Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 22:25
Static task
static1
Behavioral task
behavioral1
Sample
1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe
-
Size
100KB
-
MD5
1dabdd40fc265a39611acf8c31fb19db
-
SHA1
e833264f87c3afe871a2ac3ccd78fc77f5bf2965
-
SHA256
91db926d13bb0137347991e30a1ccd093e535ff375e102bfd44d9aae15650d21
-
SHA512
52f85135818d535c5b1bbae76be31ee29e009126ec3bd57dd684b7f6ef8f8a621c5e43c04f63527c796ec1749fdc16a3dc2775d124c594ab97e1d6404b4fe206
-
SSDEEP
1536:9qWp0jUkHuln1NyXwb/Gr3t65UtfssbkWh7A:9/2jzHi/Gmg0ytfu
Malware Config
Extracted
guloader
http://185.161.211.58/Mekino_nanocore_rIfno101.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1044-2-0x00000000003C0000-0x00000000003CC000-memory.dmp family_guloader behavioral1/memory/1044-4-0x00000000003C0000-0x00000000003CC000-memory.dmp family_guloader -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exepid process 1044 1dabdd40fc265a39611acf8c31fb19db_JaffaCakes118.exe