guloader | df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 13:49

Target

df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe
Size

613KB
MD5

598006943c00897342521805a95ca553
SHA1

ff0d0e310dcff0011161515c504df7d49dbeba7b
SHA256

df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9
SHA512

efa3006bde7ce0f05cf9bf11ee5beb700b2a9539d532b883906606db18c6a72e1fe9c7e414f41c76f54a17aa0a78350fd4ee93ff6fc0387bb24769a235a9a499
SSDEEP

6144:VGYgXWlQw/LOvqf+fNu8HQc4o97VsAHWUt0TNBpt8OGM8eow6oW8TWBa2T4Wrdc9:ADGz0I+M8J52U0NuMrs748dX2

Score

10^/10

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

pid process

1004 df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

pid	process
1004	df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

Drops file in System32 directory 1 IoCs

Processes:

df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Bkkenbundenes\Raadets\Miljadministrationerne.lnk	df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nstE9E5.tmp\System.dll

Filesize
11KB

MD5
ee260c45e97b62a5e42f17460d406068

SHA1
df35f6300a03c4d3d3bd69752574426296b78695

SHA256
e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27

SHA512
a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3

Download Submit
memory/1004-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1004-56-0x0000000003770000-0x0000000004147000-memory.dmp

Filesize
9.8MB

Download
memory/1004-57-0x0000000003770000-0x0000000004147000-memory.dmp

Filesize
9.8MB

Download