guloader | 86fd65c991039149a153bd61e8ffc9595fccdb8b4230be495ffc5e42eb84d6d4

General

Target

QUOTE.exe
Size

346KB
MD5

70c8145c188bf89c25f085e001c6f9a7
SHA1

d3e24cdd7272965ba04b8a0a7013c79e2633f7aa
SHA256

4cb733e05325fdf02dfaf5982ca2a8917373658aed1e328869077e92c6d73225
SHA512

445f9f092241810359fcd7e319ec5f0dc40a4f19656484085a37201b5dd348a246bb1916b9ee526292cdab00068c5f2ddaacc259470c440d4bd82c6ad6cfa40c
SSDEEP

6144:5XCKG5Hob1T0qQzmnMpv+j++KqfUuuMSR7EDaLLt+a5YiCmbnIGZmXjeqJKnuG2a:5XcHy1gqOppGq+k1imLwauAZCjeqJKuE

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2068	powershell.exe
2716	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 2716	2068	powershell.exe	32

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Konditional\threatened\mistilled\astringerings\backstretch.ini	QUOTE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2068	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2068	2320	QUOTE.exe	29
PID 2320 wrote to memory of 2068	2320	QUOTE.exe	29
PID 2320 wrote to memory of 2068	2320	QUOTE.exe	29
PID 2320 wrote to memory of 2068	2320	QUOTE.exe	29
PID 2068 wrote to memory of 2616	2068	powershell.exe	31
PID 2068 wrote to memory of 2616	2068	powershell.exe	31
PID 2068 wrote to memory of 2616	2068	powershell.exe	31
PID 2068 wrote to memory of 2616	2068	powershell.exe	31
PID 2068 wrote to memory of 2716	2068	powershell.exe	32
PID 2068 wrote to memory of 2716	2068	powershell.exe	32
PID 2068 wrote to memory of 2716	2068	powershell.exe	32
PID 2068 wrote to memory of 2716	2068	powershell.exe	32
PID 2068 wrote to memory of 2716	2068	powershell.exe	32
PID 2068 wrote to memory of 2716	2068	powershell.exe	32

C:\Users\Admin\AppData\Local\Temp\QUOTE.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -windowstyle hidden "$Isocracy202=Get-Content 'C:\Users\Admin\AppData\Local\Temp\gyllepumper\kamgavls\jargonels\Infami\Metagaster\Brnehaveklasserne.Mom';$Alderdoms=$Isocracy202.SubString(54858,3);.$Alderdoms($Isocracy202)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
    3⤵
    PID:2616
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gyllepumper\kamgavls\jargonels\Civilstandsbetegnelse.Adf

Filesize
326KB

MD5
2348c28b6ff7851f7162d654f935091f

SHA1
8442a4fa957f48402c3e3c2edd240acc5d4613cd

SHA256
6eb4bdccdb2c134c8083246c4dbfcb256f04e49b1689193422bc41b4b443164c

SHA512
27c9b48638d3ef6a191bf2861ee7ac86b4960a8e5b701f7db2787087fbe58e1d927dfa7247be90f35db6a6d7568110c3175e11b36e113d08bb021a7ce70d8771

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyllepumper\kamgavls\jargonels\Infami\Metagaster\Brnehaveklasserne.Mom

Filesize
53KB

MD5
2a4402450d6e37b4c5f6434e8e2548ae

SHA1
29b0d015b4c7420b576f3ce745b95f16f416045e

SHA256
05e03c9da534face56a3181a98e7194ce73a4638f713523d26aa97486f427eea

SHA512
e5a69a27041b0c1f8592861e820da036edc41cf3b0d630a6eea8e1cb8935ff88a5aec6a231e240c2c3fa52c47c64608ea84924cb6165170e3ee144335fbb4387

Download Submit
memory/2068-17-0x0000000077870000-0x0000000077A19000-memory.dmp

Filesize
1.7MB

Download
memory/2068-18-0x0000000077A60000-0x0000000077B36000-memory.dmp

Filesize
856KB

Download
memory/2068-8-0x0000000002C80000-0x0000000002CC0000-memory.dmp

Filesize
256KB

Download
memory/2068-12-0x0000000002C80000-0x0000000002CC0000-memory.dmp

Filesize
256KB

Download
memory/2068-7-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/2068-14-0x00000000055A0000-0x00000000055A4000-memory.dmp

Filesize
16KB

Download
memory/2068-15-0x0000000006780000-0x0000000008297000-memory.dmp

Filesize
27.1MB

Download
memory/2068-16-0x0000000006780000-0x0000000008297000-memory.dmp

Filesize
27.1MB

Download
memory/2068-6-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/2068-9-0x0000000002C80000-0x0000000002CC0000-memory.dmp

Filesize
256KB

Download
memory/2068-34-0x0000000006780000-0x0000000008297000-memory.dmp

Filesize
27.1MB

Download
memory/2068-20-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/2068-21-0x0000000002C80000-0x0000000002CC0000-memory.dmp

Filesize
256KB

Download
memory/2068-26-0x0000000006780000-0x0000000008297000-memory.dmp

Filesize
27.1MB

Download
memory/2716-24-0x0000000077A96000-0x0000000077A97000-memory.dmp

Filesize
4KB

Download
memory/2716-22-0x0000000077870000-0x0000000077A19000-memory.dmp

Filesize
1.7MB

Download
memory/2716-25-0x0000000000340000-0x00000000013A2000-memory.dmp

Filesize
16.4MB

Download
memory/2716-23-0x0000000077A60000-0x0000000077B36000-memory.dmp

Filesize
856KB

Download
memory/2716-27-0x00000000013B0000-0x0000000002EC7000-memory.dmp

Filesize
27.1MB

Download
memory/2716-19-0x00000000013B0000-0x0000000002EC7000-memory.dmp

Filesize
27.1MB

Download

Analysis

Sharing