guloader | 4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4

Analysis

max time kernel
149s
max time network
186s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 08:27

Target

4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe
Size

52KB
MD5

56d6212310c5ab3edf20f0edaf925b27
SHA1

2fc6d933ce07d8d14d908554c200925136fd014c
SHA256

4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4
SHA512

52d80436d54d25a5383766755147d5ba8a51d2f3071ae9116b31b5e37e9e700bdffc71d2ae5474ce016988f3d3b79961acbcc03ad04cd6eaf99deb248594187d
SSDEEP

384:snvKasK0S11V+bv+cmz7xeEXvwhwtvIMXkO4IJqErcGATIKG:snvyKcbv+cmXhfwh0wMXBjYE4GAz

Score

10^/10

Family

guloader

http://ribbonlogistics.com/js/jquery/public/cagefs/files/bin/9UJYHT.bin

https://www.mastqalander.pk/deal-manager/.well-known/pki-validation/9UJYHT.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

pid	process
1952	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe
1636	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

description	pid	process	target process
PID 1952 set thread context of 1636	1952	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

pid process

1952 4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

pid process

1952 4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

description	pid	process	target process
PID 1952 wrote to memory of 1636	1952	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe
PID 1952 wrote to memory of 1636	1952	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe
PID 1952 wrote to memory of 1636	1952	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe
PID 1952 wrote to memory of 1636	1952	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe
PID 1952 wrote to memory of 1636	1952	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe	4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe

C:\Users\Admin\AppData\Local\Temp\4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe
"C:\Users\Admin\AppData\Local\Temp\4b9dd65ba698f3c87ff4526f8486bf5d92d6e84a69a9066783c60a6502fcf9c4.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1636

memory/1636-58-0x00000000004010E4-mapping.dmp

Download
memory/1636-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1636-66-0x00000000001B0000-0x00000000002B0000-memory.dmp

Filesize
1024KB

Download
memory/1636-67-0x0000000076F50000-0x00000000770F9000-memory.dmp

Filesize
1.7MB

Download
memory/1636-68-0x0000000077130000-0x00000000772B0000-memory.dmp

Filesize
1.5MB

Download
memory/1636-69-0x0000000076F50000-0x00000000770F9000-memory.dmp

Filesize
1.7MB

Download
memory/1952-57-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1952-59-0x0000000000300000-0x000000000030B000-memory.dmp

Filesize
44KB

Download
memory/1952-60-0x0000000076F50000-0x00000000770F9000-memory.dmp

Filesize
1.7MB

Download
memory/1952-62-0x0000000077130000-0x00000000772B0000-memory.dmp

Filesize
1.5MB

Download