guloader | adb7d7dc2e9f52d63b90bc7bd871a0c13c07ee8ce730d624f398b7acbc57054a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 17:40

Target

9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe
Size

60KB
MD5

9f046aa9e46726891c302fd2db9a3190
SHA1

b760b61ed7262d10664deb923944e6a4276df77d
SHA256

adb7d7dc2e9f52d63b90bc7bd871a0c13c07ee8ce730d624f398b7acbc57054a
SHA512

baf1a4a8b79a0289bb5cfee134e90ad7ee917b19be8be66ed333652442185ea8924969819b1b2be3dde166359d8a06ecaa6150fa4ac663853b28d62ee5a92d80
SSDEEP

384:A3K7pE7vPFJUOIg9J+ZE+IBU7c7G1Mrn1qYNMgbnJF7hXKHeBNgw9KsWjDlNpje/:Ii67PFJagDQVxYnLtF90Gfmnpj+

Score

10^/10

Family

guloader

http://wewewewewesesesesasbacwederffggffddsss.duckdns.org/jks/bbn.bin

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4724	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe
2988	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4724 set thread context of 2988	4724	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	81

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4724	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4724	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 2988	4724	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	81
PID 4724 wrote to memory of 2988	4724	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	81
PID 4724 wrote to memory of 2988	4724	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	81
PID 4724 wrote to memory of 2988	4724	9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9f046aa9e46726891c302fd2db9a3190_JaffaCakes118.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2988

memory/2988-3-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/2988-6-0x00000000779F1000-0x0000000077B11000-memory.dmp

Filesize
1.1MB

Download
memory/2988-5-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/4724-2-0x0000000002150000-0x000000000215A000-memory.dmp

Filesize
40KB

Download
memory/4724-4-0x00000000779F1000-0x0000000077B11000-memory.dmp

Filesize
1.1MB

Download