guloader | baa364ff2127d6dc7cd49fddc9fe7a3e1c4b93173d8f7531d172a38285115ea9

Analysis

max time kernel
146s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UMOWA DEV8759 - pdf.exe
Size 545KB
Sample240417-mf9njsdf2z
SHA256 baa364ff2127d6dc7cd49fddc9fe7a3e1c4b93173d8f7531d172a38285115ea9
MD5 2f6fbd4dd3ffb23e86b8fe0c092d4d59
SHA1 a093d228d0aa8769419ef25153d1310e826aec79
SHA512 78cbb98cd4ade680b0bee831db01a4babf4c9b17c5252362cdb380291cd10deaf01a81657c9986802b07a246617b080ff4680d45d16e2a43d25fbe86a0fb2762
SSDEEP 12288:29HJyccI40lhH3k07aii3riCeYUG+PcuU:29HJZcI4gJGQAdx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 5 IoCs

pid	Process
1668	UMOWA DEV8759 - pdf.exe
1668	UMOWA DEV8759 - pdf.exe
1668	UMOWA DEV8759 - pdf.exe
1668	UMOWA DEV8759 - pdf.exe
1668	UMOWA DEV8759 - pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1668	UMOWA DEV8759 - pdf.exe
2740	UMOWA DEV8759 - pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 2740	1668	UMOWA DEV8759 - pdf.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\matteret.lnk	UMOWA DEV8759 - pdf.exe
File opened for modification	C:\Windows\Fonts\matteret.lnk	UMOWA DEV8759 - pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1668	UMOWA DEV8759 - pdf.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2740	1668	UMOWA DEV8759 - pdf.exe	28
PID 1668 wrote to memory of 2740	1668	UMOWA DEV8759 - pdf.exe	28
PID 1668 wrote to memory of 2740	1668	UMOWA DEV8759 - pdf.exe	28
PID 1668 wrote to memory of 2740	1668	UMOWA DEV8759 - pdf.exe	28
PID 1668 wrote to memory of 2740	1668	UMOWA DEV8759 - pdf.exe	28
PID 1668 wrote to memory of 2740	1668	UMOWA DEV8759 - pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\UMOWA DEV8759 - pdf.exe
"C:\Users\Admin\AppData\Local\Temp\UMOWA DEV8759 - pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\UMOWA DEV8759 - pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\UMOWA DEV8759 - pdf.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

matteret.lnk

Path C:\Windows\Fonts\matteret.lnk
Size 1KB
SHA256 38d5ed73171d3440f74da14015f32ab0d50af436be4ebddb8de6e554c4fa1d73
MD5 54e61e8d2a95c2a4edbd25bc8d0670aa
SHA1 26daf797b4754d81702c3ddc7ef2c55d0eaeb7e1
SHA512 486f4a0585257e1d6a73757c080556e7d66272580fc85634977dc64565c4193b73ef47423cd16d654fff797088e014cf208c27e9fec0d4602b3ffae408ba20dc
MD5 SHA1 SHA512

Submit Download

Banner.dll

Path \Users\Admin\AppData\Local\Temp\nsy3EE6.tmp\Banner.dll
Size 4KB
SHA256 f4530c734e3ce6253ffa6e5d755d61e4709ab9fc3b0eee3d4cdb89ec89c48bd2
MD5 aea3ac67fa68fd3f00edfbf9b43a2770
SHA1 aa59d1a4311c42b612ee66a027f224261beebbc3
SHA512 ffb6abc624d50ae8bc9c83ff518cb532dfd076f107077dceaf0e23d11c186a18671a5f538270be8b0b986e41ad1981a3606995046a6ee7b6b64a33c83ed72df9
MD5 SHA1 SHA512

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsy3EE6.tmp\System.dll
Size 11KB
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path \Users\Admin\AppData\Local\Temp\nsy3EE6.tmp\nsDialogs.dll
Size 9KB
SHA256 495bddc0be6e18e981db82fab9d1de55c7e269ab4ec3ff43035193bc017a307b
MD5 8ced0b79f7b9033d0795aab3be6d627c
SHA1 90c2043ffccd068f407c624c50ac7b795db1e132
SHA512 e38f63a342729f5ff6d0db607d7877b65c33ed19e2b5a97dd868ece8c2a3e829d4153624943444be2f0de885496161d54c1da9594bdc0a5a0bcc8b727e2facb0
SSDEEP 96:3Rp41CMj95rKhkfL5RkEdKkcxM2DjDf3GEEE9v5E9av+Yx4indY7ndS27gA:3RujesS4HREEK5MYxDdqn420
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1668-340-0x00000000036B0000-0x00000000051C7000-memory.dmp

Download

memory/1668-338-0x00000000778C0000-0x0000000077A69000-memory.dmp

Download

memory/1668-339-0x0000000077AB0000-0x0000000077B86000-memory.dmp

Download

memory/1668-341-0x0000000010000000-0x0000000010006000-memory.dmp

Download

memory/1668-337-0x00000000036B0000-0x00000000051C7000-memory.dmp

Download

memory/1668-352-0x00000000036B0000-0x00000000051C7000-memory.dmp

Download

memory/2740-342-0x00000000014E0000-0x0000000002FF7000-memory.dmp

Download

memory/2740-343-0x00000000778C0000-0x0000000077A69000-memory.dmp

Download

memory/2740-344-0x0000000077AE6000-0x0000000077AE7000-memory.dmp

Download

memory/2740-345-0x0000000000470000-0x00000000014D2000-memory.dmp

Download

memory/2740-346-0x00000000014E0000-0x0000000002FF7000-memory.dmp

Download

memory/2740-348-0x0000000077AB0000-0x0000000077B86000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads