guloader | 88fc32a54543077e4f66df43eb5f41c908de966d843e5cc3b55298e8a12ed3f4

General

Target

b931d8035a682f8a20e7d22f2a3eb583.exe
Size

204KB
MD5

b931d8035a682f8a20e7d22f2a3eb583
SHA1

0beed11d5ff54eaefae2409c8379472ded8fb22b
SHA256

88fc32a54543077e4f66df43eb5f41c908de966d843e5cc3b55298e8a12ed3f4
SHA512

2fd87cd381843a06cdfb054803bc88492b58d23a9b06be9bc2e803e85cd515ab09b8238c868c7f9112eea17deccad0e8be717610f3962b696c5542ecd006bc96

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Executes dropped EXE 1 IoCs

Processes:

UNCONC~1.EXE

pid process

1988 UNCONC~1.EXE
Loads dropped DLL 3 IoCs

Processes:

b931d8035a682f8a20e7d22f2a3eb583.exeUNCONC~1.EXE

pid process

368 b931d8035a682f8a20e7d22f2a3eb583.exe
368 b931d8035a682f8a20e7d22f2a3eb583.exe
1988 UNCONC~1.EXE

pid	process
1988	UNCONC~1.EXE

pid	process
368	b931d8035a682f8a20e7d22f2a3eb583.exe
368	b931d8035a682f8a20e7d22f2a3eb583.exe
1988	UNCONC~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b931d8035a682f8a20e7d22f2a3eb583.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b931d8035a682f8a20e7d22f2a3eb583.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b931d8035a682f8a20e7d22f2a3eb583.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

UNCONC~1.EXE

pid process

1988 UNCONC~1.EXE

pid	process
1988	UNCONC~1.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b931d8035a682f8a20e7d22f2a3eb583.exe

description	pid	process	target process
PID 368 wrote to memory of 1988	368	b931d8035a682f8a20e7d22f2a3eb583.exe	UNCONC~1.EXE
PID 368 wrote to memory of 1988	368	b931d8035a682f8a20e7d22f2a3eb583.exe	UNCONC~1.EXE
PID 368 wrote to memory of 1988	368	b931d8035a682f8a20e7d22f2a3eb583.exe	UNCONC~1.EXE
PID 368 wrote to memory of 1988	368	b931d8035a682f8a20e7d22f2a3eb583.exe	UNCONC~1.EXE
PID 368 wrote to memory of 1988	368	b931d8035a682f8a20e7d22f2a3eb583.exe	UNCONC~1.EXE
PID 368 wrote to memory of 1988	368	b931d8035a682f8a20e7d22f2a3eb583.exe	UNCONC~1.EXE
PID 368 wrote to memory of 1988	368	b931d8035a682f8a20e7d22f2a3eb583.exe	UNCONC~1.EXE

C:\Users\Admin\AppData\Local\Temp\b931d8035a682f8a20e7d22f2a3eb583.exe
"C:\Users\Admin\AppData\Local\Temp\b931d8035a682f8a20e7d22f2a3eb583.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:368

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
MD5
d02d27c34545bc0b69ec291fbe5b872f

SHA1
5131370c2af88e34ab023026e166329971c2e6ce

SHA256
2c05003672f05ef6ac4a45270bd555d721d26b8b3f191b45ef07a55de60e861d

SHA512
0ebff991d0f312db8edbf8e021497c2df76f649edb1bbc9dab19bb0980e608ce3d5a763aa10ca3800f13ab28c11e52583ff2ccaec6bb8484a676266114bc905e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
MD5
d02d27c34545bc0b69ec291fbe5b872f

SHA1
5131370c2af88e34ab023026e166329971c2e6ce

SHA256
2c05003672f05ef6ac4a45270bd555d721d26b8b3f191b45ef07a55de60e861d

SHA512
0ebff991d0f312db8edbf8e021497c2df76f649edb1bbc9dab19bb0980e608ce3d5a763aa10ca3800f13ab28c11e52583ff2ccaec6bb8484a676266114bc905e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
MD5
d02d27c34545bc0b69ec291fbe5b872f

SHA1
5131370c2af88e34ab023026e166329971c2e6ce

SHA256
2c05003672f05ef6ac4a45270bd555d721d26b8b3f191b45ef07a55de60e861d

SHA512
0ebff991d0f312db8edbf8e021497c2df76f649edb1bbc9dab19bb0980e608ce3d5a763aa10ca3800f13ab28c11e52583ff2ccaec6bb8484a676266114bc905e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
MD5
d02d27c34545bc0b69ec291fbe5b872f

SHA1
5131370c2af88e34ab023026e166329971c2e6ce

SHA256
2c05003672f05ef6ac4a45270bd555d721d26b8b3f191b45ef07a55de60e861d

SHA512
0ebff991d0f312db8edbf8e021497c2df76f649edb1bbc9dab19bb0980e608ce3d5a763aa10ca3800f13ab28c11e52583ff2ccaec6bb8484a676266114bc905e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNCONC~1.EXE
MD5
d02d27c34545bc0b69ec291fbe5b872f

SHA1
5131370c2af88e34ab023026e166329971c2e6ce

SHA256
2c05003672f05ef6ac4a45270bd555d721d26b8b3f191b45ef07a55de60e861d

SHA512
0ebff991d0f312db8edbf8e021497c2df76f649edb1bbc9dab19bb0980e608ce3d5a763aa10ca3800f13ab28c11e52583ff2ccaec6bb8484a676266114bc905e

Download Submit
memory/368-60-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/1988-63-0x0000000000000000-mapping.dmp

Download
memory/1988-70-0x0000000000310000-0x000000000033A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing