guloader | d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe
Size

908KB
MD5

d36c6a744592b03820482ba99b2216fa
SHA1

911c42ca67b3d82c9300d65bc80d7a367fb99f98
SHA256

d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb
SHA512

ab90d28ce2948aea578b9b37e1ce732855945dae92a315472738616eebcfd87c7fe5411627ddf602cf6b0b650ca66485f10584a2ba3f9c70e59215fee99b0806
SSDEEP

12288:Knby4m2z2OppNHITNQjVSK1QXDT1dGZVhjcIAFdkC2akBNowmj8r:Wy4m2iOpzHU+MOQzmVhjc7rQaUNowmj2

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe

pid process

988 d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe

pid	process
988	d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe

Drops file in Windows directory 1 IoCs

Processes:

d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\Extracurial\Drumbler\Skitserede.Tak	d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe
"C:\Users\Admin\AppData\Local\Temp\d6cca13aa864e7fb973e2368574b4407794af1e8c744056aa763d40c16dbe4cb.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiDF97.tmp\System.dll
Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
memory/988-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/988-56-0x00000000039E0000-0x0000000004831000-memory.dmp

Filesize
14.3MB

Download
memory/988-57-0x00000000039E0000-0x0000000004831000-memory.dmp

Filesize
14.3MB

Download