guloader | 9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124

General

Target

MalwareBazaar.exe
Size

484KB
MD5

4d5aa2285d7426050f478210bae7c5aa
SHA1

54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
SHA256

9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
SHA512

e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
SSDEEP

12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD

Score

10^/10

guloader downloader execution persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe

Loads dropped DLL 6 IoCs

pid	Process
2416	MalwareBazaar.exe
2416	MalwareBazaar.exe
2416	MalwareBazaar.exe
2416	MalwareBazaar.exe
2772	powershell.exe
2880	Fatherhoods.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Preoccupant = "%Stableres% -windowstyle minimized $Netbrum=(Get-ItemProperty -Path 'HKCU:\\Toponymist\\').Berufsverbots;%Stableres% ($Netbrum)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2880	Fatherhoods.exe
2880	Fatherhoods.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2772	powershell.exe
2880	Fatherhoods.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 2880	2772	powershell.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0035000000018bc8-42.dat	nsis_installer_1
behavioral1/files/0x0035000000018bc8-42.dat	nsis_installer_2

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
376	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2772	2416	MalwareBazaar.exe	30
PID 2416 wrote to memory of 2772	2416	MalwareBazaar.exe	30
PID 2416 wrote to memory of 2772	2416	MalwareBazaar.exe	30
PID 2416 wrote to memory of 2772	2416	MalwareBazaar.exe	30
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2880 wrote to memory of 2892	2880	Fatherhoods.exe	34
PID 2880 wrote to memory of 2892	2880	Fatherhoods.exe	34
PID 2880 wrote to memory of 2892	2880	Fatherhoods.exe	34
PID 2880 wrote to memory of 2892	2880	Fatherhoods.exe	34
PID 2892 wrote to memory of 376	2892	cmd.exe	36
PID 2892 wrote to memory of 376	2892	cmd.exe	36
PID 2892 wrote to memory of 376	2892	cmd.exe	36
PID 2892 wrote to memory of 376	2892	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Diffusibleness=Get-Content 'C:\Users\Admin\AppData\Local\kilns\Unobtainably\Gyldigheden146.Aga';$Bimana=$Diffusibleness.SubString(14599,3);.$Bimana($Diffusibleness)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Fatherhoods.exe
    "C:\Users\Admin\AppData\Local\Temp\Fatherhoods.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preoccupant" /t REG_EXPAND_SZ /d "%Stableres% -windowstyle minimized $Netbrum=(Get-ItemProperty -Path 'HKCU:\Toponymist\').Berufsverbots;%Stableres% ($Netbrum)"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preoccupant" /t REG_EXPAND_SZ /d "%Stableres% -windowstyle minimized $Netbrum=(Get-ItemProperty -Path 'HKCU:\Toponymist\').Berufsverbots;%Stableres% ($Netbrum)"
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\kilns\Unobtainably\Gyldigheden146.Aga

Filesize
69KB

MD5
d0a9e32e46f506f297ac08b6f2f12642

SHA1
eede417b23afdc7dd7f1b8c4a1368f2495c619a2

SHA256
6ff0b96b411fa1248bf9526086106e1a03ece0800f175a490f5cd3f83f9547d7

SHA512
2bb7f65278ee1bb772e44294ccf7a388d0312487bc481d7c0af8d6eefcaa6ecef7855e9e0dd282fad12bcdd8a68059ed3c68c3790f4220fe11019087f052178a

Download Submit
C:\Users\Admin\AppData\Local\kilns\Unobtainably\Simens.Ice

Filesize
317KB

MD5
c447a6853c4e90506068dd8a8e422539

SHA1
57cfb00c477b4ce55dcabadbb62fcec48e77adcb

SHA256
3ddb99ea9e3285c07274baf2a33465a30c39b315c584d06b0e6319ca4b232247

SHA512
ba6ce148a2007b57c01e99b62b9f3d7a5737f7295425993c53db096d5300c887f9347007163664a06c185031b464b4a1184928aebeef3a907f402d575c077e4a

Download Submit
\Users\Admin\AppData\Local\Temp\Fatherhoods.exe

Filesize
484KB

MD5
4d5aa2285d7426050f478210bae7c5aa

SHA1
54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96

SHA256
9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124

SHA512
e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF7C8.tmp\BgImage.dll

Filesize
7KB

MD5
521df745a41f0b8164ffd01717cacbba

SHA1
dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74

SHA256
dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b

SHA512
c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF7C8.tmp\UserInfo.dll

Filesize
4KB

MD5
acbda33dd5700c122e2fe48e3d4351fd

SHA1
2c154baf7c64052ee712b7cdf9c36b7697dd3fc8

SHA256
943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0

SHA512
d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF7C8.tmp\nsDialogs.dll

Filesize
9KB

MD5
1c8b2b40c642e8b5a5b3ff102796fb37

SHA1
3245f55afac50f775eb53fd6d14abb7fe523393d

SHA256
8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

SHA512
4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

Download Submit
memory/2772-33-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-34-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-31-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-37-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-32-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-39-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-40-0x0000000006600000-0x000000000ACE1000-memory.dmp

Filesize
70.9MB

Download
memory/2772-41-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-30-0x00000000737E1000-0x00000000737E2000-memory.dmp

Filesize
4KB

Download
memory/2880-67-0x0000000000460000-0x00000000014C2000-memory.dmp

Filesize
16.4MB

Download
memory/2880-68-0x00000000014D0000-0x0000000005BB1000-memory.dmp

Filesize
70.9MB

Download
memory/2880-70-0x0000000000460000-0x00000000014C2000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads