guloader | 5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

General

Target

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
Size

318KB
MD5

46e978f5dee2d39687269d77e44df3cf
SHA1

f15c27a41a2e7e78b07df29c687da3e70e813e66
SHA256

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d
SHA512

81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19
SSDEEP

6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 4 IoCs

pid	Process
1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
3900	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 3900	1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	99

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 3900	1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	99
PID 1124 wrote to memory of 3900	1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	99
PID 1124 wrote to memory of 3900	1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	99
PID 1124 wrote to memory of 3900	1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	99
PID 1124 wrote to memory of 3900	1124	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	99

C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
"C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
  "C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsv494E.tmp\System.dll

Filesize
11KB

MD5
4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

SHA1
7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

SHA256
d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

SHA512
cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv494E.tmp\UserInfo.dll

Filesize
4KB

MD5
035bdb470a6807313bd005bd98341ffc

SHA1
5017d1e5a23f1c64594f737e6fccd519729c3b3e

SHA256
26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

SHA512
f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv494E.tmp\nsDialogs.dll

Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit
C:\Users\Public\Desktop\polres.lnk

Filesize
1KB

MD5
326b4c3b30cc04d7b135cb9d490a5315

SHA1
6c105e5cd66d17b94fd51ca122ae091f3526f4a1

SHA256
3a98c777a8fc51cb3d01562342650c099cd2d92bfd5f6d4e03380445e7c6af9c

SHA512
87095b56a626f907029e274a9e1477e3ac5ee7c540dcba50c77802b4f8a09bf4d795c58d251713a5def7adffe6ad739ba7cd0aa3f678081aa7156c2f1bbed20d

Download Submit
memory/1124-376-0x0000000005D90000-0x0000000008A0F000-memory.dmp

Filesize
44.5MB

Download
memory/1124-377-0x0000000077051000-0x0000000077171000-memory.dmp

Filesize
1.1MB

Download
memory/1124-378-0x0000000073EB4000-0x0000000073EB5000-memory.dmp

Filesize
4KB

Download
memory/1124-381-0x0000000005D90000-0x0000000008A0F000-memory.dmp

Filesize
44.5MB

Download
memory/1124-388-0x0000000005D90000-0x0000000008A0F000-memory.dmp

Filesize
44.5MB

Download
memory/3900-379-0x00000000016D0000-0x000000000434F000-memory.dmp

Filesize
44.5MB

Download
memory/3900-380-0x0000000000470000-0x00000000016C4000-memory.dmp

Filesize
18.3MB

Download
memory/3900-383-0x00000000016D0000-0x000000000434F000-memory.dmp

Filesize
44.5MB

Download

Analysis

Sharing