guloader | 43319fa796c6b542426e4e853a26a12d9a1cd49687878484a5bae88d246600cb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
z6FORMATOPROVEEDORESMETAX.exe
Size 383KB
Sample240429-xrhdjsad32
SHA256 43319fa796c6b542426e4e853a26a12d9a1cd49687878484a5bae88d246600cb
MD5 23e67f856583bc4edbab6d66fb5d3519
SHA1 335d696e7448570c632dc0b6f3aadfe69262d2ef
SHA512 893f81e5c0a8e64b4a2ab2edee73b7867255154191cd73ca9faddfc3c7c68454689dc3b297c7cf3bb51f14f3910fb9c0ff6f1ce5f1139961a8153e54c9868ffc
SSDEEP 6144:HT4DtVpZI3UNWc3n5C3Tsc8XANjZ8S+ztjsNtsZ7X9/wkm8mKuUE2OCQpPAvFeVY:HTgYEztxwquUfNQZAvsl9pSTlDt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4360-65-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2900-60-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4360-65-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2900-60-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2256-59-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Flerbrugerudgave% -windowstyle minimized $remontering=(Get-ItemProperty -Path 'HKCU:\\Forklaringsmodellen\\').Jeanna228;%Flerbrugerudgave% ($remontering)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1040	wab.exe
1040	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4944	powershell.exe
1040	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 1040	4944	powershell.exe	94
PID 1040 set thread context of 2900	1040	wab.exe	99
PID 1040 set thread context of 4360	1040	wab.exe	100
PID 1040 set thread context of 2256	1040	wab.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3724	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
2256	wab.exe
2256	wab.exe
2900	wab.exe
2900	wab.exe
2900	wab.exe
2900	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4944	powershell.exe
1040	wab.exe
1040	wab.exe
1040	wab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	2256	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1040	wab.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4944	2292	z6FORMATOPROVEEDORESMETAX.exe	83
PID 2292 wrote to memory of 4944	2292	z6FORMATOPROVEEDORESMETAX.exe	83
PID 2292 wrote to memory of 4944	2292	z6FORMATOPROVEEDORESMETAX.exe	83
PID 4944 wrote to memory of 2372	4944	powershell.exe	87
PID 4944 wrote to memory of 2372	4944	powershell.exe	87
PID 4944 wrote to memory of 2372	4944	powershell.exe	87
PID 4944 wrote to memory of 1040	4944	powershell.exe	94
PID 4944 wrote to memory of 1040	4944	powershell.exe	94
PID 4944 wrote to memory of 1040	4944	powershell.exe	94
PID 4944 wrote to memory of 1040	4944	powershell.exe	94
PID 4944 wrote to memory of 1040	4944	powershell.exe	94
PID 1040 wrote to memory of 432	1040	wab.exe	95
PID 1040 wrote to memory of 432	1040	wab.exe	95
PID 1040 wrote to memory of 432	1040	wab.exe	95
PID 432 wrote to memory of 3724	432	cmd.exe	97
PID 432 wrote to memory of 3724	432	cmd.exe	97
PID 432 wrote to memory of 3724	432	cmd.exe	97
PID 1040 wrote to memory of 2900	1040	wab.exe	99
PID 1040 wrote to memory of 2900	1040	wab.exe	99
PID 1040 wrote to memory of 2900	1040	wab.exe	99
PID 1040 wrote to memory of 2900	1040	wab.exe	99
PID 1040 wrote to memory of 4360	1040	wab.exe	100
PID 1040 wrote to memory of 4360	1040	wab.exe	100
PID 1040 wrote to memory of 4360	1040	wab.exe	100
PID 1040 wrote to memory of 4360	1040	wab.exe	100
PID 1040 wrote to memory of 2256	1040	wab.exe	101
PID 1040 wrote to memory of 2256	1040	wab.exe	101
PID 1040 wrote to memory of 2256	1040	wab.exe	101
PID 1040 wrote to memory of 2256	1040	wab.exe	101

C:\Users\Admin\AppData\Local\Temp\z6FORMATOPROVEEDORESMETAX.exe
"C:\Users\Admin\AppData\Local\Temp\z6FORMATOPROVEEDORESMETAX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Deserting=Get-Content 'C:\Users\Admin\AppData\Local\tjurhane\fasciolidae\stinksvampen\jebliksbilledes\Unrelative\Sikkativers\Regredieredes\Fastkurspolitikken.Vol';$teksthjden=$Deserting.SubString(61567,3);.$teksthjden($Deserting)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    3⤵
    PID:2372
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Flerbrugerudgave% -windowstyle minimized $remontering=(Get-ItemProperty -Path 'HKCU:\Forklaringsmodellen\').Jeanna228;%Flerbrugerudgave% ($remontering)"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Flerbrugerudgave% -windowstyle minimized $remontering=(Get-ItemProperty -Path 'HKCU:\Forklaringsmodellen\').Jeanna228;%Flerbrugerudgave% ($remontering)"
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3724
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rburvpsettslsro"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2900
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cvijvidghbkxdxcugh"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:4360
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\exncwsoavjccfdyyprxwp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_uxullinn.bvf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uxullinn.bvf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

rburvpsettslsro

Path C:\Users\Admin\AppData\Local\Temp\rburvpsettslsro
Size 4KB
SHA256 eef6222f63aae44aec7addd2cdf1d348af92b32e0be1d4c857c48d9a941d9dac
MD5 0c71400795defb1ddf2816dcb2440470
SHA1 a9f25ddc014a44b58a890ac42ea47d98a3f754a3
SHA512 4d5fd766afe850d8282b85ca0ff3ef36e225e754254f43e1e3e0147675d40f901096199e666310e7f70b6cfbe9f33f3dbe4a063fbd4df7267190bad5121efabf
SSDEEP 48:wvvv0HxfvvcHxfdvv0HxBvv0Hxakvv0H7:mvyxvKp1vyPvybvy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jernindustriers16.War

Path C:\Users\Admin\AppData\Local\tjurhane\fasciolidae\stinksvampen\Venstremnd\Kontraktforhandling\Bosnian48\Oprindelsers\Jernindustriers16.War
Size 317KB
SHA256 d91eed61446e903f869aef5a8cbb79838fb433c35a1395c7b4d73589cc9cb5ba
MD5 28f1c6b709a58427fc3ee47df638ed75
SHA1 bf77edc7db52ff80241230e47dddc8273d3fe645
SHA512 d193d9053b9ab401a56e2c939e98c2ad6fa55dede94ca4a61e8fc71c5427b4c8ca29964efed314676b1ff578d5b1a6328944816dfd01164deb3d1405ce44add4
SSDEEP 6144:zWsrEVaNZKi7h+tof8GEQsJFA8ShxPxFt6q8MtSp5QIVWT:zWsrt0iVkofoQsbmPd6jESpKIWT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fastkurspolitikken.Vol

Path C:\Users\Admin\AppData\Local\tjurhane\fasciolidae\stinksvampen\jebliksbilledes\Unrelative\Sikkativers\Regredieredes\Fastkurspolitikken.Vol
Size 60KB
SHA256 f383eb80238916fd6c00c1513464f841fefb622aad04f345f4bc69f8a24aa8b1
MD5 2a4c059165f67c3923409c13eb335f08
SHA1 327454ea9cef3b257a7a154bc75aa1dac1dc77d1
SHA512 d1d1898f852d9fb3af766fea3e06ffefad91af0bc4d5652716103f6f2151118b5129d8c9707fcaf14d3e16654f7148163b80ec03a3e2a4bbb036575666392560
SSDEEP 768:bxvCc7TZ/G5kUwtoHQsp55qLP4vozxzNVqsZPiL3B3uy1LnUIz75zx7IwUER81uu:1qJ+ltCWP3NzNVqLj5bDd9NxouDgUSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1040-72-0x0000000023940000-0x0000000023959000-memory.dmp

Download

memory/1040-71-0x0000000023940000-0x0000000023959000-memory.dmp

Download

memory/1040-51-0x00000000022B0000-0x0000000007D49000-memory.dmp

Download

memory/1040-68-0x0000000023940000-0x0000000023959000-memory.dmp

Download

memory/2256-58-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2256-59-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2256-57-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2900-54-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2900-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2900-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4360-55-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4360-65-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4360-61-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4944-23-0x0000000005B50000-0x0000000005B9C000-memory.dmp

Download

memory/4944-52-0x0000000073470000-0x0000000073C20000-memory.dmp

Download

memory/4944-32-0x0000000004570000-0x0000000004580000-memory.dmp

Download

memory/4944-31-0x0000000004570000-0x0000000004580000-memory.dmp

Download

memory/4944-29-0x0000000007EF0000-0x000000000856A000-memory.dmp

Download

memory/4944-35-0x0000000006FC0000-0x0000000006FC4000-memory.dmp

Download

memory/4944-36-0x0000000008570000-0x000000000E009000-memory.dmp

Download

memory/4944-37-0x0000000073470000-0x0000000073C20000-memory.dmp

Download

memory/4944-38-0x0000000004570000-0x0000000004580000-memory.dmp

Download

memory/4944-40-0x0000000076EC1000-0x0000000076FE1000-memory.dmp

Download

memory/4944-42-0x0000000004570000-0x0000000004580000-memory.dmp

Download

memory/4944-43-0x0000000004570000-0x0000000004580000-memory.dmp

Download

memory/4944-41-0x0000000004570000-0x0000000004580000-memory.dmp

Download

memory/4944-33-0x0000000004570000-0x0000000004580000-memory.dmp

Download

memory/4944-25-0x0000000005FE0000-0x0000000005FFA000-memory.dmp

Download

memory/4944-27-0x00000000072C0000-0x0000000007864000-memory.dmp

Download

memory/4944-26-0x0000000006030000-0x0000000006052000-memory.dmp

Download

memory/4944-24-0x0000000006C70000-0x0000000006D06000-memory.dmp

Download

memory/4944-4-0x00000000044C0000-0x00000000044F6000-memory.dmp

Download

memory/4944-22-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

Download

memory/4944-21-0x0000000005470000-0x00000000057C4000-memory.dmp

Download

memory/4944-9-0x0000000004AA0000-0x0000000004AC2000-memory.dmp

Download

memory/4944-10-0x0000000005290000-0x00000000052F6000-memory.dmp

Download

memory/4944-11-0x0000000005400000-0x0000000005466000-memory.dmp

Download

memory/4944-8-0x0000000004BB0000-0x00000000051D8000-memory.dmp

Download

memory/4944-5-0x0000000073470000-0x0000000073C20000-memory.dmp

Download

memory/4944-6-0x0000000004570000-0x0000000004580000-memory.dmp

Download

memory/4944-7-0x0000000004570000-0x0000000004580000-memory.dmp

Download