guloader | 6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7

General

Target

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
Size

56KB
MD5

c240069b9ddb2fd496f2407101125fae
SHA1

a664a87f951ffba1d3842967e1fac9c603130777
SHA256

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7
SHA512

01ffa9979672bd7ea87270b08c0bef3410a5896f59a1be5168c8a47285480b7ee014e9d6bb1bed2a6f8e20c12571aba2dd8b329377214bf4f93d69d8d90b5fe6

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1lKLbw-xDVj_b7ejiygi2KBe2Iq6x1Lf2

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader Payload 2 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1996-61-0x000000000091B7DE-mapping.dmp	family_guloader
behavioral1/memory/1996-65-0x00000000000F0000-0x00000000001F0000-memory.dmp	family_guloader

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exeRegAsm.exe

pid process

900 6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
1996 RegAsm.exe

pid	process
900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
1996	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

description	pid	process	target process
PID 900 set thread context of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

pid process

900 6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

pid process

900 6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

pid	process
900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

pid	process
900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

description	pid	process	target process
PID 900 wrote to memory of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 900 wrote to memory of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 900 wrote to memory of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 900 wrote to memory of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 900 wrote to memory of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 900 wrote to memory of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 900 wrote to memory of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 900 wrote to memory of 1996	900	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
"C:\Users\Admin\AppData\Local\Temp\6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-57-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/900-58-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/900-59-0x00000000773D0000-0x0000000077579000-memory.dmp

Filesize
1.7MB

Download
memory/900-60-0x00000000775B0000-0x0000000077730000-memory.dmp

Filesize
1.5MB

Download
memory/900-62-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/900-67-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/900-68-0x00000000775B0000-0x0000000077730000-memory.dmp

Filesize
1.5MB

Download
memory/1996-61-0x000000000091B7DE-mapping.dmp

Download
memory/1996-65-0x00000000000F0000-0x00000000001F0000-memory.dmp

Filesize
1024KB

Download
memory/1996-66-0x00000000773D0000-0x0000000077579000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads