guloader | 5fa45df110fa3297cf9a6b980f8a8183569ce96b511bbe7d9cef1491ccca2136

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO# ROSIT MR2309040.exe
Size

761KB
MD5

9cca6c27ab4c2d57ffb57973de78658c
SHA1

961a879187aa8d7665cb00bbbfddcf67bce4172c
SHA256

051cb37b130a5af6e0fdcedbcbf67901e45baf9a99cf81e106b0e72e4ef2f6b9
SHA512

afca46b53e037e1872f4810c45ac0561bcef96b7dffc34bfd697082228934f66a5ea949b578a28f9d1e1b6ee4698e639dc2f4ed4769eec2aa9ad55382ba91461
SSDEEP

12288:Zgf3/HvEqA4wXuyo86ii63KnVdZsfZhgZ7q+V9qKWLZrEGg29fiuhx:83/PE0weyorI6nzOfZq7S+o9v

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
2492	PO# ROSIT MR2309040.exe
2492	PO# ROSIT MR2309040.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3912	PO# ROSIT MR2309040.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2492	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 3912	2492	PO# ROSIT MR2309040.exe	93
PID 3912 set thread context of 3364	3912	PO# ROSIT MR2309040.exe	56
PID 3912 set thread context of 3404	3912	PO# ROSIT MR2309040.exe	97
PID 3404 set thread context of 3364	3404	help.exe	56
PID 3404 set thread context of 4720	3404	help.exe	98

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\naah.Akt79	PO# ROSIT MR2309040.exe
File created	C:\Program Files (x86)\tribesmen.lnk	PO# ROSIT MR2309040.exe
File opened for modification	C:\Program Files (x86)\tribesmen.lnk	PO# ROSIT MR2309040.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\superline.Vrk218	PO# ROSIT MR2309040.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	help.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2492	PO# ROSIT MR2309040.exe
3912	PO# ROSIT MR2309040.exe
3364	Explorer.EXE
3364	Explorer.EXE
3404	help.exe
3404	help.exe
3404	help.exe
3404	help.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3364	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 3912	2492	PO# ROSIT MR2309040.exe	93
PID 2492 wrote to memory of 3912	2492	PO# ROSIT MR2309040.exe	93
PID 2492 wrote to memory of 3912	2492	PO# ROSIT MR2309040.exe	93
PID 2492 wrote to memory of 3912	2492	PO# ROSIT MR2309040.exe	93
PID 2492 wrote to memory of 3912	2492	PO# ROSIT MR2309040.exe	93
PID 3364 wrote to memory of 3404	3364	Explorer.EXE	97
PID 3364 wrote to memory of 3404	3364	Explorer.EXE	97
PID 3364 wrote to memory of 3404	3364	Explorer.EXE	97
PID 3404 wrote to memory of 4720	3404	help.exe	98
PID 3404 wrote to memory of 4720	3404	help.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\Temp\PO# ROSIT MR2309040.exe
  "C:\Users\Admin\AppData\Local\Temp\PO# ROSIT MR2309040.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\PO# ROSIT MR2309040.exe
    "C:\Users\Admin\AppData\Local\Temp\PO# ROSIT MR2309040.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3912
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\tribesmen.lnk

Filesize
1010B

MD5
9dd9da3d2db1cb56a760e7d3a4f9941e

SHA1
4941f4b2c5bb69ec07c94d6a7c6f8c4f9c0074cb

SHA256
45d66628094e96bf1f0e3e2c89b191745f30f38948d0f91bd250b133df216167

SHA512
118677286bdabaeb4d77d031c82b2f5c668bf39ead3d9981f664d62d84eb454b159716ba720877c46b200bd8c07e579853a1c6036dc8b5c3f8f2ad3cd414f4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy351C.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
memory/2492-24-0x0000000004A60000-0x0000000006CA5000-memory.dmp

Filesize
34.3MB

Download
memory/2492-18-0x0000000004A60000-0x0000000006CA5000-memory.dmp

Filesize
34.3MB

Download
memory/2492-20-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2492-19-0x00000000777C1000-0x00000000778E1000-memory.dmp

Filesize
1.1MB

Download
memory/2492-27-0x0000000004A60000-0x0000000006CA5000-memory.dmp

Filesize
34.3MB

Download
memory/3364-57-0x00000000090C0000-0x00000000091DC000-memory.dmp

Filesize
1.1MB

Download
memory/3364-49-0x00000000090C0000-0x00000000091DC000-memory.dmp

Filesize
1.1MB

Download
memory/3364-48-0x00000000090C0000-0x00000000091DC000-memory.dmp

Filesize
1.1MB

Download
memory/3364-39-0x000000000D010000-0x000000000DE97000-memory.dmp

Filesize
14.5MB

Download
memory/3364-46-0x000000000D010000-0x000000000DE97000-memory.dmp

Filesize
14.5MB

Download
memory/3404-47-0x0000000000C60000-0x0000000000CA0000-memory.dmp

Filesize
256KB

Download
memory/3404-44-0x0000000000C60000-0x0000000000CA0000-memory.dmp

Filesize
256KB

Download
memory/3404-43-0x0000000001770000-0x0000000001ABA000-memory.dmp

Filesize
3.3MB

Download
memory/3404-41-0x0000000000C60000-0x0000000000CA0000-memory.dmp

Filesize
256KB

Download
memory/3404-45-0x0000000001570000-0x000000000160D000-memory.dmp

Filesize
628KB

Download
memory/3404-40-0x0000000000C60000-0x0000000000CA0000-memory.dmp

Filesize
256KB

Download
memory/3912-32-0x0000000001660000-0x00000000038A5000-memory.dmp

Filesize
34.3MB

Download
memory/3912-30-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3912-38-0x0000000003AB0000-0x0000000003ACE000-memory.dmp

Filesize
120KB

Download
memory/3912-34-0x00000000777C1000-0x00000000778E1000-memory.dmp

Filesize
1.1MB

Download
memory/3912-33-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3912-31-0x0000000033B80000-0x0000000033ECA000-memory.dmp

Filesize
3.3MB

Download
memory/3912-42-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3912-37-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3912-29-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3912-28-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3912-26-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3912-25-0x0000000077865000-0x0000000077866000-memory.dmp

Filesize
4KB

Download
memory/3912-23-0x0000000077848000-0x0000000077849000-memory.dmp

Filesize
4KB

Download
memory/3912-22-0x0000000001660000-0x00000000038A5000-memory.dmp

Filesize
34.3MB

Download
memory/3912-21-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4720-56-0x0000021F58200000-0x0000021F582E9000-memory.dmp

Filesize
932KB

Download