guloader | 852a0d477d29d18d5b7c419e4d64a90761e04c908fc7171e2faab5ad40021fbc

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xerox322200524.exe
Size 464KB
Sample240522-rtlwvsed7t
SHA256 285009b0e71742b5fbe9407dcb25e378d35c2b9eab33f51618b46b647878c60d
MD5 5b578b597f4f4eef57eda996ee33cdb6
SHA1 efdb66166e1a45e9a30c67bc6d80e42f843b5604
SHA512 a7cc33e0e73c5c821d66a2ce437dfcd1ae8074161e3cafb9c2668dd3e411fc4073e1161f8781a17bbb3c8af29f210b9c3b7cf9d7a534fb278fc54ae4eabdeea3
SSDEEP 12288:vi3hR5SANiItEOU79Uhua4g8Do3BMJSojhvnH3:K3hv5iIizUhH4g8eqSqd3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 3 IoCs

pid	Process
512	xerox322200524.exe
512	xerox322200524.exe
512	xerox322200524.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
512	xerox322200524.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	512	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\xerox322200524.exe
"C:\Users\Admin\AppData\Local\Temp\xerox322200524.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1060
  2⤵
  - Program crash
  PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 512 -ip 512
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BgImage.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\BgImage.dll
Size 7KB
SHA256 286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9
MD5 9436196007f65f0ae96f64b1c8b2572e
SHA1 4b004b5c2865c9450876be83faa8cc96e1d12c01
SHA512 5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e
SSDEEP 96:8egk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:t7TJa2roqJyA2EN8diuTHje
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\System.dll
Size 11KB
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\nsDialogs.dll
Size 9KB
SHA256 59cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311
MD5 82c3f38cd34739872af07443c65d0bd8
SHA1 1f4ee2d394404a291eda6419f856adaf4b960237
SHA512 3a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d
SSDEEP 192:ow8cSzvTyl4tgi8pPjQM0PuAg0YNy+IFtSP:lBSzm+t18pZ0WAg0R+IFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Krydsrevisionernes.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Krydsrevisionernes.lnk
Size 906B
SHA256 3ded11541e82aa7b94e2dd827b63f2de4db589ee5914b906085d4ddfbbadb695
MD5 d574991a4df6d0d76d59b5c65ab0423f
SHA1 ebac8847ca2fb8610bfff14c315761ef5870b1e6
SHA512 89ab4ca99730bfedd36802281fe4f723d1b9cbca2acae999b7b5d5672567d94b00294d1e1a94acba135a750d2b267d46e01356b0dae89e553a9da34defc68925
MD5 SHA1 SHA512

Submit Download

memory/512-45-0x0000000004320000-0x0000000005F9B000-memory.dmp

Download

memory/512-46-0x0000000077191000-0x00000000772B1000-memory.dmp

Download

memory/512-47-0x0000000004320000-0x0000000005F9B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads