guloader | adb7d7dc2e9f52d63b90bc7bd871a0c13c07ee8ce730d624f398b7acbc57054a

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 17:40

Target

9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe
Size

60KB
MD5

9f046aa9e46726891c302fd2db9a3190
SHA1

b760b61ed7262d10664deb923944e6a4276df77d
SHA256

adb7d7dc2e9f52d63b90bc7bd871a0c13c07ee8ce730d624f398b7acbc57054a
SHA512

baf1a4a8b79a0289bb5cfee134e90ad7ee917b19be8be66ed333652442185ea8924969819b1b2be3dde166359d8a06ecaa6150fa4ac663853b28d62ee5a92d80
SSDEEP

384:A3K7pE7vPFJUOIg9J+ZE+IBU7c7G1Mrn1qYNMgbnJF7hXKHeBNgw9KsWjDlNpje/:Ii67PFJagDQVxYnLtF90Gfmnpj+

Score

10^/10

Family

guloader

http://wewewewewesesesesasbacwederffggffddsss.duckdns.org/jks/bbn.bin

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe
1628	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1628	2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1628	2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	28
PID 2012 wrote to memory of 1628	2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	28
PID 2012 wrote to memory of 1628	2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	28
PID 2012 wrote to memory of 1628	2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	28
PID 2012 wrote to memory of 1628	2012	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1628

memory/1628-6-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/1628-7-0x0000000077190000-0x0000000077339000-memory.dmp

Filesize
1.7MB

Download
memory/1628-8-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2012-2-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2012-3-0x0000000077191000-0x0000000077292000-memory.dmp

Filesize
1.0MB

Download
memory/2012-5-0x0000000077190000-0x0000000077339000-memory.dmp

Filesize
1.7MB

Download
memory/2012-4-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/2012-10-0x0000000077190000-0x0000000077339000-memory.dmp

Filesize
1.7MB

Download