guloader | 021019d43c3673e246c205092aaf3db73469849815b3b3dbf303612a5c0868bf

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-02-2023 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021019d43c3673e246c205092aaf3db73469849815b3b3dbf303612a5c0868bf.exe
Size

553KB
MD5

84b26fb04959307ac94f6ff656d56718
SHA1

fdff48663e2111922a3497731a65cc6ef067ff3d
SHA256

021019d43c3673e246c205092aaf3db73469849815b3b3dbf303612a5c0868bf
SHA512

3899cb68c0976d5f3b57ac9603a9c4405d4a2f229ca6a0791b7a0068bf77238a335b7f0033e8bbdb146cf01f102cdc5690a0504e6ecad577f658845ee31d051b
SSDEEP

12288:H5OCjkGNTgoQq6GYbARZuxgiust858fkYwP:FdTgoQ7GFRUxu4FO

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
1708	021019d43c3673e246c205092aaf3db73469849815b3b3dbf303612a5c0868bf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Ovensman.God147	021019d43c3673e246c205092aaf3db73469849815b3b3dbf303612a5c0868bf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\021019d43c3673e246c205092aaf3db73469849815b3b3dbf303612a5c0868bf.exe
"C:\Users\Admin\AppData\Local\Temp\021019d43c3673e246c205092aaf3db73469849815b3b3dbf303612a5c0868bf.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy140F.tmp\System.dll

Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
memory/1708-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x0000000003B40000-0x0000000004774000-memory.dmp

Filesize
12.2MB

Download
memory/1708-57-0x0000000003B40000-0x0000000004774000-memory.dmp

Filesize
12.2MB

Download