guloader | d81a38771f5d2a7fa9aa2d6e437cb191f632541ef600c2f48ca23d204497ed3f

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-02-2023 07:08

Target

200333852-042536-sanlccjavap0004-4332.pdf.exe
Size

590KB
MD5

e1f1c869069a506fbba24fe57af294d1
SHA1

402cfe8ce3c76bc658bbdcc503e8b91d841c33b8
SHA256

d8933e7d6e91c53200c334528a935434d1b0e2ce2286e9842e75911ea832b8c7
SHA512

15e6124c598b5280fa1c69ca2a115aa27420477d5de7b95a0db20abb64bea3a587424da5c54b6d8dbedf7ccdf7a7d26b529e57f5fad34f3bfb4152a23b55bd41
SSDEEP

12288:tgL+rDzX8+uSoJF6qmq+biBie2VlBvt4bgjoS9nOu2prh:M2ESofoqCDfnIooS9nL2pt

Score

10^/10

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 2 IoCs

Processes:

200333852-042536-sanlccjavap0004-4332.pdf.exe

pid process

1624 200333852-042536-sanlccjavap0004-4332.pdf.exe
1624 200333852-042536-sanlccjavap0004-4332.pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1624	200333852-042536-sanlccjavap0004-4332.pdf.exe
1624	200333852-042536-sanlccjavap0004-4332.pdf.exe

C:\Users\Admin\AppData\Local\Temp\200333852-042536-sanlccjavap0004-4332.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\200333852-042536-sanlccjavap0004-4332.pdf.exe"
1⤵
- Loads dropped DLL
PID:1624

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsy87C.tmp\System.dll
Filesize
11KB

MD5
0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1
10c51496d37cecd0e8a503a5a9bb2329d9b38116

SHA256
982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

SHA512
cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy87C.tmp\System.dll
Filesize
11KB

MD5
0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1
10c51496d37cecd0e8a503a5a9bb2329d9b38116

SHA256
982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

SHA512
cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

Download Submit
memory/1624-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1624-57-0x00000000039B0000-0x000000000538C000-memory.dmp

Filesize
25.9MB

Download
memory/1624-58-0x00000000039B0000-0x000000000538C000-memory.dmp

Filesize
25.9MB

Download