guloader | 29b4fb29e554f7742c65631632008d3dc162411ee22552fe75e386bc174af3d7

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BenefitsRequest#241305.com.exe
Size 563KB
Sample240514-hpsdeaef96
SHA256 29b4fb29e554f7742c65631632008d3dc162411ee22552fe75e386bc174af3d7
MD5 7ec58d2a993aa1b84ac13ac8b79533c3
SHA1 31b010160a16152ae34d9723da1562b54c858e2f
SHA512 46d8fe0ef416e4f6266e84e8a8b3fdb20ba820a98df16f7740580297c13df64bafb323a1f5ef4fce59e0743cdfd7302cf1df2afc6c5670ae2f471cdebd0bd64b
SSDEEP 12288:QMw/qS1ZEDK6eS5Z/O51Itwg2XiOQjKv0+PNKgk5Slw9:QMw/qogWSwItwViOQev0tl5Slw9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection downloader execution

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3868-56-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4016-57-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/3868-56-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2104-55-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4016-57-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3392	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4352	wab.exe
4352	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3392	powershell.exe
4352	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3392 set thread context of 4352	3392	powershell.exe	102
PID 4352 set thread context of 4016	4352	wab.exe	104
PID 4352 set thread context of 3868	4352	wab.exe	105
PID 4352 set thread context of 2104	4352	wab.exe	108

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\reservoirernes\racemism.ind	BenefitsRequest#241305.com.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
2104	wab.exe
2104	wab.exe
4016	wab.exe
4016	wab.exe
4016	wab.exe
4016	wab.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3392	powershell.exe
4352	wab.exe
4352	wab.exe
4352	wab.exe
4352	wab.exe
4352	wab.exe
4352	wab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	2104	wab.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3392	1804	BenefitsRequest#241305.com.exe	90
PID 1804 wrote to memory of 3392	1804	BenefitsRequest#241305.com.exe	90
PID 1804 wrote to memory of 3392	1804	BenefitsRequest#241305.com.exe	90
PID 3392 wrote to memory of 3852	3392	powershell.exe	92
PID 3392 wrote to memory of 3852	3392	powershell.exe	92
PID 3392 wrote to memory of 3852	3392	powershell.exe	92
PID 3392 wrote to memory of 4352	3392	powershell.exe	102
PID 3392 wrote to memory of 4352	3392	powershell.exe	102
PID 3392 wrote to memory of 4352	3392	powershell.exe	102
PID 3392 wrote to memory of 4352	3392	powershell.exe	102
PID 3392 wrote to memory of 4352	3392	powershell.exe	102
PID 4352 wrote to memory of 4444	4352	wab.exe	103
PID 4352 wrote to memory of 4444	4352	wab.exe	103
PID 4352 wrote to memory of 4444	4352	wab.exe	103
PID 4352 wrote to memory of 4016	4352	wab.exe	104
PID 4352 wrote to memory of 4016	4352	wab.exe	104
PID 4352 wrote to memory of 4016	4352	wab.exe	104
PID 4352 wrote to memory of 4016	4352	wab.exe	104
PID 4352 wrote to memory of 3868	4352	wab.exe	105
PID 4352 wrote to memory of 3868	4352	wab.exe	105
PID 4352 wrote to memory of 3868	4352	wab.exe	105
PID 4352 wrote to memory of 3868	4352	wab.exe	105
PID 4352 wrote to memory of 4220	4352	wab.exe	106
PID 4352 wrote to memory of 4220	4352	wab.exe	106
PID 4352 wrote to memory of 4220	4352	wab.exe	106
PID 4352 wrote to memory of 1164	4352	wab.exe	107
PID 4352 wrote to memory of 1164	4352	wab.exe	107
PID 4352 wrote to memory of 1164	4352	wab.exe	107
PID 4352 wrote to memory of 2104	4352	wab.exe	108
PID 4352 wrote to memory of 2104	4352	wab.exe	108
PID 4352 wrote to memory of 2104	4352	wab.exe	108
PID 4352 wrote to memory of 2104	4352	wab.exe	108

C:\Users\Admin\AppData\Local\Temp\BenefitsRequest#241305.com.exe
"C:\Users\Admin\AppData\Local\Temp\BenefitsRequest#241305.com.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Scumless=cat 'C:\Users\Admin\AppData\Roaming\frafrendes\stjmaaling\Porcelain12.Cal';$Kirkebssens=$Scumless.substring(34528,3);.$Kirkebssens($Scumless)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
    3⤵
    PID:3852
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pirrsylq"
      4⤵
      PID:4444
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pirrsylq"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4016
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zkwjtrdkdkf"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:3868
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kekuujolzsyuho"
      4⤵
      PID:4220
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kekuujolzsyuho"
      4⤵
      PID:1164
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kekuujolzsyuho"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_f52doclh.4hw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f52doclh.4hw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pirrsylq

Path C:\Users\Admin\AppData\Local\Temp\pirrsylq
Size 4KB
SHA256 7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04
MD5 10fa8ec140c204486092fb161e567ec7
SHA1 4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473
SHA512 9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76
SSDEEP 48:wvvv05xfvvc5xfdvv05xBvv05xakvv057:mvAxvYp1vAPvAbvA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Porcelain12.Cal

Path C:\Users\Admin\AppData\Roaming\frafrendes\stjmaaling\Porcelain12.Cal
Size 74KB
SHA256 df8341843e16f3946a559f7789a213f133b8adf65827b691904aaa99c163744c
MD5 a6a30ef96062fda171816d2b55c58859
SHA1 2a2c10886b952a42851c5e7e6b9c9ac3a91a664f
SHA512 bbf6ac4cabef3f6f5365526e9558ad2b26e8f0175ef2294cde01759a0e1724b31f2aa306bc95d2f597c383f7687499f5bcee4432c303291d2824f79ee3ef99ac
SSDEEP 1536:EXcumSlbZXFhdhJBatdvWNWdcImmdLivoeT6s3+tgD6oPrU:EXuSl5dhJIfWO7dHe8tgJPrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sprechstallmeisterne.Tar

Path C:\Users\Admin\AppData\Roaming\frafrendes\stjmaaling\Sprechstallmeisterne.Tar
Size 330KB
SHA256 ee496a040913969b893ecd69e976ed41fbcf97a358cfc2277e616730c5a33f80
MD5 1c5a5241b767fa4fac3f5eb359b92c7b
SHA1 5a01f5244365231ee25d5d3e47076630808e3c18
SHA512 9808afe00a0cf196d9bfedefeedab4db7ea521665d68cc01421a51d0ee3268ee9927480e80325ccdb38ebfbdb97e6383abed686ebd901dcb7bd3af4af741246b
SSDEEP 6144:eHbjSXw4/W/rhhiPHFclc9evCPLNVXffYJRPV6ng2sG+4nSpb7Ej:eHSP2HiP2lcsvqfM6nyG+4nS9E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2104-55-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2104-54-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2104-51-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3392-24-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Download

memory/3392-39-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-19-0x00000000057F0000-0x0000000005B44000-memory.dmp

Download

memory/3392-6-0x0000000073C6E000-0x0000000073C6F000-memory.dmp

Download

memory/3392-25-0x0000000005E90000-0x0000000005EDC000-memory.dmp

Download

memory/3392-26-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-27-0x0000000006FA0000-0x0000000007036000-memory.dmp

Download

memory/3392-28-0x0000000006320000-0x000000000633A000-memory.dmp

Download

memory/3392-29-0x0000000006370000-0x0000000006392000-memory.dmp

Download

memory/3392-30-0x00000000075F0000-0x0000000007B94000-memory.dmp

Download

memory/3392-12-0x0000000005710000-0x0000000005776000-memory.dmp

Download

memory/3392-32-0x0000000008220000-0x000000000889A000-memory.dmp

Download

memory/3392-34-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-11-0x0000000005040000-0x0000000005062000-memory.dmp

Download

memory/3392-36-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-37-0x0000000073C6E000-0x0000000073C6F000-memory.dmp

Download

memory/3392-38-0x00000000088A0000-0x0000000009488000-memory.dmp

Download

memory/3392-13-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/3392-40-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-42-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-7-0x0000000002490000-0x00000000024C6000-memory.dmp

Download

memory/3392-44-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-8-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-9-0x0000000073C60000-0x0000000074410000-memory.dmp

Download

memory/3392-10-0x0000000005070000-0x0000000005698000-memory.dmp

Download

memory/3868-50-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3868-52-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3868-56-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4016-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4016-53-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4016-57-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4352-46-0x0000000001EB0000-0x0000000002A98000-memory.dmp

Download

memory/4352-43-0x0000000001EB0000-0x0000000002A98000-memory.dmp

Download

memory/4352-70-0x000000001E650000-0x000000001E669000-memory.dmp

Download

memory/4352-74-0x000000001E650000-0x000000001E669000-memory.dmp

Download

memory/4352-73-0x000000001E650000-0x000000001E669000-memory.dmp

Download