guloader | b7c2ddf77ff7bcc93ac0e5df3e6d03ec3c15103feff0f3cd96662342a40f273e

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe
Size 863KB
Sample240417-rbh29aah46
SHA256 3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34
MD5 80d8911cf9f3ccaa526a6afda63a4ae1
SHA1 a434e9f052a8c8b5ca0bca099e49317f15033bb3
SHA512 f2053a6e8dda2eff2b8ddfb1312c150dbe1f66d5a6029abc4284b9d6261817ba165359b83ab5ee99934acc23eb5603987a662aa21d911d9b66a8ad15847958ee
SSDEEP 12288:hIrQbs3XWa23NQHD9Olb6yboUTMJ2qSpGH8VCX5q//X5M/u1Lr:cuQXWj3NQROlOyboUTin8Vw5MqUr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2896	powershell.exe
2660	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2660	2896	powershell.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2896	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2896	2060	3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe	28
PID 2060 wrote to memory of 2896	2060	3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe	28
PID 2060 wrote to memory of 2896	2060	3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe	28
PID 2060 wrote to memory of 2896	2060	3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe	28
PID 2896 wrote to memory of 2696	2896	powershell.exe	30
PID 2896 wrote to memory of 2696	2896	powershell.exe	30
PID 2896 wrote to memory of 2696	2896	powershell.exe	30
PID 2896 wrote to memory of 2696	2896	powershell.exe	30
PID 2896 wrote to memory of 2660	2896	powershell.exe	32
PID 2896 wrote to memory of 2660	2896	powershell.exe	32
PID 2896 wrote to memory of 2660	2896	powershell.exe	32
PID 2896 wrote to memory of 2660	2896	powershell.exe	32
PID 2896 wrote to memory of 2660	2896	powershell.exe	32
PID 2896 wrote to memory of 2660	2896	powershell.exe	32

C:\Users\Admin\AppData\Local\Temp\3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe
"C:\Users\Admin\AppData\Local\Temp\3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -windowstyle hidden "$Ambulatorisk=Get-Content 'C:\Users\Admin\AppData\Roaming\akroterion\archmugwump\Meanwhiles.Bly';$Rubanke=$Ambulatorisk.SubString(63664,3);.$Rubanke($Ambulatorisk)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
    3⤵
    PID:2696
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Meanwhiles.Bly

Path C:\Users\Admin\AppData\Roaming\akroterion\archmugwump\Meanwhiles.Bly
Size 62KB
SHA256 f15b38a25f98ff312589b715a871359d8008bba74884f3a0f3ba14dffd269af1
MD5 8ae5a440769b5c5dcd2f0c137fb7e373
SHA1 45991089539f7aead1367746762b05600c28e40b
SHA512 04d53e16021b852fb02c558c4ebea9f0966d94bb4695fea982f66cfc36dcc5a306229c97b78501d336ffc42c4ea72e13571d7754a09b20dfa2cff7cd01bcfa2b
SSDEEP 1536:z2CXD6vF6OlRhR9+8R2cLKuzdLrSRBQHEMoqd:6WaZk8RzThr6+HPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

fdrenegaardes.Afv

Path C:\Users\Admin\AppData\Roaming\akroterion\archmugwump\fdrenegaardes.Afv
Size 318KB
SHA256 dc8c7bb3485128616bcf2673421cf120dbb07c0f436d094e57fd90b6c77e3ae7
MD5 1b8d9dc26352bd6794a5adffb9d60af8
SHA1 629e166140528068f25bc4f1d7f622318f93e93f
SHA512 05b245eb1249d2ae8cfc6ea4459f1cb63fa74baddb72fade0ab1af5bfd45d0d9f3ff0519c2e1dcb2bc63c0b1124d0d7bd110ea02b353fd5287a7f21208c3d3b6
SSDEEP 6144:9OCPrPWSrAHh1yUnSUbbzD+Q5jrEcGlf2Xwywi2Y3WJpXg:9JPrPW1xzDlx4pegJiB6pQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2660-36-0x00000000014A0000-0x00000000021C5000-memory.dmp

Download

memory/2660-34-0x0000000000430000-0x0000000001492000-memory.dmp

Download

memory/2660-32-0x0000000077866000-0x0000000077867000-memory.dmp

Download

memory/2660-30-0x0000000077830000-0x0000000077906000-memory.dmp

Download

memory/2660-29-0x0000000077640000-0x00000000777E9000-memory.dmp

Download

memory/2660-28-0x00000000014A0000-0x00000000021C5000-memory.dmp

Download

memory/2896-18-0x0000000002750000-0x0000000002790000-memory.dmp

Download

memory/2896-27-0x0000000077830000-0x0000000077906000-memory.dmp

Download

memory/2896-22-0x0000000006500000-0x0000000007225000-memory.dmp

Download

memory/2896-23-0x0000000006500000-0x0000000007225000-memory.dmp

Download

memory/2896-24-0x0000000073F10000-0x00000000744BB000-memory.dmp

Download

memory/2896-25-0x0000000002750000-0x0000000002790000-memory.dmp

Download

memory/2896-26-0x0000000077640000-0x00000000777E9000-memory.dmp

Download

memory/2896-21-0x0000000005130000-0x0000000005134000-memory.dmp

Download

memory/2896-19-0x0000000005FF0000-0x00000000060F0000-memory.dmp

Download

memory/2896-11-0x0000000073F10000-0x00000000744BB000-memory.dmp

Download

memory/2896-13-0x0000000002750000-0x0000000002790000-memory.dmp

Download

memory/2896-31-0x0000000006500000-0x0000000007225000-memory.dmp

Download

memory/2896-15-0x0000000002750000-0x0000000002790000-memory.dmp

Download

memory/2896-14-0x0000000002750000-0x0000000002790000-memory.dmp

Download

memory/2896-12-0x0000000073F10000-0x00000000744BB000-memory.dmp

Download

memory/2896-41-0x0000000006500000-0x0000000007225000-memory.dmp

Download