guloader | 86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe
Size

380KB
MD5

5670f42a9ed9c593b72fdf7351cd5e6c
SHA1

781615f55566cd8f5442b6bf7e065ab7cea1b902
SHA256

86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6
SHA512

ace933955f63a7f7a0fd873907992371f6f36304b78bf12fe47f7046162f97a6b0cae082e1c354d9ada1ad6e631f1fcc1b26ad44e987a8a334f6b37e8e5d3f38
SSDEEP

6144:cM231sHcuulI7ph/+nA3feUHzXclMIXuLQwidBSGYFuXSjLat:UecuuAph/IAFzXhdLspY/U

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe
3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe
552	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3208 set thread context of 552	3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 552	3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe	95
PID 3208 wrote to memory of 552	3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe	95
PID 3208 wrote to memory of 552	3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe	95
PID 3208 wrote to memory of 552	3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe	95
PID 3208 wrote to memory of 552	3208	86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe	95

C:\Users\Admin\AppData\Local\Temp\86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe
"C:\Users\Admin\AppData\Local\Temp\86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe
  "C:\Users\Admin\AppData\Local\Temp\86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss4160.tmp\System.dll

Filesize
11KB

MD5
e23600029d1b09bdb1d422fb4e46f5a6

SHA1
5d64a2f6a257a98a689a3db9a087a0fd5f180096

SHA256
7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38

SHA512
c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac

Download Submit
C:\Users\Admin\Tubaistens.ini

Filesize
45B

MD5
1ed15cc277af7562eb72f4e48be3fe10

SHA1
57c78bd7ec913f83e871c110be655ad827832669

SHA256
f2a5a5e3109ab9577eb752819265b7f3552765356922bdd17f44a4781a104a1f

SHA512
39ca25427cc43851029ada4d1986e5d0de4670436e9f311ca145cea67c47461b2ed35137ae188a1af9d5d70a26c91f721d2f33daac8654c46f48777780f33b97

Download Submit
memory/552-26217-0x00000000017A0000-0x00000000047D5000-memory.dmp

Filesize
48.2MB

Download
memory/552-26219-0x0000000000540000-0x0000000001794000-memory.dmp

Filesize
18.3MB

Download
memory/552-26221-0x00000000017A0000-0x00000000047D5000-memory.dmp

Filesize
48.2MB

Download
memory/3208-26214-0x0000000014BD0000-0x0000000017C05000-memory.dmp

Filesize
48.2MB

Download
memory/3208-26215-0x0000000077D11000-0x0000000077E31000-memory.dmp

Filesize
1.1MB

Download
memory/3208-26216-0x0000000074B75000-0x0000000074B76000-memory.dmp

Filesize
4KB

Download
memory/3208-26218-0x0000000014BD0000-0x0000000017C05000-memory.dmp

Filesize
48.2MB

Download
memory/3208-26226-0x0000000014BD0000-0x0000000017C05000-memory.dmp

Filesize
48.2MB

Download