Overview

overview

10

Static

static

3

z89PO25-06...DF.exe

windows7-x64

10

z89PO25-06...DF.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 20:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    z89PO25-06-2024orderlist_PDF.exe

  • Size

    428KB

  • MD5

    e6b91a52554e6adf43df0ffaa6b92d33

  • SHA1

    4000722ce7f9445e068892b3ed80c9151f7e8a47

  • SHA256

    0a7f62793ce40e99600c729a97d80c02b4f8c80d16c32f5edaa8a6eac48d416e

  • SHA512

    ea228dea9d90b67ddcea115c181fd06f07385a3497adade0f957c539cf44327259d5a1a0e36b5abb333e1c29af359743011a02c5fc1adce2e4549409d8a95ff5

  • SSDEEP

    12288:0JJz/7Ecm5WQVK69G14QIlQdBnVqS2xN9wR4:CxEx5WQM69z7QVqS4oG

Score
10/10
guloaderdownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\z89PO25-06-2024orderlist_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\z89PO25-06-2024orderlist_PDF.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\z89PO25-06-2024orderlist_PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\z89PO25-06-2024orderlist_PDF.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2736

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsy2463.tmp\System.dll
    Filesize

    11KB

    MD5

    960a5c48e25cf2bca332e74e11d825c9

    SHA1

    da35c6816ace5daf4c6c1d57b93b09a82ecdc876

    SHA256

    484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

    SHA512

    cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

    Download Submit
  • memory/2232-15-0x0000000003790000-0x0000000005227000-memory.dmp
    Filesize

    26.6MB

    Download
  • memory/2232-17-0x0000000076F20000-0x00000000770C9000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/2232-16-0x0000000076F21000-0x0000000077022000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2232-20-0x0000000003790000-0x0000000005227000-memory.dmp
    Filesize

    26.6MB

    Download
  • memory/2232-26-0x0000000003790000-0x0000000005227000-memory.dmp
    Filesize

    26.6MB

    Download
  • memory/2736-18-0x0000000076F20000-0x00000000770C9000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/2736-19-0x0000000000450000-0x00000000014B2000-memory.dmp
    Filesize

    16.4MB

    Download