Overview

overview

10

Static

static

3

Proforma Invoice.exe

windows7-x64

10

Proforma Invoice.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    02-07-2024 21:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Proforma Invoice.exe

  • Size

    176KB

  • MD5

    f84c3d0516a0996dd1779403dec4e3bc

  • SHA1

    a5fb905b130cf2ac7f7f243a9e33357ead86ec44

  • SHA256

    e93df96edba4454e7bf67ab0f33f0c0299d6d644f7f04bfeb12bbcb92ede0a15

  • SHA512

    07b054331319a576fac555c9bdbbf7b166ee983b826e06db2d0ce0b715fce03fd5bf076d089883308a1c500f399c74456867e976a680a6d53f9f5ba4fe8f7c3b

  • SSDEEP

    3072:AGXPgWy4wvx3llL94GxN6FvvmeQMBH06CypsFj3rE7:AwPhW3llL94GxN6FvvmeQMBH06ClFj3Q

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://onedrive.live.com/download?cid=26BBD7D5AD88DD29&resid=26BBD7D5AD88DD29%21107&authkey=AEtk6USHs_M9h6s

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Guloader payload 1 IoCs
    guloader
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2924-2-0x00000000002E0000-0x00000000002EB000-memory.dmp
    Filesize

    44KB

    Download
  • memory/2924-3-0x0000000076FB1000-0x00000000770B2000-memory.dmp
    Filesize

    1.0MB

    Download