General
-
Target
guna2dllmicrosoftservices.exe
-
Size
11.6MB
-
Sample
240702-krss3ayekk
-
MD5
8c736eeb47128f56a62aee0ed67beac8
-
SHA1
9145d0bd225d3072530ef31d7f9dda0149cd3ee3
-
SHA256
0b64c44ec911f7bd4ea005e55e24e600e43b9db6cfe2aef8b9e3bdd47c2efcdc
-
SHA512
1a6e54aa81eed6ce6a227a94ce9a580c4a7721b9e68416ae85165ea471f43f50f9b8657bf7c9d8bbf53be48c0b646c4fba1ace16ca83ee4f6fb8b8cbf73c294d
-
SSDEEP
196608:Fk+UPAxmtSHeNvX+wfm/pf+xfdjSEqR0ZWKsnarIWOzW0DaqkH:9MtSUvX+9/pWF8NRiBsnarIWeRaDH
Behavioral task
behavioral1
Sample
guna2dllmicrosoftservices.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
guna2dllmicrosoftservices.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
guna2dllmicrosoftservices.exe
-
Size
11.6MB
-
MD5
8c736eeb47128f56a62aee0ed67beac8
-
SHA1
9145d0bd225d3072530ef31d7f9dda0149cd3ee3
-
SHA256
0b64c44ec911f7bd4ea005e55e24e600e43b9db6cfe2aef8b9e3bdd47c2efcdc
-
SHA512
1a6e54aa81eed6ce6a227a94ce9a580c4a7721b9e68416ae85165ea471f43f50f9b8657bf7c9d8bbf53be48c0b646c4fba1ace16ca83ee4f6fb8b8cbf73c294d
-
SSDEEP
196608:Fk+UPAxmtSHeNvX+wfm/pf+xfdjSEqR0ZWKsnarIWOzW0DaqkH:9MtSUvX+9/pWF8NRiBsnarIWeRaDH
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Hide Artifacts
2Hidden Files and Directories
2