Overview

overview

10

Static

static

bfd13f95b9...37.exe

windows7_x64

10

bfd13f95b9...37.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    01-07-2022 04:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bfd13f95b95c437e7f96fa29c687c056bc0ed4aa67893274ddc38a68f81e9a37.exe

  • Size

    60KB

  • MD5

    401c5beadf4c7e0d28128e94e007af81

  • SHA1

    2ac7ba7677e2d79cec8b4751f5a237e5bd21214c

  • SHA256

    bfd13f95b95c437e7f96fa29c687c056bc0ed4aa67893274ddc38a68f81e9a37

  • SHA512

    c77994dcb051320c3b78d69e94c7c66ccc645ce928790f8738127020e810ef6ec452f8dfb68d6daa4710aea851c10e6003318bec5dc2499b7066049bffc0aac9

Score
10/10
guloaderdownloader

Malware Config

Extracted

Family

guloader

C2

https://garyssales.com/c4.bin

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfd13f95b95c437e7f96fa29c687c056bc0ed4aa67893274ddc38a68f81e9a37.exe
    "C:\Users\Admin\AppData\Local\Temp\bfd13f95b95c437e7f96fa29c687c056bc0ed4aa67893274ddc38a68f81e9a37.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Users\Admin\AppData\Local\Temp\bfd13f95b95c437e7f96fa29c687c056bc0ed4aa67893274ddc38a68f81e9a37.exe
      "C:\Users\Admin\AppData\Local\Temp\bfd13f95b95c437e7f96fa29c687c056bc0ed4aa67893274ddc38a68f81e9a37.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/396-132-0x0000000000000000-mapping.dmp
    Download
  • memory/396-134-0x0000000000400000-0x000000000055D000-memory.dmp
    Filesize

    1.4MB

    Download
  • memory/396-136-0x0000000000401000-0x0000000000506000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/396-139-0x0000000000560000-0x0000000000660000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/396-140-0x00007FFE74910000-0x00007FFE74B05000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/396-141-0x00000000772B0000-0x0000000077453000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/396-142-0x00000000772B0000-0x0000000077453000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4780-133-0x00000000021B0000-0x00000000021B7000-memory.dmp
    Filesize

    28KB

    Download
  • memory/4780-138-0x00000000772B0000-0x0000000077453000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4780-137-0x00007FFE74910000-0x00007FFE74B05000-memory.dmp
    Filesize

    2.0MB

    Download