guloader | 5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

General

Target

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
Size

318KB
MD5

46e978f5dee2d39687269d77e44df3cf
SHA1

f15c27a41a2e7e78b07df29c687da3e70e813e66
SHA256

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d
SHA512

81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19
SSDEEP

6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 4 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

pid	process
232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

pid	process
232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
884	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

description	pid	process	target process
PID 232 set thread context of 884	232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Drops file in Windows directory 2 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

pid process

232 5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

description	pid	process	target process
PID 232 wrote to memory of 884	232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
PID 232 wrote to memory of 884	232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
PID 232 wrote to memory of 884	232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
PID 232 wrote to memory of 884	232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
PID 232 wrote to memory of 884	232	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
"C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:232

C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
"C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsa544B.tmp\System.dll

Filesize
11KB

MD5
4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

SHA1
7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

SHA256
d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

SHA512
cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa544B.tmp\UserInfo.dll

Filesize
4KB

MD5
035bdb470a6807313bd005bd98341ffc

SHA1
5017d1e5a23f1c64594f737e6fccd519729c3b3e

SHA256
26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

SHA512
f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa544B.tmp\nsDialogs.dll

Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit
C:\Users\Public\Desktop\polres.lnk

Filesize
1KB

MD5
7e97e1b88d63881124fa402592fab593

SHA1
193b1d2b4759adacc79ca0dcc4824d257067b2b1

SHA256
110cfc8a227a460c9815b5b5b9993210d5853100e81682abdf9c47df096d2c7c

SHA512
5cf55c5402333178851051cc4c01f1fcf88fb9b6f692d7039777680bac79f5acc0cee5c53a5431621c10a010354e404f6fa24a632c5165c89be9396bd5b8bb38

Download Submit
memory/232-376-0x0000000005ED0000-0x0000000008B4F000-memory.dmp

Filesize
44.5MB

Download
memory/232-377-0x0000000077581000-0x00000000776A1000-memory.dmp

Filesize
1.1MB

Download
memory/232-378-0x00000000743E4000-0x00000000743E5000-memory.dmp

Filesize
4KB

Download
memory/232-380-0x0000000005ED0000-0x0000000008B4F000-memory.dmp

Filesize
44.5MB

Download
memory/232-388-0x0000000005ED0000-0x0000000008B4F000-memory.dmp

Filesize
44.5MB

Download
memory/884-379-0x00000000016D0000-0x000000000434F000-memory.dmp

Filesize
44.5MB

Download
memory/884-381-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/884-383-0x00000000016D0000-0x000000000434F000-memory.dmp

Filesize
44.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads