Analysis

  • max time kernel
    101s
  • max time network
    212s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/07/2025, 06:20

General

  • Target

    JUSTIFICANTE DE PAGO.exe

  • Size

    1.6MB

  • MD5

    92ea2de8eac32690cc714753005d58dd

  • SHA1

    bd24e283b11c6bfc7bf95ed57d74255c84e42091

  • SHA256

    4d8ac0b9a416c55db3917d86a2339a99e6945135914e720a1d535188e8fae059

  • SHA512

    8294f5678f0f5bb8e25ee46f06b4caff99901b64c6ee935e390228cac9f34c9ae57087edf9c50070a3355cca170b6eb8744ebec555a28b1305299c04a0e09dfc

  • SSDEEP

    49152:1R2XPl1XpJutVQSN6rwm4WWfrQsYqZIn7:1R2XPlVpwt6S7WWyq2n7

Malware Config

Signatures

  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 10 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe
    "C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe
      "C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4640
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 440
        3⤵
        • Program crash
        PID:1580
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4640 -ip 4640
    1⤵
      PID:5368

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsy687F.tmp\LangDLL.dll

            Filesize

            5KB

            MD5

            30b091668111ab1d6c19f16586a9eee5

            SHA1

            aea49d81cf9972eaf1604793c04d13ddffe2c475

            SHA256

            331ca4b3a311324b463167ec43851146e57a2d90500ac3fd57a7683f6b777ffb

            SHA512

            6dd592af085b2e28c54d7f525916112dbf5cfe134393b0b97f8f1f64739cf90962273c51f02e8ce2c623cf6aa8355eacda5db0b0256d8f05a77ccf0f99d11648

          • C:\Users\Admin\AppData\Local\Temp\nsy687F.tmp\System.dll

            Filesize

            11KB

            MD5

            9625d5b1754bc4ff29281d415d27a0fd

            SHA1

            80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

            SHA256

            c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

            SHA512

            dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

          • memory/3668-41-0x00000000042D0000-0x0000000005D83000-memory.dmp

            Filesize

            26.7MB

          • memory/3668-42-0x00000000042D0000-0x0000000005D83000-memory.dmp

            Filesize

            26.7MB

          • memory/3668-43-0x0000000010004000-0x0000000010005000-memory.dmp

            Filesize

            4KB

          • memory/3668-44-0x00000000042D0000-0x0000000005D83000-memory.dmp

            Filesize

            26.7MB