesize
1.7MB