guloader | 3a0f0986193d0dc5e03ca1229e2509287593c03247e32bb5424009bc35e80738

Resubmissions

08-10-2022 00:17

221008-alen5seafl 10

07-10-2022 06:08

221007-gv6mjsbhhn 10

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2022 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PKSJ Malware/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
Size

64KB
MD5

4aa5734fe9c86184f931f4ddaf2d4d7b
SHA1

a066ccad76f3c63d053cd68ac8692d4f4acf82ac
SHA256

2e18ad3e470b97415beb2cdb8e3ef7510bad21f0a5add020a7f9343dd959eeaa
SHA512

7355ffd3fc59af49af1d57f5327c7442a12c8e5ddc6ec9e176cc27fd4986cd6182f5f6ce91f892c07029efcac37f90d4dd077b6bb226b54c40621b94987a044c
SSDEEP

384:rdP9JIA7uJ1wK2xBpHbVbl+NGYD90pSCfZziEKffhaekBfdReVwoGHdRsArr2rOR:R9JIqNl/SSrrpBfiIdRsorZucnjtsq

Score

10^/10

guloader downloader guloader persistence

Malware Config

Extracted

Family

guloader

https://eficadgdl.com/well/Omitted-Credentials_encrypted_6A17930.bin

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 2 IoCs

guloader

Processes:

resource	yara_rule
behavioral26/memory/1792-137-0x0000000000000000-mapping.dmp	family_guloader
behavioral26/memory/1792-141-0x0000000000C00000-0x0000000000D00000-memory.dmp	family_guloader

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	RegAsm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Slngkapper9 = "C:\\Users\\Admin\\TROFFE\\erythroph.exe"	RegAsm.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exeRegAsm.exe

pid process

2372 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
1792 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

description pid process target process

PID 2372 set thread context of 1792 2372 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

pid process

2372 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

pid process

2372 VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

pid	process
2372	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
1792	RegAsm.exe

description	pid	process	target process
PID 2372 set thread context of 1792	2372	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe

pid	process
2372	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

pid	process
2372	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

description	pid	process	target process
PID 2372 wrote to memory of 1792	2372	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2372 wrote to memory of 1792	2372	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2372 wrote to memory of 1792	2372	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe
PID 2372 wrote to memory of 1792	2372	VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\3\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
"C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\3\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\PKSJ Malware\3\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-137-0x0000000000000000-mapping.dmp

Download
memory/1792-141-0x0000000000C00000-0x0000000000D00000-memory.dmp

Filesize
1024KB

Download
memory/1792-142-0x00007FFB5B870000-0x00007FFB5BA65000-memory.dmp

Filesize
2.0MB

Download
memory/1792-143-0x0000000077700000-0x00000000778A3000-memory.dmp

Filesize
1.6MB

Download
memory/1792-144-0x0000000077700000-0x00000000778A3000-memory.dmp

Filesize
1.6MB

Download
memory/1792-145-0x00007FFB5B870000-0x00007FFB5BA65000-memory.dmp

Filesize
2.0MB

Download
memory/1792-146-0x0000000077700000-0x00000000778A3000-memory.dmp

Filesize
1.6MB

Download
memory/2372-138-0x0000000002280000-0x0000000002288000-memory.dmp

Filesize
32KB

Download
memory/2372-139-0x00007FFB5B870000-0x00007FFB5BA65000-memory.dmp

Filesize
2.0MB

Download
memory/2372-140-0x0000000077700000-0x00000000778A3000-memory.dmp

Filesize
1.6MB

Download
memory/2372-147-0x0000000002280000-0x0000000002288000-memory.dmp

Filesize
32KB

Download
memory/2372-148-0x0000000077700000-0x00000000778A3000-memory.dmp

Filesize
1.6MB

Download