guloader | 2c79efff8958d72ea87da05593ae8e168f7c0e9bcbbc5f73ec390784337e99df

General

Target

Bibeskftigelserne221.exe
Size

1.2MB
MD5

792dec181c3f286826d04aecd6cf32f1
SHA1

d71c41fd445053571453dd43f8071e058de19ced
SHA256

ec9fe9526ec132e17c934f5b3993f164b8cb5ec15813171c04f63ff563ad4f1e
SHA512

fddd91dc77476ba57be516a4a4893beadcb84cf7d916bc80fda92640ec8a5a6b3e3a3efba72f5d56b9a0af6bf2a8092d40131825ed2c10b99a1367e47c169748
SSDEEP

24576:7BG3e6TOKsix+24/2LoxYHum/1DJQRzEWbo/bwo:dGe6TOiE202sxYOO10UDwo

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2556	powershell.exe
2472	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2556 set thread context of 2472	2556	powershell.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2556	2856	Bibeskftigelserne221.exe	28
PID 2856 wrote to memory of 2556	2856	Bibeskftigelserne221.exe	28
PID 2856 wrote to memory of 2556	2856	Bibeskftigelserne221.exe	28
PID 2856 wrote to memory of 2556	2856	Bibeskftigelserne221.exe	28
PID 2556 wrote to memory of 2560	2556	powershell.exe	30
PID 2556 wrote to memory of 2560	2556	powershell.exe	30
PID 2556 wrote to memory of 2560	2556	powershell.exe	30
PID 2556 wrote to memory of 2560	2556	powershell.exe	30
PID 2556 wrote to memory of 2472	2556	powershell.exe	32
PID 2556 wrote to memory of 2472	2556	powershell.exe	32
PID 2556 wrote to memory of 2472	2556	powershell.exe	32
PID 2556 wrote to memory of 2472	2556	powershell.exe	32
PID 2556 wrote to memory of 2472	2556	powershell.exe	32
PID 2556 wrote to memory of 2472	2556	powershell.exe	32

C:\Users\Admin\AppData\Local\Temp\Bibeskftigelserne221.exe
"C:\Users\Admin\AppData\Local\Temp\Bibeskftigelserne221.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -windowstyle hidden "$Coveter=Get-Content 'C:\Users\Admin\AppData\Roaming\Bilithon\benthoscope\Schizopod\Nonmakeup101.Pan55';$Paatalemyndighederne=$Coveter.SubString(54624,3);.$Paatalemyndighederne($Coveter)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
    3⤵
    PID:2560
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Bilithon\benthoscope\Demoralizingly167.Len

Filesize
325KB

MD5
17afb85f7d98834a22aa2d79adcc4952

SHA1
e4d0af396242985d07bec411d80e6516161a283f

SHA256
6d1b4dff638e2368991cce0c1fa8a7023764807dd6d9b053589053f4ac6e8cd8

SHA512
ce847608470eb94614c0d6ae272be49f1653bab99127d7ee5ae22fb35c35f9f91be36bf44fe30ddb2bec8841c674da6794b0c3dd067b168a5bdd313308a8d57d

Download Submit
C:\Users\Admin\AppData\Roaming\Bilithon\benthoscope\Schizopod\Nonmakeup101.Pan55

Filesize
53KB

MD5
2e56e126a7f68c9dbb6167bfc1cd26c2

SHA1
e45b4e9dff74f0711968994253b8fcaf39a5f8e3

SHA256
b3fb58fdae2d31784f1b1c4f62b2c20a985789de7cb63b6e4748168aac4fb70a

SHA512
15b0861ae57b05cc8906d8706332797da2152d44f16ba4c89da37fc6ec5753d543e890d898ecda384bcf1cf18894291a94262959dd7f395649e220629a814e3d

Download Submit
memory/2472-24-0x0000000001CF0000-0x00000000033BF000-memory.dmp

Filesize
22.8MB

Download
memory/2472-31-0x0000000001CF0000-0x00000000033BF000-memory.dmp

Filesize
22.8MB

Download
memory/2472-30-0x0000000000C80000-0x0000000001CE2000-memory.dmp

Filesize
16.4MB

Download
memory/2472-29-0x0000000077000000-0x00000000770D6000-memory.dmp

Filesize
856KB

Download
memory/2472-28-0x0000000077036000-0x0000000077037000-memory.dmp

Filesize
4KB

Download
memory/2472-26-0x0000000076E10000-0x0000000076FB9000-memory.dmp

Filesize
1.7MB

Download
memory/2556-16-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2556-18-0x0000000005460000-0x0000000005464000-memory.dmp

Filesize
16KB

Download
memory/2556-21-0x0000000076E10000-0x0000000076FB9000-memory.dmp

Filesize
1.7MB

Download
memory/2556-22-0x0000000077000000-0x00000000770D6000-memory.dmp

Filesize
856KB

Download
memory/2556-23-0x0000000073760000-0x0000000073D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-19-0x0000000006640000-0x0000000007D0F000-memory.dmp

Filesize
22.8MB

Download
memory/2556-25-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2556-20-0x0000000006640000-0x0000000007D0F000-memory.dmp

Filesize
22.8MB

Download
memory/2556-27-0x0000000006640000-0x0000000007D0F000-memory.dmp

Filesize
22.8MB

Download
memory/2556-10-0x0000000073760000-0x0000000073D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-13-0x0000000073760000-0x0000000073D0B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-11-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2556-12-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2556-38-0x0000000006640000-0x0000000007D0F000-memory.dmp

Filesize
22.8MB

Download

Analysis

Sharing