Analysis
-
max time kernel
101s -
max time network
212s -
platform
windows11-21h2_x64 -
resource
win11-20250619-en -
resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/07/2025, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
JUSTIFICANTE DE PAGO.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
JUSTIFICANTE DE PAGO.exe
Resource
win11-20250619-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20250619-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250619-en
General
-
Target
JUSTIFICANTE DE PAGO.exe
-
Size
1.6MB
-
MD5
92ea2de8eac32690cc714753005d58dd
-
SHA1
bd24e283b11c6bfc7bf95ed57d74255c84e42091
-
SHA256
4d8ac0b9a416c55db3917d86a2339a99e6945135914e720a1d535188e8fae059
-
SHA512
8294f5678f0f5bb8e25ee46f06b4caff99901b64c6ee935e390228cac9f34c9ae57087edf9c50070a3355cca170b6eb8744ebec555a28b1305299c04a0e09dfc
-
SSDEEP
49152:1R2XPl1XpJutVQSN6rwm4WWfrQsYqZIn7:1R2XPlVpwt6S7WWyq2n7
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 10 IoCs
pid Process 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe 3668 JUSTIFICANTE DE PAGO.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\expired\fortjet.ini JUSTIFICANTE DE PAGO.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3668 JUSTIFICANTE DE PAGO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1580 4640 WerFault.exe 78 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUSTIFICANTE DE PAGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUSTIFICANTE DE PAGO.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3668 JUSTIFICANTE DE PAGO.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3668 wrote to memory of 4640 3668 JUSTIFICANTE DE PAGO.exe 78 PID 3668 wrote to memory of 4640 3668 JUSTIFICANTE DE PAGO.exe 78 PID 3668 wrote to memory of 4640 3668 JUSTIFICANTE DE PAGO.exe 78 PID 3668 wrote to memory of 4640 3668 JUSTIFICANTE DE PAGO.exe 78 PID 3668 wrote to memory of 4640 3668 JUSTIFICANTE DE PAGO.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 4403⤵
- Program crash
PID:1580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4640 -ip 46401⤵PID:5368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD530b091668111ab1d6c19f16586a9eee5
SHA1aea49d81cf9972eaf1604793c04d13ddffe2c475
SHA256331ca4b3a311324b463167ec43851146e57a2d90500ac3fd57a7683f6b777ffb
SHA5126dd592af085b2e28c54d7f525916112dbf5cfe134393b0b97f8f1f64739cf90962273c51f02e8ce2c623cf6aa8355eacda5db0b0256d8f05a77ccf0f99d11648
-
Filesize
11KB
MD59625d5b1754bc4ff29281d415d27a0fd
SHA180e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA256c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
SHA512dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b