guloader | fc9b05cbb39884cc78b5cc7df7c1df9c2af37119b0d4ec8438b977b68f6c79af

Analysis

max time kernel
72s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2023 12:32

Target

fc9b05cbb39884cc78b5cc7df7c1df9c2af37119b0d4ec8438b977b68f6c79af.exe
Size

480KB
MD5

459ba9ee7169cfe26391afb0545e2278
SHA1

d5a6c3187baa4aaddb5355dde645669c416189a2
SHA256

fc9b05cbb39884cc78b5cc7df7c1df9c2af37119b0d4ec8438b977b68f6c79af
SHA512

83bac92b6462382321b833165f85aac9fbf71a0efa42689f703bb0c087df8956fd49d3e171594211caed2bc60cf127eb69f31cf599babd520436514e0dff5d94
SSDEEP

12288:ztoAXsmMsGFWGgTiwKhcQeuIbv/FeWUPT:q1mMsGF5oiVEs

Score

10^/10

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

fc9b05cbb39884cc78b5cc7df7c1df9c2af37119b0d4ec8438b977b68f6c79af.exe

pid process

5108 fc9b05cbb39884cc78b5cc7df7c1df9c2af37119b0d4ec8438b977b68f6c79af.exe

pid	process
5108	fc9b05cbb39884cc78b5cc7df7c1df9c2af37119b0d4ec8438b977b68f6c79af.exe

Drops file in Program Files directory 1 IoCs

Processes:

fc9b05cbb39884cc78b5cc7df7c1df9c2af37119b0d4ec8438b977b68f6c79af.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\subtilisation\Untumidly14.ini	fc9b05cbb39884cc78b5cc7df7c1df9c2af37119b0d4ec8438b977b68f6c79af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsoAABF.tmp\System.dll
Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
memory/5108-133-0x0000000003330000-0x0000000003431000-memory.dmp

Filesize
1.0MB

Download
memory/5108-134-0x0000000003330000-0x0000000003431000-memory.dmp

Filesize
1.0MB

Download