guloader | 343b2ad0290badf5ce4700a3b93866f63ef8157b157f09cb3c9da4f3efd1c1c2

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

574KB
MD5

69bf840d279bb17e387e74914a122af6
SHA1

7c5e6a9c7107ed3ef251d5571ef2dd053165ec8d
SHA256

343b2ad0290badf5ce4700a3b93866f63ef8157b157f09cb3c9da4f3efd1c1c2
SHA512

6d374c7b929b3f52b1723e0a13e316a0d51e6fee43e949a3453b77b1d7a7e11018a5ae279996c004fa26f161115c331a96f0a1ef01725aa847ce292d18792d84
SSDEEP

12288:V0obxAhh3kCS/ylnAjQSLhBPlyF1+SULR2NpT5R:hlAoiFSnlyFk1LR8pT5R

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
2012	file.exe
2012	file.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\amelanchier\fagpolitisk.lid	file.exe
File opened for modification	C:\Windows\gedeskg\jeminas.chu	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstBB64.tmp\System.dll

Filesize
11KB

MD5
34442e1e0c2870341df55e1b7b3cccdc

SHA1
99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

SHA256
269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

SHA512
4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

Download Submit
C:\Users\Admin\antirachitically.ini

Filesize
37B

MD5
dc162b140294db15512791cd220783b0

SHA1
3aea809077577eea8a6615d32964dbbc2f74e783

SHA256
dee92e7829a8e3773852fab991cf08c61f9f47cd377aef602d778f2ab4b64af4

SHA512
b2fb8452db12a05ae6bbf7f50aa608cd219418f467c90f4d0023f5e666580bf613709ad50664c14a352412fc96ead8236850a338ca52e5327f09e9d704bf96f0

Download Submit
\Users\Admin\AppData\Local\Temp\nstBB64.tmp\System.dll

Filesize
11KB

MD5
34442e1e0c2870341df55e1b7b3cccdc

SHA1
99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

SHA256
269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

SHA512
4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

Download Submit
\Users\Admin\AppData\Local\Temp\nstBB64.tmp\System.dll

Filesize
11KB

MD5
34442e1e0c2870341df55e1b7b3cccdc

SHA1
99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

SHA256
269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

SHA512
4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

Download Submit
memory/2012-214-0x0000000003050000-0x0000000005073000-memory.dmp

Filesize
32.1MB

Download
memory/2012-215-0x0000000003050000-0x0000000005073000-memory.dmp

Filesize
32.1MB

Download