guloader | df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe
Size

613KB
MD5

598006943c00897342521805a95ca553
SHA1

ff0d0e310dcff0011161515c504df7d49dbeba7b
SHA256

df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9
SHA512

efa3006bde7ce0f05cf9bf11ee5beb700b2a9539d532b883906606db18c6a72e1fe9c7e414f41c76f54a17aa0a78350fd4ee93ff6fc0387bb24769a235a9a499
SSDEEP

6144:VGYgXWlQw/LOvqf+fNu8HQc4o97VsAHWUt0TNBpt8OGM8eow6oW8TWBa2T4Wrdc9:ADGz0I+M8J52U0NuMrs748dX2

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

pid process

1004 df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

pid	process
1004	df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

Drops file in System32 directory 1 IoCs

Processes:

df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Bkkenbundenes\Raadets\Miljadministrationerne.lnk	df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe
"C:\Users\Admin\AppData\Local\Temp\df148634d4c1283169e14cdf73cd66c217c4259eb24cdc4aa94e834d5373ccf9.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1004

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstE9E5.tmp\System.dll
Filesize
11KB

MD5
ee260c45e97b62a5e42f17460d406068

SHA1
df35f6300a03c4d3d3bd69752574426296b78695

SHA256
e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27

SHA512
a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3

Download Submit
memory/1004-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1004-56-0x0000000003770000-0x0000000004147000-memory.dmp

Filesize
9.8MB

Download
memory/1004-57-0x0000000003770000-0x0000000004147000-memory.dmp

Filesize
9.8MB

Download