guloader | 3a0f0986193d0dc5e03ca1229e2509287593c03247e32bb5424009bc35e80738

Resubmissions

08-10-2022 00:17

221008-alen5seafl 10

07-10-2022 06:08

221007-gv6mjsbhhn 10

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-10-2022 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PKSJ Malware/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
Size

64KB
MD5

4aa5734fe9c86184f931f4ddaf2d4d7b
SHA1

a066ccad76f3c63d053cd68ac8692d4f4acf82ac
SHA256

2e18ad3e470b97415beb2cdb8e3ef7510bad21f0a5add020a7f9343dd959eeaa
SHA512

7355ffd3fc59af49af1d57f5327c7442a12c8e5ddc6ec9e176cc27fd4986cd6182f5f6ce91f892c07029efcac37f90d4dd077b6bb226b54c40621b94987a044c
SSDEEP

384:rdP9JIA7uJ1wK2xBpHbVbl+NGYD90pSCfZziEKffhaekBfdReVwoGHdRsArr2rOR:R9JIqNl/SSrrpBfiIdRsorZucnjtsq

Score

10^/10

guloader downloader guloader persistence

Malware Config

Extracted

Family

guloader

https://eficadgdl.com/well/Omitted-Credentials_encrypted_6A17930.bin

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 2 IoCs

guloader

Processes:

resource	yara_rule
behavioral25/memory/944-58-0x000000000020B7DE-mapping.dmp	family_guloader
behavioral25/memory/944-65-0x0000000000510000-0x0000000000610000-memory.dmp	family_guloader

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	RegAsm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Slngkapper9 = "C:\\Users\\Admin\\TROFFE\\erythroph.exe"	RegAsm.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exeRegAsm.exe

pid process

2028 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
944 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

description pid process target process

PID 2028 set thread context of 944 2028 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

pid process

2028 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
2028 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

pid process

2028 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

pid	process
2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
944	RegAsm.exe

description	pid	process	target process
PID 2028 set thread context of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe

pid	process
2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

pid	process
2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

description	pid	process	target process
PID 2028 wrote to memory of 984	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 984	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 984	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 984	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 984	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 984	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 984	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2028 wrote to memory of 944	2028	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\3\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
"C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\3\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\3\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe"
2⤵
PID:984

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\3\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-58-0x000000000020B7DE-mapping.dmp

Download
memory/944-65-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/944-66-0x0000000077660000-0x0000000077809000-memory.dmp

Filesize
1.7MB

Download
memory/944-67-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/2028-57-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2028-62-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2028-63-0x0000000077660000-0x0000000077809000-memory.dmp

Filesize
1.7MB

Download
memory/2028-64-0x0000000077840000-0x00000000779C0000-memory.dmp

Filesize
1.5MB

Download
memory/2028-68-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2028-69-0x0000000077840000-0x00000000779C0000-memory.dmp

Filesize
1.5MB

Download