guloader | e99697188323e143ea9f2f595726cff836de361dfae04a2d461545a7c70d5483

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Evgh. rvs Armenia. 30.04.2024.exe
Size 783KB
Sample240430-nxt5vsbe7z
SHA256 0d8b7479bd9156032cf3287faee1807e96d68c7bce3835c7e3435951446bade1
MD5 6775321bbbe02737daff72cbfef1d3a5
SHA1 778fb1443b71b7afbf8965d6fad12247c7e2befc
SHA512 0970f311b772c014384a17d0c3b51a47f7046096d2d140db7fbe665087369fde3123c77283304121ac37517a3aa117787c42914884ec82f985ddf88c7531b810
SSDEEP 12288:DrC48OWaxjjtjj9bHGMIvxV7G5iMOQrLTI9AVZ/RZF:H7/jxjjtjj9JIvxV7G5iMN/0GZ/RZF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5000-186-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4952-185-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/5000-186-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2204-191-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4952-185-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Ufuldbaarnes% -windowstyle minimized $Nonconjecturably=(Get-ItemProperty -Path 'HKCU:\\Nausea\\').Wryer;%Ufuldbaarnes% ($Nonconjecturably)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2396	wab.exe
2396	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3084	powershell.exe
2396	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3084 set thread context of 2396	3084	powershell.exe	99
PID 2396 set thread context of 4952	2396	wab.exe	103
PID 2396 set thread context of 5000	2396	wab.exe	105
PID 2396 set thread context of 2204	2396	wab.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3740	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3084	powershell.exe
3084	powershell.exe
3084	powershell.exe
3084	powershell.exe
3084	powershell.exe
3084	powershell.exe
3084	powershell.exe
3084	powershell.exe
3084	powershell.exe
4952	wab.exe
4952	wab.exe
2204	wab.exe
2204	wab.exe
4952	wab.exe
4952	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3084	powershell.exe
2396	wab.exe
2396	wab.exe
2396	wab.exe
2396	wab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	powershell.exe
Token: SeDebugPrivilege	2204	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2396	wab.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3084	3944	Evgh. rvs Armenia. 30.04.2024.exe	87
PID 3944 wrote to memory of 3084	3944	Evgh. rvs Armenia. 30.04.2024.exe	87
PID 3944 wrote to memory of 3084	3944	Evgh. rvs Armenia. 30.04.2024.exe	87
PID 3084 wrote to memory of 3228	3084	powershell.exe	94
PID 3084 wrote to memory of 3228	3084	powershell.exe	94
PID 3084 wrote to memory of 3228	3084	powershell.exe	94
PID 3084 wrote to memory of 2396	3084	powershell.exe	99
PID 3084 wrote to memory of 2396	3084	powershell.exe	99
PID 3084 wrote to memory of 2396	3084	powershell.exe	99
PID 3084 wrote to memory of 2396	3084	powershell.exe	99
PID 3084 wrote to memory of 2396	3084	powershell.exe	99
PID 2396 wrote to memory of 2464	2396	wab.exe	100
PID 2396 wrote to memory of 2464	2396	wab.exe	100
PID 2396 wrote to memory of 2464	2396	wab.exe	100
PID 2464 wrote to memory of 3740	2464	cmd.exe	102
PID 2464 wrote to memory of 3740	2464	cmd.exe	102
PID 2464 wrote to memory of 3740	2464	cmd.exe	102
PID 2396 wrote to memory of 4952	2396	wab.exe	103
PID 2396 wrote to memory of 4952	2396	wab.exe	103
PID 2396 wrote to memory of 4952	2396	wab.exe	103
PID 2396 wrote to memory of 4952	2396	wab.exe	103
PID 2396 wrote to memory of 4628	2396	wab.exe	104
PID 2396 wrote to memory of 4628	2396	wab.exe	104
PID 2396 wrote to memory of 4628	2396	wab.exe	104
PID 2396 wrote to memory of 5000	2396	wab.exe	105
PID 2396 wrote to memory of 5000	2396	wab.exe	105
PID 2396 wrote to memory of 5000	2396	wab.exe	105
PID 2396 wrote to memory of 5000	2396	wab.exe	105
PID 2396 wrote to memory of 2204	2396	wab.exe	106
PID 2396 wrote to memory of 2204	2396	wab.exe	106
PID 2396 wrote to memory of 2204	2396	wab.exe	106
PID 2396 wrote to memory of 2204	2396	wab.exe	106

C:\Users\Admin\AppData\Local\Temp\Evgh. rvs Armenia. 30.04.2024.exe
"C:\Users\Admin\AppData\Local\Temp\Evgh. rvs Armenia. 30.04.2024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Unlovingness=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Deinotherium\Attn104\Jiber\Superintendentens\Chaptaliseringernes.Kro';$Polymer=$Unlovingness.SubString(60937,3);.$Polymer($Unlovingness)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    3⤵
    PID:3228
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Ufuldbaarnes% -windowstyle minimized $Nonconjecturably=(Get-ItemProperty -Path 'HKCU:\Nausea\').Wryer;%Ufuldbaarnes% ($Nonconjecturably)"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Ufuldbaarnes% -windowstyle minimized $Nonconjecturably=(Get-ItemProperty -Path 'HKCU:\Nausea\').Wryer;%Ufuldbaarnes% ($Nonconjecturably)"
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3740
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zgmrcmccyutiainnsarmduxbatsqyr"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4952
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\carjuwnvmclncpbrcdmnohskihkzrchzgk"
      4⤵
      PID:4628
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\carjuwnvmclncpbrcdmnohskihkzrchzgk"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:5000
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mcwuvp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chaptaliseringernes.Kro

Path C:\Users\Admin\AppData\Local\Temp\Deinotherium\Attn104\Jiber\Superintendentens\Chaptaliseringernes.Kro
Size 59KB
SHA256 b7d771d62b14d618608d7541302035b824e69cee7a497ab326a14e7562800f3a
MD5 7a00c4088c123d61422f4fe0db41bd24
SHA1 8dcb56788e82418c69556771808bb6c7b977067f
SHA512 e5c309d5d1cec2083750e242d901f8bdc3a845018603f6ed16436f65ebda2e1e7f5978ac3dc838199cae22ab7b0c12c930cf941bb25c33886731d76c5598ae37
SSDEEP 1536:YZzbiRU2WUoHhEBe6aOe0P2vG2Ib4OO5S3oaT:gzbUUnU2hmVaM2vR7NS3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Insipidly.Stu

Path C:\Users\Admin\AppData\Local\Temp\Deinotherium\Hypopharynx\Udbuler\Eomecon\Boligtilsynet\Insipidly.Stu
Size 289KB
SHA256 5be338accfc2df976a1bd39007957e5d5240336fbc7542d3e89cf3b17b0ee028
MD5 961a103dacf6f59cff06d81648a2f791
SHA1 dc779ee2a3129db451895e52f413592764c03e17
SHA512 3c0a75b3bb598c0883fb43a39bd94aa34f5a3c44b2c849a7cea3d2ff33f48cb48e58d64285568bbb522d1584bd49af48e77e712b0e74f03182331e23580e25fe
SSDEEP 6144:d+VnvDv+carHKpS+bdwr2LDxZZOhmBS1/8MLluKE2a4Op3VEJMB:dgbBaHKpSOdwr2LD4hmBC8uMXFVEJI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_blcsn12n.3ai.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_blcsn12n.3ai.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

zgmrcmccyutiainnsarmduxbatsqyr

Path C:\Users\Admin\AppData\Local\Temp\zgmrcmccyutiainnsarmduxbatsqyr
Size 4KB
SHA256 68ad415964e18bf4e229f7df89d1c0465a4284883cd3161c56c1480df119a8a9
MD5 6fd6c69a3f9395c627de278a1da855b7
SHA1 6d6a0096c5ee5be0a087cc2184b1a53f054b6e5c
SHA512 1efdb66e934ab0602c5ee2a03a8d7e7373a2630b5e538395afee868297c6b7d121dd7d741c271e36833bd61d4e2f9595bd9e1f6e8022d3f0a880b9c454ba5c98
SSDEEP 48:wvvv0/xfvvc/xfdvv0/xBvv0/xakvv0/7:mvyxvap1vyPvybvy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Illoyalitet.ini

Path C:\Users\Admin\Documents\Illoyalitet.ini
Size 36B
SHA256 e6862ee9e8fa0b8fcc82cc21c62f46d8a7a80bb4ccf039e1119b5e322c17de5a
MD5 40ed5b8117eadcde3752ec625327924b
SHA1 68e109bdc088f9a20c4081661eb47618df0838b2
SHA512 ad29fa5dc4bad695b914356c83779b69c28167e8f7156564bb6c8fd5d4709e0bd6ce2d85f914f4be7b81bf64e584d53033b82748039840047fa2800eb9ae9673
MD5 SHA1 SHA512

Submit Download

memory/2204-188-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2204-189-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2204-191-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2396-196-0x00000000218C0000-0x00000000218D9000-memory.dmp

Download

memory/2396-199-0x00000000218C0000-0x00000000218D9000-memory.dmp

Download

memory/2396-200-0x00000000218C0000-0x00000000218D9000-memory.dmp

Download

memory/2396-179-0x0000000001E60000-0x00000000058FF000-memory.dmp

Download

memory/3084-163-0x0000000005460000-0x0000000005470000-memory.dmp

Download

memory/3084-180-0x0000000073740000-0x0000000073EF0000-memory.dmp

Download

memory/3084-158-0x0000000006E40000-0x0000000006E62000-memory.dmp

Download

memory/3084-159-0x00000000080F0000-0x0000000008694000-memory.dmp

Download

memory/3084-156-0x0000000007AA0000-0x0000000007B36000-memory.dmp

Download

memory/3084-161-0x0000000008D20000-0x000000000939A000-memory.dmp

Download

memory/3084-165-0x0000000005460000-0x0000000005470000-memory.dmp

Download

memory/3084-164-0x0000000005460000-0x0000000005470000-memory.dmp

Download

memory/3084-155-0x0000000006980000-0x00000000069CC000-memory.dmp

Download

memory/3084-154-0x00000000068D0000-0x00000000068EE000-memory.dmp

Download

memory/3084-167-0x0000000007E80000-0x0000000007E84000-memory.dmp

Download

memory/3084-168-0x00000000093A0000-0x000000000CE3F000-memory.dmp

Download

memory/3084-170-0x0000000077471000-0x0000000077591000-memory.dmp

Download

memory/3084-169-0x0000000073740000-0x0000000073EF0000-memory.dmp

Download

memory/3084-171-0x0000000005460000-0x0000000005470000-memory.dmp

Download

memory/3084-157-0x0000000006E20000-0x0000000006E3A000-memory.dmp

Download

memory/3084-153-0x00000000063D0000-0x0000000006724000-memory.dmp

Download

memory/3084-137-0x0000000073740000-0x0000000073EF0000-memory.dmp

Download

memory/3084-138-0x0000000005460000-0x0000000005470000-memory.dmp

Download

memory/3084-139-0x00000000032A0000-0x00000000032D6000-memory.dmp

Download

memory/3084-143-0x0000000006220000-0x0000000006286000-memory.dmp

Download

memory/3084-142-0x0000000006140000-0x00000000061A6000-memory.dmp

Download

memory/3084-141-0x00000000058B0000-0x00000000058D2000-memory.dmp

Download

memory/3084-140-0x0000000005AA0000-0x00000000060C8000-memory.dmp

Download

memory/4952-185-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4952-182-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4952-181-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5000-184-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5000-183-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5000-186-0x0000000000400000-0x0000000000462000-memory.dmp

Download