guloader | 61becb2257f95087577ede433ea399f8dceb89ee6733e90c9919523befe3376e

Analysis

max time kernel
154s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/07/2022, 17:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Tedy.164775.28245.exe
Size 1.5MB
Sample220712-v9f74abebj
SHA256 61becb2257f95087577ede433ea399f8dceb89ee6733e90c9919523befe3376e
MD5 fd8a52c8ef3ffefff9dd3a6547a199c4
SHA1 bb9e34d20523d65aa3dff1817c762c79430e0cd7
SHA512 5620e1c128bb5fb4bbe64947ed9ea68ff1f34d8f91154b3e1de7a74a3895ec6481c093ffc4147a81bf20f18b9bc5cb340abd033b3bbc2aaebddcbbce33f6f3e5
MD5 SHA1 SHA512

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4036	SecuriteInfo.com.Variant.Tedy.164775.28245.exe
4036	SecuriteInfo.com.Variant.Tedy.164775.28245.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Kundeservicens142\Datidsformens\OFFENTLIGHEDENS.ini	SecuriteInfo.com.Variant.Tedy.164775.28245.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.164775.28245.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.164775.28245.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:4036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nscA80E.tmp\System.dll
Size 12KB
SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
MD5 792b6f86e296d3904285b2bf67ccd7e0
SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
MD5 SHA1 SHA512 SSDEEP

Submit Download