guloader | 74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe
Size 104KB
Sample230718-k932rahd22
SHA256 74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a
MD5 20669aaed8d12c7513bd705aefc92f8d
SHA1 06ab6d734a0007b5fa97320ae4ac170f4b7ba1f5
SHA512 4870df33925297b8e196ecedf8ef69c68e737116b288819e26fb6af6a3987e6761b4a8f4277f3ff59e8123e5668de1134897e780d6a7f1c27daaeac676e38a9e
SSDEEP 768:XpOUzr1wlbA9Jpb3CFjyIyM8pbtMOcrvpWGYnNLGbRJH/UABF1CybT3IYW2IpEGj:5nNwlbA9JpGFjLXobt4vofnNK19GLKm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Extracted

Family

guloader

http://castmart.ga/~zadmin/icloud/bill_encrypted_9743D3F.bin

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3772	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe
908	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3772 set thread context of 908	3772	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe	91

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3772	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3772	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 908	3772	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe	91
PID 3772 wrote to memory of 908	3772	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe	91
PID 3772 wrote to memory of 908	3772	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe	91
PID 3772 wrote to memory of 908	3772	74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe	91

C:\Users\Admin\AppData\Local\Temp\74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe
"C:\Users\Admin\AppData\Local\Temp\74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe
  "C:\Users\Admin\AppData\Local\Temp\74f7a22f258a13c4926316f14a0178086601cdb54507a9f2c18cad8c388a753a.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-138-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/908-140-0x0000000000560000-0x0000000000660000-memory.dmp

Download

memory/3772-135-0x0000000002230000-0x0000000002240000-memory.dmp

Download

memory/3772-136-0x0000000077931000-0x0000000077A51000-memory.dmp

Download

memory/3772-137-0x0000000002230000-0x0000000002240000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads