guloader | c56c915cd0bc528bdb21d6037917d2e4cde18b2ef27a4b74a0420a5f205869e6

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cobaltbghdbghich13_browsingExe.exe
Size 63KB
Sample230802-wthxeshh6w
SHA256 c56c915cd0bc528bdb21d6037917d2e4cde18b2ef27a4b74a0420a5f205869e6
MD5 d657568f8e43f34111509a5e8df9f8c7
SHA1 143a124ec51df1c4b378344fcb92850b11d8ed8d
SHA512 8cfb5609955a228851b2e252d9c5dd3824f49b8bf62de05a3c2bb4096539e7dcdd574bc42af9113e5d22ccf937cd16a4e3584aeb7409ad1930de4144050a84fd
SSDEEP 768:Ev0eEH6pOTYCbvsyXnzWW0Q0wqwWKYjKDNO9Fds7ZRAByGZolQKgP:EaHXYCzbV0BwQjMN6TstRABBOlQt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader persistence

Malware Config

Extracted

Family

guloader

https://onedrive.live.com/download?cid=59DDD422D234EC53&resid=59DDD422D234EC53%21109&authkey=AP7E4GdQBTZYNjw

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Bacteriophag = "C:\\Users\\Admin\\udtrkningen\\fishlessu.exe"	ielowutil.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
468	Cobaltbghdbghich13_browsingExe.exe
560	ielowutil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 560	468	Cobaltbghdbghich13_browsingExe.exe	95

Suspicious behavior: MapViewOfSection 12 IoCs

pid	Process
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe
468	Cobaltbghdbghich13_browsingExe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
468	Cobaltbghdbghich13_browsingExe.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 3716	468	Cobaltbghdbghich13_browsingExe.exe	84
PID 468 wrote to memory of 3716	468	Cobaltbghdbghich13_browsingExe.exe	84
PID 468 wrote to memory of 3716	468	Cobaltbghdbghich13_browsingExe.exe	84
PID 468 wrote to memory of 548	468	Cobaltbghdbghich13_browsingExe.exe	85
PID 468 wrote to memory of 548	468	Cobaltbghdbghich13_browsingExe.exe	85
PID 468 wrote to memory of 548	468	Cobaltbghdbghich13_browsingExe.exe	85
PID 468 wrote to memory of 3336	468	Cobaltbghdbghich13_browsingExe.exe	86
PID 468 wrote to memory of 3336	468	Cobaltbghdbghich13_browsingExe.exe	86
PID 468 wrote to memory of 3336	468	Cobaltbghdbghich13_browsingExe.exe	86
PID 468 wrote to memory of 4620	468	Cobaltbghdbghich13_browsingExe.exe	87
PID 468 wrote to memory of 4620	468	Cobaltbghdbghich13_browsingExe.exe	87
PID 468 wrote to memory of 4620	468	Cobaltbghdbghich13_browsingExe.exe	87
PID 468 wrote to memory of 4924	468	Cobaltbghdbghich13_browsingExe.exe	88
PID 468 wrote to memory of 4924	468	Cobaltbghdbghich13_browsingExe.exe	88
PID 468 wrote to memory of 4924	468	Cobaltbghdbghich13_browsingExe.exe	88
PID 468 wrote to memory of 320	468	Cobaltbghdbghich13_browsingExe.exe	89
PID 468 wrote to memory of 320	468	Cobaltbghdbghich13_browsingExe.exe	89
PID 468 wrote to memory of 320	468	Cobaltbghdbghich13_browsingExe.exe	89
PID 468 wrote to memory of 4496	468	Cobaltbghdbghich13_browsingExe.exe	90
PID 468 wrote to memory of 4496	468	Cobaltbghdbghich13_browsingExe.exe	90
PID 468 wrote to memory of 4496	468	Cobaltbghdbghich13_browsingExe.exe	90
PID 468 wrote to memory of 700	468	Cobaltbghdbghich13_browsingExe.exe	91
PID 468 wrote to memory of 700	468	Cobaltbghdbghich13_browsingExe.exe	91
PID 468 wrote to memory of 700	468	Cobaltbghdbghich13_browsingExe.exe	91
PID 468 wrote to memory of 1912	468	Cobaltbghdbghich13_browsingExe.exe	92
PID 468 wrote to memory of 1912	468	Cobaltbghdbghich13_browsingExe.exe	92
PID 468 wrote to memory of 1912	468	Cobaltbghdbghich13_browsingExe.exe	92
PID 468 wrote to memory of 4688	468	Cobaltbghdbghich13_browsingExe.exe	93
PID 468 wrote to memory of 4688	468	Cobaltbghdbghich13_browsingExe.exe	93
PID 468 wrote to memory of 4688	468	Cobaltbghdbghich13_browsingExe.exe	93
PID 468 wrote to memory of 32	468	Cobaltbghdbghich13_browsingExe.exe	94
PID 468 wrote to memory of 32	468	Cobaltbghdbghich13_browsingExe.exe	94
PID 468 wrote to memory of 32	468	Cobaltbghdbghich13_browsingExe.exe	94
PID 468 wrote to memory of 560	468	Cobaltbghdbghich13_browsingExe.exe	95
PID 468 wrote to memory of 560	468	Cobaltbghdbghich13_browsingExe.exe	95
PID 468 wrote to memory of 560	468	Cobaltbghdbghich13_browsingExe.exe	95
PID 468 wrote to memory of 560	468	Cobaltbghdbghich13_browsingExe.exe	95

C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe
"C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:3716
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:548
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:3336
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:4620
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:4924
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:320
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:4496
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:700
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:1912
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:4688
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  PID:32
- C:\Program Files (x86)\internet explorer\ielowutil.exe
  "C:\Users\Admin\AppData\Local\Temp\Cobaltbghdbghich13_browsingExe.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-135-0x0000000000730000-0x0000000000738000-memory.dmp

Download

memory/468-136-0x0000000077031000-0x0000000077151000-memory.dmp

Download

memory/468-144-0x0000000000730000-0x0000000000738000-memory.dmp

Download

memory/468-145-0x0000000077031000-0x0000000077151000-memory.dmp

Download

memory/468-146-0x0000000000730000-0x0000000000738000-memory.dmp

Download

memory/560-137-0x0000000001270000-0x0000000001370000-memory.dmp

Download

memory/560-138-0x0000000001270000-0x0000000001370000-memory.dmp

Download

memory/560-139-0x0000000077031000-0x0000000077151000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads