guloader | c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe
Size 773KB
Sample240610-d7ta7scc48
SHA256 c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280
MD5 b70a38a0517d82332d49008ed8544280
SHA1 5d2405742b69a74d1534746919f9125204234114
SHA512 1267737b027b3b9a77945a111352591f8c231035fe7a093f06b2e296784096775cfcfd819dbe437cd38c60babd154900707971a5626b84e083ebe044f6478542
SSDEEP 12288:/KdQYPhiCUSyZsnY40EfLB5uarQWBLqBmxsTEUL9i6aoEO7nLOilOtE:/JYHUS9F0ETB5uD4LqBmxC/Lw6L7Ki/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	drive.google.com
21	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ranglesten\atriumgaardes.pla	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3720	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe
3720	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3164 set thread context of 3720	3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe	88

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\senegas.sed	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\bearlet.tor	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe
File opened for modification	C:\Windows\andenklasseskupeens\jordfyld.ini	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3896	3720	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3720	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe
3720	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 3720	3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe	88
PID 3164 wrote to memory of 3720	3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe	88
PID 3164 wrote to memory of 3720	3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe	88
PID 3164 wrote to memory of 3720	3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe	88
PID 3164 wrote to memory of 3720	3164	c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe	88

C:\Users\Admin\AppData\Local\Temp\c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe
"C:\Users\Admin\AppData\Local\Temp\c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe
  "C:\Users\Admin\AppData\Local\Temp\c1ac9d7f43c663808c60ff26c2e41f32f5d101a8ef0f76d68cef613b19fab280.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1412
    3⤵
    - Program crash
    PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3720 -ip 3720
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss59DB.tmp\System.dll
Size 11KB
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3164-13-0x0000000005260000-0x00000000071FA000-memory.dmp

Download

memory/3164-14-0x0000000077531000-0x0000000077651000-memory.dmp

Download

memory/3164-15-0x0000000074184000-0x0000000074185000-memory.dmp

Download

memory/3164-18-0x0000000005260000-0x00000000071FA000-memory.dmp

Download

memory/3164-32-0x0000000005260000-0x00000000071FA000-memory.dmp

Download

memory/3720-16-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/3720-17-0x0000000001660000-0x00000000035FA000-memory.dmp

Download

memory/3720-31-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/3720-33-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/3720-34-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/3720-35-0x0000000001660000-0x00000000035FA000-memory.dmp

Download