guloader | 8815e244503f5cdbfbfdda71a58219e0baa627c0986e3638d4aedef87170993b

Analysis

max time kernel
142s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
Size

582KB
MD5

1f160df75b05e29bc10e44345b4f6e80
SHA1

0370aa0ec56c13cce6ae980fbb17573e50cb11cc
SHA256

8815e244503f5cdbfbfdda71a58219e0baa627c0986e3638d4aedef87170993b
SHA512

5eaa5f311286bc181217cea255418afe1ec989de146b67e90d4470770c18085aa524632fee00a190db52c08131fe6419124085dbd97b545905bc98d2c0206ba8
SSDEEP

6144:GtxpfgMigGBfkpJW23fSRuDztOu9YG7lGhqXPd09OH0O+hebWk:5cccvW23fSR0OSYG78i+OH0OjWk

Score

10^/10

guloader downloader upx

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4656	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
4656	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4656-0-0x0000000000400000-0x000000000053C000-memory.dmp	upx
behavioral2/memory/4656-134-0x0000000000400000-0x000000000053C000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fabriksskorstene\Docsmith\Porthors\Sbeoperaen.ini	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Folien\Pipile.ini	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
File created	C:\Windows\Fonts\Padishahs\Unanimatedness\knippers\Ankrendes.lnk	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
File opened for modification	C:\Windows\Fonts\Miljstyrelser\Forpraktikanternes\Kontrolafdelingernes.Wil	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5012	4656	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe	84
PID 4656 wrote to memory of 5012	4656	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe	84
PID 4656 wrote to memory of 5012	4656	1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Zootomic\Opdyrkende\Rodge\Ationsdatoernes\Controller\Skibsbyggers.Tek61
  2⤵
  PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsg5556.tmp\System.dll

Filesize
12KB

MD5
8cf2ac271d7679b1d68eefc1ae0c5618

SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8

SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5556.tmp\nsExec.dll

Filesize
7KB

MD5
f27689c513e7d12c7c974d5f8ef710d6

SHA1
e305f2a2898d765a64c82c449dfb528665b4a892

SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47

SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

Download Submit
C:\Users\Public\Music\Untwistable.ini

Filesize
41B

MD5
463ad6211320c412c8f090513beeb7ed

SHA1
bdcf774e0d7b4ccd6fb29ebab4d229581e3d4d9d

SHA256
1fa2c934842049b67b6b61fc7bf1a9edc377b23b035bee75bfe3041ce025da8a

SHA512
a8298062932bc541dd5b445125b8822f6f292cf6b54f96b8f067388d8368aa097a6fa2cebc5b6dd51dcbfdbad3521ff34ffb39e223fc26c41f7143ce72242ac6

Download Submit
memory/4656-0-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/4656-133-0x00000000032A0000-0x00000000033A1000-memory.dmp

Filesize
1.0MB

Download
memory/4656-134-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/4656-137-0x00000000032A0000-0x00000000033A1000-memory.dmp

Filesize
1.0MB

Download