Overview

overview

10

Static

static

3

490f912a00...18.exe

windows7-x64

5

490f912a00...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 02:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    490f912a000e2da93b240765e76ed308_JaffaCakes118.exe

  • Size

    48KB

  • MD5

    490f912a000e2da93b240765e76ed308

  • SHA1

    1314b561dbed543b969aebb8ed60f07bfe7152e2

  • SHA256

    4d5dafcd58879d4855fe468b8930b1fb39744371f338a27ffe26efb56555b12e

  • SHA512

    69fba90b288a52c0dc311d897ab17f7275ce15e88ead1e7b3fd8b636925ce7dbf0599a2014dab9812f1b2dd3692add754c871936b31c28c880f4a01a85bf2333

  • SSDEEP

    768:YnrkN2548wvAECw90JO5x30n0ajjrRAao6T24cUH8Ge:UrkN2548w5CwWJO5d0nPrRFo6S4R+

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://onedrive.live.com/download?cid=E3F864783437E54C&resid=E3F864783437E54C%21120&authkey=AJxvhb5E2TNcfSY

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Guloader payload 1 IoCs
    guloader
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\490f912a000e2da93b240765e76ed308_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\490f912a000e2da93b240765e76ed308_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\490f912a000e2da93b240765e76ed308_JaffaCakes118.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1564-2-0x0000000000790000-0x0000000000798000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1564-3-0x0000000077261000-0x0000000077381000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/1564-8-0x0000000000790000-0x0000000000798000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1564-9-0x0000000000790000-0x0000000000798000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2616-4-0x0000000000A00000-0x0000000000B00000-memory.dmp
    Filesize

    1024KB

    Download