guloader | f80962371161f31493fee8db67f3f5c053358e75cf2b7f4b1135de5baff377dd

Analysis

max time kernel
61s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2022 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOC-72110983657734771-pdf.exe
Size

347KB
MD5

c1f0b4caed18b81ecc00f38f10e9203d
SHA1

55838d97be9547cd578c9cfcf50a53cd9bfe7cc7
SHA256

f80962371161f31493fee8db67f3f5c053358e75cf2b7f4b1135de5baff377dd
SHA512

18d34c269c71663ed1f1c76a8a045f2f5c97ee0ba3b43b3d6d4a5c93966605cb7fa24dedef7ec7286a73093f5a2e01412ad254f70cbcaf32c8314189fa5e75a5
SSDEEP

6144:U57TcfYfVe5IpmseWlBsXpis+w6IvAmJWDMAc8h:vYMupms6iWj/WDMr8h

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
4480	DOC-72110983657734771-pdf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Stemningsblgerne\Edikters.lnk	DOC-72110983657734771-pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\DOC-72110983657734771-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DOC-72110983657734771-pdf.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:4480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsiD0B3.tmp\System.dll

Filesize
11KB

MD5
960a5c48e25cf2bca332e74e11d825c9

SHA1
da35c6816ace5daf4c6c1d57b93b09a82ecdc876

SHA256
484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

SHA512
cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

Download Submit
memory/4480-133-0x00000000028A0000-0x00000000029A0000-memory.dmp

Filesize
1024KB

Download
memory/4480-134-0x00000000028A0000-0x00000000029A0000-memory.dmp

Filesize
1024KB

Download