guloader | 467b4ebe09d4cfd3d6262d0ba0eaae1af96fb3a1ffb16962f1757d96cdd816ac

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ACINACEOUS.exe
Size

124KB
MD5

246d2cc9a5452ba99a079d06d11011b5
SHA1

f2a1e04e91de8e10eb62dde7cc6d932b3a3cf294
SHA256

c3986fbb4678bbdd6b8cd2b850bdeff03ebf9cbe4226c5107bd059459510ced7
SHA512

b4dd6893c090c347f03160158292ca54c6d35a72a6e81d527b77c69b56e4d44f17de754bac816860b617db9bb443db088aaa01ec34b5e51e0a4423fef6b9dcdb
SSDEEP

1536:1pGPwzxA4k4gpX2F7rg/afm5yw2euHXjr+JnxjyCQq8nvls:1g4EU7r6afm5ywkO65e

Score

10^/10

guloader discovery downloader guloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=12gFK6qzFV_ZNQm5z-4O5m7KVXdF87z79

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

resource	yara_rule
behavioral1/memory/2412-2-0x0000000000310000-0x000000000031B000-memory.dmp	family_guloader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ACINACEOUS.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	ACINACEOUS.exe

C:\Users\Admin\AppData\Local\Temp\ACINACEOUS.exe
"C:\Users\Admin\AppData\Local\Temp\ACINACEOUS.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-3-0x0000000077651000-0x0000000077752000-memory.dmp

Filesize
1.0MB

Download
memory/2412-2-0x0000000000310000-0x000000000031B000-memory.dmp

Filesize
44KB

Download