guloader | f38a6a99eb426c7c222b78231ba730b59f4ca324235fe5099b00682e1deefca5

Analysis

max time kernel
157s
max time network
163s
platform
windows7_x64
resource
win7-en-20211208
submitted
21-01-2022 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Proforma Invoice.exe
Size

64KB
MD5

d09f1e15cbc187edc5792c61d8670a09
SHA1

2b7059a6964b634dd7bb372b5e62c38887b8e93d
SHA256

3561b08594d47d1c827ef76518197472532bfae0ffb9329711f51dc0ee9bdf2a
SHA512

f5c4436dc0dc002785d6574614ed2f9d2b3b175f3e14fa546dd131736d2cc263de289dd818940c5a61ca536616b48b69a0245698f2cdef6e5f2a4bc450fdec27

Score

10^/10

guloader downloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=1t2kWSyeWJ0Nxuf3Q0XWr6hhlOTDB_4Og

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Proforma Invoice.exeProforma Invoice.exe

pid process

1572 Proforma Invoice.exe
520 Proforma Invoice.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Proforma Invoice.exe

description pid process target process

PID 1572 set thread context of 520 1572 Proforma Invoice.exe Proforma Invoice.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Proforma Invoice.exe

pid process

1572 Proforma Invoice.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Proforma Invoice.exe

pid process

1572 Proforma Invoice.exe

pid	process
1572	Proforma Invoice.exe
520	Proforma Invoice.exe

description	pid	process	target process
PID 1572 set thread context of 520	1572	Proforma Invoice.exe	Proforma Invoice.exe

pid	process
1572	Proforma Invoice.exe

pid	process
1572	Proforma Invoice.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Proforma Invoice.exe

description	pid	process	target process
PID 1572 wrote to memory of 520	1572	Proforma Invoice.exe	Proforma Invoice.exe
PID 1572 wrote to memory of 520	1572	Proforma Invoice.exe	Proforma Invoice.exe
PID 1572 wrote to memory of 520	1572	Proforma Invoice.exe	Proforma Invoice.exe
PID 1572 wrote to memory of 520	1572	Proforma Invoice.exe	Proforma Invoice.exe
PID 1572 wrote to memory of 520	1572	Proforma Invoice.exe	Proforma Invoice.exe

C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572

C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-62-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/520-66-0x00000000001B0000-0x0000000000370000-memory.dmp

Filesize
1.8MB

Download
memory/520-67-0x0000000076D30000-0x0000000076ED9000-memory.dmp

Filesize
1.7MB

Download
memory/1572-57-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/1572-58-0x0000000076D30000-0x0000000076ED9000-memory.dmp

Filesize
1.7MB

Download
memory/1572-59-0x0000000076F10000-0x0000000077090000-memory.dmp

Filesize
1.5MB

Download
memory/1572-61-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download