guloader | 5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a

General

Target

5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe
Size

784KB
MD5

e49773c89d735bf9e427e4108dce8a0e
SHA1

fbca00f3b541bc57ca9308a291184a1d38f59da0
SHA256

5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a
SHA512

4f24777d0156d3b09555a41e8bbebcb4b32c0686e2c856c2169e9a74be7e779f281b9ac00a02f2a91faf99c5dd26134e1b05bcf386ac08ad0b59786f496d3e24
SSDEEP

12288:c1nnU0REibppIBGG7B0bnwHpXNdQFQu+0TFpg6sFbY/zbWgpil1II7MlBcNQlY:unfrb3IBGGl0bydNdQahUj62i7Xy+

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\balancevelsen\xylotrya\clunkier.mis	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1680	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe
1680	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 1680	1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	30

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\catatonias\unknotted\enetageshusets.lnk	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sociologies\overlgge\ghastlily\riversider\sado.Fae158	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe
File opened for modification	C:\Windows\resources\0409\Skrupgrinendes72\handyrenes\Nougats\Rammage3\abekattens\Posterioristic56\Khazenim.ini	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe
File opened for modification	C:\Windows\resources\vindstdet\raketvrnssystemers\reffelt\enactments\cirkapriser\uniformitarian.ini	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe
File opened for modification	C:\Windows\resources\moistened\Taxman171\lapsided\franzs.Ska	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe
File opened for modification	C:\Windows\resources\0409\throughither\Inadequacy99\frottehaandkldets.ini	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	1680	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1680	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1680	1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	30
PID 1936 wrote to memory of 1680	1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	30
PID 1936 wrote to memory of 1680	1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	30
PID 1936 wrote to memory of 1680	1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	30
PID 1936 wrote to memory of 1680	1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	30
PID 1936 wrote to memory of 1680	1936	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	30
PID 1680 wrote to memory of 2436	1680	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	33
PID 1680 wrote to memory of 2436	1680	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	33
PID 1680 wrote to memory of 2436	1680	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	33
PID 1680 wrote to memory of 2436	1680	5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe	33

C:\Users\Admin\AppData\Local\Temp\5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe
"C:\Users\Admin\AppData\Local\Temp\5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe
  "C:\Users\Admin\AppData\Local\Temp\5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 68
    3⤵
    - Program crash
    PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi52A4.tmp\System.dll

Filesize
12KB

MD5
acd12e950b2ced1b5690f682d2c15b25

SHA1
639a1d0aaf669896377074281186cb6372811fd6

SHA256
6a28f1529bd59bc04f0519e086d2946ec4f09f5e4e6f30d2afb3c3585001dccf

SHA512
131bd07208d2d8c18ee9da36ce95e3c4a8d8acbb55fa96fc5a0affbc1d6e6b0ca733e9dd70ef1d5a0e15f91d88dbe1fe2c0656ea80b5a51e536ac54ab53110b4

Download Submit
memory/1680-20-0x0000000076DC0000-0x0000000076F69000-memory.dmp

Filesize
1.7MB

Download
memory/1680-52-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1680-54-0x0000000034860000-0x0000000034B63000-memory.dmp

Filesize
3.0MB

Download
memory/1680-53-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1680-56-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1680-18-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1680-55-0x0000000076FB0000-0x0000000077086000-memory.dmp

Filesize
856KB

Download
memory/1680-21-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1680-19-0x0000000001470000-0x0000000004515000-memory.dmp

Filesize
48.6MB

Download
memory/1680-22-0x0000000076FE6000-0x0000000076FE7000-memory.dmp

Filesize
4KB

Download
memory/1680-49-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1680-45-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1680-48-0x0000000001470000-0x0000000004515000-memory.dmp

Filesize
48.6MB

Download
memory/1680-47-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1680-51-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1936-17-0x00000000744A0000-0x00000000744A7000-memory.dmp

Filesize
28KB

Download
memory/1936-50-0x0000000003870000-0x0000000006915000-memory.dmp

Filesize
48.6MB

Download
memory/1936-23-0x00000000744A0000-0x00000000744A7000-memory.dmp

Filesize
28KB

Download
memory/1936-16-0x0000000076FB0000-0x0000000077086000-memory.dmp

Filesize
856KB

Download
memory/1936-15-0x0000000076DC0000-0x0000000076F69000-memory.dmp

Filesize
1.7MB

Download
memory/1936-14-0x0000000003870000-0x0000000006915000-memory.dmp

Filesize
48.6MB

Download
memory/1936-13-0x0000000003870000-0x0000000006915000-memory.dmp

Filesize
48.6MB

Download

Analysis

Sharing