guloader | 62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2023, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe
Size 1.5MB
Sample230804-vwmsqaec2z
SHA256 62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033
MD5 d4d886c2a26c7a0a2100dbbfaf7bd753
SHA1 344927ad5d62cc6e27d5011bde0cd8209e5d7399
SHA512 dca780b10dd38b5108f829a66eb1e32058cb4430970b747519d0c780cbef9f6f7e51e46ef8923d8ccac3acdc96d1b970de44b2bc2167d128f9369e070c573d2e
SSDEEP 24576:xy8I5+eb8yxWHy9+9tLFOsh2SwVgCuFAN2XyWjTmhdSxZycFfazuToXmJJRK/F5i:Lhruri5XyGugHB6mw7zLDwWKMkR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
2756	62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5068	2756	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\62f6c0808306a2863176d2b6302113abdd06f626f42269ea0da9fab94f058033exe_JC.exe"
1⤵
- Loads dropped DLL
PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 1100
  2⤵
  - Program crash
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2756 -ip 2756
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz77F0.tmp\System.dll
Size 11KB
SHA256 f0cd96e0b6e40f92ad1aa0efacde833bae807b92fca19bf062c1cf8acf29484b
MD5 b853d5d2361ade731e33e882707efc34
SHA1 c58b1aeabdf1cbb8334ef8797e7aceaa7a1cb6be
SHA512 8ea31d82ffa6f58dab5632fe72690d3a6db0be65aec85fc8a1f71626773c0974dcebefae17bcf67c4c56ef442545e985eea0b348ff6e4fc36740640092b08d69
SSDEEP 192:eA2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsEf:mS62Gw947ExuGDI7J8EF7KIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2756-143-0x0000000004ED0000-0x00000000058CC000-memory.dmp

Download

memory/2756-144-0x0000000004ED0000-0x00000000058CC000-memory.dmp