guloader | c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
Size 692KB
Sample240522-cs633shc38
SHA256 c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5
MD5 904ff58ae02442b30663c9be0f4d9e77
SHA1 9009f89ab55e84c8bbf70303247c62f8048deb77
SHA512 46aceab3cd6a6ba0ad1405d4c4f124863f4fc07a5dd0ee7df2c210c285eeb0c367d91d4e7e6e7c4865e6f494dbd3c211fb09ff4485621f69e819be3ebbb722fa
SSDEEP 12288:K2Co9kUzVAtb/WMdXDKDAObjsZt7P68BmPE:Kt39W8aTbjsH7P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
1836	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 1836	892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe	94

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\pernille\aftershine.ini	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
File opened for modification	C:\Program Files (x86)\bevirket\kabinettets.bef	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
File opened for modification	C:\Program Files (x86)\barbatimao.Gro	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1836	892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe	94
PID 892 wrote to memory of 1836	892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe	94
PID 892 wrote to memory of 1836	892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe	94
PID 892 wrote to memory of 1836	892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe	94
PID 892 wrote to memory of 1836	892	c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe	94

C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
"C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe
  "C:\Users\Admin\AppData\Local\Temp\c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf5381.tmp\System.dll
Size 11KB
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/892-16-0x0000000004930000-0x0000000006970000-memory.dmp

Download

memory/892-17-0x0000000076EC1000-0x0000000076FE1000-memory.dmp

Download

memory/892-18-0x0000000073B14000-0x0000000073B15000-memory.dmp

Download

memory/892-20-0x0000000004930000-0x0000000006970000-memory.dmp

Download

memory/892-28-0x0000000004930000-0x0000000006970000-memory.dmp

Download

memory/1836-19-0x0000000001730000-0x0000000003770000-memory.dmp

Download

memory/1836-21-0x00000000004D0000-0x0000000001724000-memory.dmp

Download

memory/1836-23-0x0000000001730000-0x0000000003770000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads