Overview

overview

10

Static

static

3

contract c...DF.exe

windows7-x64

10

contract c...DF.exe

windows10-1703-x64

10

contract c...DF.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 19:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    contract copy amended JUNE 2024_PDF.exe

  • Size

    428KB

  • MD5

    e6b91a52554e6adf43df0ffaa6b92d33

  • SHA1

    4000722ce7f9445e068892b3ed80c9151f7e8a47

  • SHA256

    0a7f62793ce40e99600c729a97d80c02b4f8c80d16c32f5edaa8a6eac48d416e

  • SHA512

    ea228dea9d90b67ddcea115c181fd06f07385a3497adade0f957c539cf44327259d5a1a0e36b5abb333e1c29af359743011a02c5fc1adce2e4549409d8a95ff5

  • SSDEEP

    12288:0JJz/7Ecm5WQVK69G14QIlQdBnVqS2xN9wR4:CxEx5WQM69z7QVqS4oG

Score
10/10
guloaderdownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\contract copy amended JUNE 2024_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\contract copy amended JUNE 2024_PDF.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Users\Admin\AppData\Local\Temp\contract copy amended JUNE 2024_PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\contract copy amended JUNE 2024_PDF.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3504

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsk469F.tmp\System.dll
    Filesize

    11KB

    MD5

    960a5c48e25cf2bca332e74e11d825c9

    SHA1

    da35c6816ace5daf4c6c1d57b93b09a82ecdc876

    SHA256

    484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

    SHA512

    cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

    Download Submit
  • memory/3504-18-0x00000000016B0000-0x0000000003147000-memory.dmp
    Filesize

    26.6MB

    Download
  • memory/3504-21-0x0000000077BE5000-0x0000000077BE6000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3504-20-0x0000000077BC8000-0x0000000077BC9000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3504-22-0x0000000000450000-0x00000000016A4000-memory.dmp
    Filesize

    18.3MB

    Download
  • memory/3504-23-0x00000000016B0000-0x0000000003147000-memory.dmp
    Filesize

    26.6MB

    Download
  • memory/3504-25-0x0000000077B41000-0x0000000077C61000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/4576-15-0x0000000004B00000-0x0000000006597000-memory.dmp
    Filesize

    26.6MB

    Download
  • memory/4576-16-0x0000000077B41000-0x0000000077C61000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/4576-17-0x0000000010004000-0x0000000010005000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4576-19-0x0000000004B00000-0x0000000006597000-memory.dmp
    Filesize

    26.6MB

    Download
  • memory/4576-30-0x0000000004B00000-0x0000000006597000-memory.dmp
    Filesize

    26.6MB

    Download