guloader | b0e40f83154bce1343f616094c5c67fb9991f06aa7a0fb1915f952e40c3d1bba

Analysis

max time kernel
133s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe
Size

120KB
MD5

15f0a22c06c2be78c39e1917e2e798ca
SHA1

7c2c3fe1b56f19376aca59d0cc44fe4614ec4f65
SHA256

b0e40f83154bce1343f616094c5c67fb9991f06aa7a0fb1915f952e40c3d1bba
SHA512

a40175c1bd27a94a417be7487783dd6f36d454bbe353805aa217990410bb664d4f835cce57d3c0fdc65f98be290bab0cd8eed7541793a38be2bec69260b8a3b4
SSDEEP

1536:qurIK51KOzsoK+dtPVpiudZNeLXWB/LnT0MWkbT3y+:3JEL4Xk6Zv3WO3y+

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=153DKiqSWVZMTgNlP2Tv0lSIALRl9DHhS

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/3584-4-0x0000000000D00000-0x0000000000E00000-memory.dmp	family_guloader

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

21 drive.google.com
22 drive.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exeRegAsm.exe

pid process

4932 15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe
3584 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe

description pid process target process

PID 4932 set thread context of 3584 4932 15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe

pid process

4932 15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe

pid process

4932 15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe

flow	ioc
21	drive.google.com
22	drive.google.com

pid	process
4932	15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe
3584	RegAsm.exe

description	pid	process	target process
PID 4932 set thread context of 3584	4932	15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe	RegAsm.exe

pid	process
4932	15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe

pid	process
4932	15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe

description	pid	process	target process
PID 4932 wrote to memory of 3584	4932	15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe	RegAsm.exe
PID 4932 wrote to memory of 3584	4932	15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe	RegAsm.exe
PID 4932 wrote to memory of 3584	4932	15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe	RegAsm.exe
PID 4932 wrote to memory of 3584	4932	15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\15f0a22c06c2be78c39e1917e2e798ca_JaffaCakes118.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3584-5-0x0000000077601000-0x0000000077721000-memory.dmp

Filesize
1.1MB

Download
memory/3584-4-0x0000000000D00000-0x0000000000E00000-memory.dmp

Filesize
1024KB

Download
memory/4932-2-0x00000000020F0000-0x00000000020F8000-memory.dmp

Filesize
32KB

Download
memory/4932-3-0x0000000077601000-0x0000000077721000-memory.dmp

Filesize
1.1MB

Download
memory/4932-15-0x00000000020F0000-0x00000000020F8000-memory.dmp

Filesize
32KB

Download
memory/4932-16-0x00000000020F0000-0x00000000020F8000-memory.dmp

Filesize
32KB

Download