guloader | 40b6dc77998b71663fd29997962bec3b46647e8ee70cf3d579aed14ead46d660

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp.exe
Size 388KB
Sample230712-laa3cscf53
SHA256 40b6dc77998b71663fd29997962bec3b46647e8ee70cf3d579aed14ead46d660
MD5 109dbd7130e7c7e519eddac87ccbc34c
SHA1 5dc36f89d0f473aac33c19a13d43bdf4b0de5618
SHA512 9b52de0fff63f26445de7a12a1fc6b8c3f3a98aff6995a176c7b56533b1786d0ce2d04073cd68a87ace1f0e113d75eb3c1db5e2bce820e5ae2e722dda3e9a4cb
SSDEEP 12288:4iuXtDKp9x6t/4W+OzWhYjjK5OuodU8R03xkH:EKr6SOz1jQb8UsMW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
980	tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path \Users\Admin\AppData\Local\Temp\nsz2D9A.tmp\System.dll
Size 11KB
SHA256 852047023ba0cae91c7a43365878613cfb4e64e36ff98c460e113d5088d68ef5
MD5 be2621a78a13a56cf09e00dd98488360
SHA1 75f0539dc6af200a07cdb056cddddec595c6cfd2
SHA512 b80cf1f678e6885276b9a1bfd9227374b2eb9e38bb20446d52ebe2c3dba89764aa50cb4d49df51a974478f3364b5dbcbc5b4a16dc8f1123b40c89c01725be3d1
SSDEEP 192:eB2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsE+:3S62Gw947ExuGDI7J8EF7KIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/980-63-0x0000000003790000-0x00000000046B7000-memory.dmp

Download

memory/980-64-0x0000000003790000-0x00000000046B7000-memory.dmp