guloader | 06ec46f6d1f609aeafb8e8f5be8d12f8874902661394ce04094249558237c29d

Analysis

max time kernel
137s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69568a88abae198f5ab9ae1578383cc2.exe
Size 502KB
Sample240508-kd568sbe8x
SHA256 06ec46f6d1f609aeafb8e8f5be8d12f8874902661394ce04094249558237c29d
MD5 69568a88abae198f5ab9ae1578383cc2
SHA1 8465bb8304fcc90bc1fd0dd3da28d959258f4107
SHA512 1bfaf5241bc2c16dd1d75363c6437b526f7d59066ab7fe88734c04e17e3fc5555a2732476586814dc131aa7cfee630597587a66ff08d1a2c67b8b6b43beca3f7
SSDEEP 12288:Xn0A1rjiXSUyo10AOwpn8GcqxKGghasb6j8/:EAkXLgG5K15Wjg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4908	69568a88abae198f5ab9ae1578383cc2.exe
4908	69568a88abae198f5ab9ae1578383cc2.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1360	69568a88abae198f5ab9ae1578383cc2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4908	69568a88abae198f5ab9ae1578383cc2.exe
1360	69568a88abae198f5ab9ae1578383cc2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 1360	4908	69568a88abae198f5ab9ae1578383cc2.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1360	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1360	69568a88abae198f5ab9ae1578383cc2.exe
1360	69568a88abae198f5ab9ae1578383cc2.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4908	69568a88abae198f5ab9ae1578383cc2.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1360	4908	69568a88abae198f5ab9ae1578383cc2.exe	92
PID 4908 wrote to memory of 1360	4908	69568a88abae198f5ab9ae1578383cc2.exe	92
PID 4908 wrote to memory of 1360	4908	69568a88abae198f5ab9ae1578383cc2.exe	92
PID 4908 wrote to memory of 1360	4908	69568a88abae198f5ab9ae1578383cc2.exe	92
PID 4908 wrote to memory of 1360	4908	69568a88abae198f5ab9ae1578383cc2.exe	92

C:\Users\Admin\AppData\Local\Temp\69568a88abae198f5ab9ae1578383cc2.exe
"C:\Users\Admin\AppData\Local\Temp\69568a88abae198f5ab9ae1578383cc2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\69568a88abae198f5ab9ae1578383cc2.exe
  "C:\Users\Admin\AppData\Local\Temp\69568a88abae198f5ab9ae1578383cc2.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 1236
    3⤵
    - Program crash
    PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1360 -ip 1360
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa4884.tmp\System.dll
Size 11KB
SHA256 44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
MD5 883eff06ac96966270731e4e22817e11
SHA1 523c87c98236cbc04430e87ec19b977595092ac8
SHA512 60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
SSDEEP 96:UPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+l:UPtkuWJX7zB3kGwfy0nyUVsxCjOMb1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsf471C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsf471C.tmp
Size 66B
SHA256 cc1c32ae1abcb46fd4871832a8b7a51a440905d97709c53e66d16a0cd33276ee
MD5 3a055708070979e7bf5088d9471320ba
SHA1 cb4e803ae05765ee43787cbd3abb91166bbf8fd7
SHA512 3f3b5c9c1fdca9e76fda76ff601d11320b4866ee0b0358b014699e33be79252cb94390fb589fa5099b68d00491a207f3fe6223b955a5a4be6f1df1b389fd613e
MD5 SHA1 SHA512

Submit Download

nsf471C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsf471C.tmp
Size 16B
SHA256 ccaabed14663822955f3eed5f5ebac067cbb8c0ff9734a67d30fb94a14826237
MD5 433fcfa8e075cbbb3370cb2f6c4658da
SHA1 c7926411bd50f5556bfbea60e7d81931e1aad868
SHA512 1306f8e4430ed4e981b775409e14d7f927aa630c2bf89b42949fd9ba11b6aceaba61d2bebc925ebc4a7fb4ac2f9add8677f2f579b591639c0b5950fa68f64ee0
MD5 SHA1 SHA512

Submit Download

nsg4942.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4942.tmp
Size 10B
SHA256 a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
MD5 9a53fc1d7126c5e7c81bb5c15b15537b
SHA1 e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA512 b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
MD5 SHA1 SHA512

Submit Download

nsg4942.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4942.tmp
Size 15B
SHA256 b157a4d58f55726c15605ad776c9c961b28e1ce295d3ebcbad6ac80e5f2c9503
MD5 03789c00a9fe96c420d84fe30cbd902c
SHA1 c3e589ccd78b4e000d7d294a0d308dfd385a1f43
SHA512 16b8866f73666e76b5fd8e04d362a9907accee835e2814197829a06b6f8442ca2ac6aef98960afcaedf64ad403e53374eb59746716dd5b4257d26d4ebfff72a6
MD5 SHA1 SHA512

Submit Download

nsg4942.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4942.tmp
Size 16B
SHA256 cc88cad1427b013d4e18f53bbcf978b7d06baae78929230ef5c7ff06d2b8f03d
MD5 6cc8ad9db8f0ba7f81660ccd69b64a98
SHA1 91dc056ad77f912e803c37ffea075118f19e7634
SHA512 94272e4a4b39622a108f0d11fffc37825719aa911720c9a39482198e8360cbd11fdcd5535fa765f3c8677375da930f5dfd8408c3135bddd7a5a954397c85866a
MD5 SHA1 SHA512

Submit Download

nsg4942.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4942.tmp
Size 24B
SHA256 c04969dc8e4f8f577e3313979fc89804ac3dc5f2108bb0ec712535ca27fd2ea5
MD5 c7b1e0162df5441fbc3308af5a364ba2
SHA1 f86b61c5ee11de018cd6e0683fea7b6384c11e9c
SHA512 0422467fdb5258a307f8ab426fad92f580f1edfd97e97bdfc61fb40cbf17e9d262a5df6edd2296ff4cd72ab947cf166839688a1fd1aa0d389f919d4f05900904
MD5 SHA1 SHA512

Submit Download

nsg4942.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4942.tmp
Size 39B
SHA256 e76b217362f76067cb3ef3b4d41b63322cd1a9312b5a2c0906e8de2297c3e11d
MD5 23ef65ac5239828723de5d62caf8d67c
SHA1 476f395cf6e6050d1b26457029965d7836ca0a8c
SHA512 5a4db3a9083e3c16c327d8c2b3af241aec1d53b1937760974cdac4eedfe81fbc0119b65f527c8f8284e86002669bcfbeecc6a72ee8595a4fee0f495b6d9b95b2
MD5 SHA1 SHA512

Submit Download

nsg4942.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4942.tmp
Size 52B
SHA256 f01a1f7e7070628cbcaf52c19129cb39351ac8b989eefbda74c3e9a293938b94
MD5 963c3e474977adcb48f618704de7e2a3
SHA1 35efbe13c55798d52b51892a718cd1d4fd7b1d8a
SHA512 e1a74e703efd50b3a6817c0f85cf6e41bc58b85a8043ed6b7d964bb265279f93e15a2bee7455b87e1fb34366398bc45fadab1e9d16bd33392dc9c4d32103c114
MD5 SHA1 SHA512

Submit Download

nsg4942.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4942.tmp
Size 53B
SHA256 4c6b8ff4b70939ee43faf81fbe415892339a2163b7302e55ac82d82f1c284683
MD5 03a83defd7d41f54c7e8a419ab1f189d
SHA1 c6c8e3a6c7db71153279988d7fdcbfff90b7e93b
SHA512 b65ed6c5077b175c0a9a92a8cc9a90f23895aceb63c22e1521770aaf2fa0aadec7e9e28008b76f368e7f623d1e48a6d59c661a10b27a4833a0638c593dbf4c50
MD5 SHA1 SHA512

Submit Download

nsg4942.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4942.tmp
Size 60B
SHA256 58441afb24ac1fe610a47e89d0848865842be2383ab88c06d31fd70eec7ce470
MD5 b5a9b50b4278f31cf8e8ad052b2c39f6
SHA1 f1c88c09bad1aafaf5cd0de9eb29e9092f119a51
SHA512 b00baeeb3332e66724077ee2430cd43f2a39041b7b7d43d195199e2465d272f16b49711ef6c34c3617f3f815097e80f48b574ef7ac37b6de75ec777f5f9cb447
MD5 SHA1 SHA512

Submit Download

nsh4B19.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh4B19.tmp
Size 10B
SHA256 40ccdff1a037de0fb10d03ea9fe79c2c96e7f18c3c7dffd92b42c2f0ed749116
MD5 fa5eb52a9735c883abcf72a7f9cf2254
SHA1 a043e3d3df1605300a2f5629ad7a302082814956
SHA512 983e3f605f34f74e95db170da28f2584a74bf4d0047ea76c905c409e624d9db2a439e70beb07d8f879fb25549da52bb9cac6304281e2582d6e5b1b4f12ac21f2
MD5 SHA1 SHA512

Submit Download

nsh4B19.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh4B19.tmp
Size 19B
SHA256 ef5767399ab18e9604a1ce029f5ef4228a2421f599ab580bfff4e2e4fb6b409d
MD5 9b81480d3420dfa314a7ca8c685e3c0f
SHA1 1bd4068ee9af7a94d6c59c563f191783b158c65b
SHA512 2b5ecd729d0a9b22e1744a17051745d929c686b14e3815787769d2d9577ccdf12686201a48c64103fa11d8525e70074300ea95d5e23b09bbd5df9e6752bb4731
MD5 SHA1 SHA512

Submit Download

nsl49FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl49FE.tmp
Size 2B
SHA256 8e5202705183bd3a20a29e224499b0f77a8273ee33cd93cca71043c57ad4bdfc
MD5 25bc6654798eb508fa0b6343212a74fe
SHA1 15d5e1d3b948fd5986aaff7d9419b5e52c75fc93
SHA512 5868c6241ed3cfcc5c34bfe42e4b9f5c69e74975e524771d8c9f35cafc13fd01cd943ec4d8caefee79a1f4a457e69d20b7a86f88db83a5bc3e6bd8a619972898
MD5 SHA1 SHA512

Submit Download

nsl49FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl49FE.tmp
Size 6B
SHA256 6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c
MD5 50484c19f1afdaf3841a0d821ed393d2
SHA1 c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b
SHA512 d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b
MD5 SHA1 SHA512

Submit Download

nsl49FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl49FE.tmp
Size 9B
SHA256 ae789a65914ed002efb82dad89e5a4d4b9ec8e7faae30d0ed6e3c0d20f7d3858
MD5 2b3884fe02299c565e1c37ee7ef99293
SHA1 d8e2ef2a52083f6df210109fea53860ea227af9c
SHA512 aeb9374a52d0ad99336bfd4ec7bb7c5437b827845b8784d9c21f7d96a931693604689f6adc3ca25fad132a0ad6123013211ff550f427fa86e4f26c122ac6a0fe
MD5 SHA1 SHA512

Submit Download

nsq4895.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq4895.tmp
Size 3B
SHA256 01a219245e1501fee01ce0baea8f6065ce5162cea12fa570689a07c9717be81d
MD5 4e27f2226785e9abbe046fc592668860
SHA1 28b18a7f383131df509f7191f946a32c5a2e410c
SHA512 2a23585835bdb5db8175cab265566042282841efdcee8aaba8b9b5d466b0f165c0c5973033ce94bb9a8f07a956689247981ea07ac5a51408263e1653d9710adb
MD5 SHA1 SHA512

Submit Download

nsq4895.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq4895.tmp
Size 7B
SHA256 639b68bd180b47d542dd001d03557ee2d5b3065c3c783143bc9fb548f3fd7713
MD5 67cfa7364c4cf265b047d87ff2e673ae
SHA1 56e27889277981a9b63fcf5b218744a125bbc2fa
SHA512 17f28a136b20b89e9c3a418b08fd8e6fcaac960872dc33b2481af2d872efc44228f420759c57724f5d953c7ba98f2283e2acc7dfe5a58cbf719c6480ec7a648b
MD5 SHA1 SHA512

Submit Download

nsq4895.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq4895.tmp
Size 11B
SHA256 714144b6001dc56c1d3286dfd64909ca592a11aec7fdab9d290397d5393ab8f6
MD5 9b198a2aaf063ff060bb24b6fa5bb5df
SHA1 90b3670750dba26a0a1015b9403232ab9d4dd07e
SHA512 840d6d9f4db234e94aefb8b82a0ae406a22aba078ace2199d61a21d7e06190c44a38e2d5857f117de8b2019d90d382d1ce4f17204925951374f34d47fd99b1f7
MD5 SHA1 SHA512

Submit Download

nsq4895.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq4895.tmp
Size 18B
SHA256 0910aef0152e26373651bd0550d8d61e3f1e72820e69c3fec56ae50cd225a493
MD5 a24188ce6d4a713d3508b4c0ec4860ff
SHA1 1e4b331b57d9d633687b5ecdaf35b0ab55c72e44
SHA512 427e9635aed314bb5e5b90ba32c55d78922b3ba8276bc185889e3d3c635925c9148e1bf12d289b0a3c0fc8bbbe78b52f223d550d39b67682f2007b625db0331e
MD5 SHA1 SHA512

Submit Download

nsq4895.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq4895.tmp
Size 38B
SHA256 1feb2f5544655440d6bdf724776f3fc7b9c9dfb226fe96385423579e03954626
MD5 874eecec3fc35024420ce6005d6991bf
SHA1 743f31a53191481b4d1e95cc5d4330c123e69a0a
SHA512 b5b5ecceeb820a519b3bd277265ed874def5a0a16d1a13af5d60e709cc7e8c8fdfd7a7b7ba694943d00e7a30fb9c267258fd1ed57418c5187acb42177bbe6c6c
MD5 SHA1 SHA512

Submit Download

nsq4895.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq4895.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
MD5 SHA1 SHA512

Submit Download

memory/1360-580-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/1360-582-0x0000000000401000-0x0000000000404000-memory.dmp

Download

memory/1360-589-0x0000000077571000-0x0000000077691000-memory.dmp

Download

memory/1360-575-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/1360-576-0x0000000001660000-0x00000000029DA000-memory.dmp

Download

memory/1360-577-0x00000000775F8000-0x00000000775F9000-memory.dmp

Download

memory/1360-587-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/1360-579-0x0000000077615000-0x0000000077616000-memory.dmp

Download

memory/1360-588-0x0000000000401000-0x0000000000404000-memory.dmp

Download

memory/1360-586-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/1360-585-0x0000000001660000-0x00000000029DA000-memory.dmp

Download

memory/1360-583-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/1360-584-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/4908-581-0x0000000005240000-0x00000000065BA000-memory.dmp

Download

memory/4908-572-0x0000000005240000-0x00000000065BA000-memory.dmp

Download

memory/4908-573-0x0000000077571000-0x0000000077691000-memory.dmp

Download

memory/4908-578-0x0000000005240000-0x00000000065BA000-memory.dmp

Download

memory/4908-574-0x0000000010004000-0x0000000010005000-memory.dmp

Download