Overview

overview

10

Static

static

3

c527daf249...94.exe

windows7-x64

10

c527daf249...94.exe

windows10-2004-x64

10

AdminTools.exe

windows7-x64

1

AdminTools.exe

windows10-2004-x64

1

Ruchernes.ps1

windows7-x64

3

Ruchernes.ps1

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c527daf2491bb0c007246173bd7dee7926a01418ae3550f60f6971f2fb8caa94.exe

  • Size

    675KB

  • Sample

    240627-b1kpdawblg

  • MD5

    7752f357a75ddb3e3f1412f559ef2a7a

  • SHA1

    a75f8ed934a8525e09b8a8ff24cf8f49c9aba90c

  • SHA256

    c527daf2491bb0c007246173bd7dee7926a01418ae3550f60f6971f2fb8caa94

  • SHA512

    ee22afcd9ef860a60e9626454fd7e576d09c3d30412cc8af82b56273f8da07711233940f9e4c6babbcdeae3b86df65ea33b8dfc60486fa56618e53ba6c752ca8

  • SSDEEP

    12288:kH+/vBkZcYasAtiieQeCpqpydrYTDyumSuoZ2hQ:i+/JqcLNeCQyVe2u7Vsi

Score
10/10
guloaderdownloaderexecution

Malware Config

Targets

    • Target

      c527daf2491bb0c007246173bd7dee7926a01418ae3550f60f6971f2fb8caa94.exe

    • Size

      675KB

    • MD5

      7752f357a75ddb3e3f1412f559ef2a7a

    • SHA1

      a75f8ed934a8525e09b8a8ff24cf8f49c9aba90c

    • SHA256

      c527daf2491bb0c007246173bd7dee7926a01418ae3550f60f6971f2fb8caa94

    • SHA512

      ee22afcd9ef860a60e9626454fd7e576d09c3d30412cc8af82b56273f8da07711233940f9e4c6babbcdeae3b86df65ea33b8dfc60486fa56618e53ba6c752ca8

    • SSDEEP

      12288:kH+/vBkZcYasAtiieQeCpqpydrYTDyumSuoZ2hQ:i+/JqcLNeCQyVe2u7Vsi

    Score
    10/10
    guloaderdownloaderexecution

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      AdminTools.exe

    • Size

      25KB

    • MD5

      24c7684f85c0e61d41c31766197d6061

    • SHA1

      2afbed52e13fb8b1f0b3cb786a463400b208049a

    • SHA256

      f095c96f8354738f2d272b7837dcde2b6c9e9abdca3efa91c114af87d7590453

    • SHA512

      778fd49b8dfd52030c1d0b7e724351ee1d9dcb02017b07af5e8ccfab18bbfcc534ac7fc541c910294b06f0863d3011d19ebc66b947e349e4e02f2884a82f348f

    • SSDEEP

      192:hQKgOcvfUkNLH3aXfJ/JcMedTsjEz02It+y5n1gtHYzrqUtEcEjPTx7N6rOE+v13:/7HkdaPPcM+TsJ5Ct4yUtGx0eMDQbz

    Score
    1/10
    behavioral3behavioral4

    • Target

      Ruchernes.Pre

    • Size

      25KB

    • MD5

      6947c3d9ecde3d39790721c3c83fa478

    • SHA1

      62b781836f42e0abda502abdb44cb209ffbb45e5

    • SHA256

      de24b75c0d91d118703630e42e1e844c1f480c183697c1661b48cbfb5fa9394d

    • SHA512

      5f6fd595a6aade1f117016f00211aa32aaf6b2d6c76ded89d92cd3189494c7047540aca08f477c97caac7d048326770b4e3a706b990767a13dfecd8316041163

    • SSDEEP

      768:pCUdFLVPCj/8M12qLHCYxkXkaY3I5g976E6UDBTYFZMLz6SG:PVqpMqjVVEEPGEzLG

    Score
    3/10
    execution
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

2
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks