guloader | 6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7

General

Target

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
Size

56KB
MD5

c240069b9ddb2fd496f2407101125fae
SHA1

a664a87f951ffba1d3842967e1fac9c603130777
SHA256

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7
SHA512

01ffa9979672bd7ea87270b08c0bef3410a5896f59a1be5168c8a47285480b7ee014e9d6bb1bed2a6f8e20c12571aba2dd8b329377214bf4f93d69d8d90b5fe6

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1lKLbw-xDVj_b7ejiygi2KBe2Iq6x1Lf2

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader Payload 2 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/4340-135-0x0000000000000000-mapping.dmp	family_guloader
behavioral2/memory/4340-137-0x0000000001190000-0x0000000001290000-memory.dmp	family_guloader

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exeRegAsm.exe

pid process

2012 6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
4340 RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

description	pid	process	target process
PID 2012 set thread context of 4340	2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

pid	process
2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

pid process

2012 6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe

description	pid	process	target process
PID 2012 wrote to memory of 2076	2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 2012 wrote to memory of 2076	2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 2012 wrote to memory of 2076	2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 2012 wrote to memory of 4340	2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 2012 wrote to memory of 4340	2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 2012 wrote to memory of 4340	2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe
PID 2012 wrote to memory of 4340	2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
"C:\Users\Admin\AppData\Local\Temp\6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe"
2⤵
PID:2076

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-132-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2012-133-0x00007FFC93FD0000-0x00007FFC941C5000-memory.dmp

Filesize
2.0MB

Download
memory/2012-134-0x0000000077C60000-0x0000000077E03000-memory.dmp

Filesize
1.6MB

Download
memory/2012-136-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2012-142-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2012-143-0x0000000077C60000-0x0000000077E03000-memory.dmp

Filesize
1.6MB

Download
memory/4340-135-0x0000000000000000-mapping.dmp

Download
memory/4340-137-0x0000000001190000-0x0000000001290000-memory.dmp

Filesize
1024KB

Download
memory/4340-138-0x00007FFC93FD0000-0x00007FFC941C5000-memory.dmp

Filesize
2.0MB

Download
memory/4340-139-0x0000000077C60000-0x0000000077E03000-memory.dmp

Filesize
1.6MB

Download
memory/4340-140-0x00007FFC93FD0000-0x00007FFC941C5000-memory.dmp

Filesize
2.0MB

Download
memory/4340-141-0x0000000077C60000-0x0000000077E03000-memory.dmp

Filesize
1.6MB

Download

pid	process
2012	6292564d7854234d7c88248a85533e748de0581a797eee52e323eefc9408abb7.exe
4340	RegAsm.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads