guloader | 3f4628e53113b20e860fdeb1e36f1090443cd532612c69c03a723bc19b390761

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
document.exe
Size 947KB
Sample240809-k4v4yssfjh
SHA256 3f4628e53113b20e860fdeb1e36f1090443cd532612c69c03a723bc19b390761
MD5 f6780bbe12c4202d17f7f091b9309395
SHA1 6a98342623ce9117cf30534f7915689de9410864
SHA512 e7501654fbe9c83f3829d44df4e81fc18a189a60abf2979cb999a4f9c50319c2e0dad69cb84a6895a218a89a10a1bf84b7081fafe6689c6be45cd553ce681b8e
SSDEEP 24576:3cx22IhPR79MWCfO8lDZRZ9FuD6Bb6wdnj:3cxJORJZCW8l1R9wxwRj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader execution persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2068	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\grundlovsstridig = "%Sarcoid% -windowstyle minimized $Hyalobasalt=(Get-ItemProperty -Path 'HKCU:\\filigranarbejdernes\\').Justeringsforsg;%Sarcoid% -windowstyle minimized ($Hyalobasalt)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	drive.google.com
16	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2068	powershell.exe
1600	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 1600	2068	powershell.exe	89

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\symptomgivende\Divisibly69.ini	document.exe
File opened for modification	C:\Program Files (x86)\Common Files\konciperingens\skudriglernes.ini	document.exe
File opened for modification	C:\Program Files (x86)\telefoneringerne.ini	document.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\rieke.ans	document.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	document.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3960	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2068	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2068	1700	document.exe	86
PID 1700 wrote to memory of 2068	1700	document.exe	86
PID 1700 wrote to memory of 2068	1700	document.exe	86
PID 2068 wrote to memory of 1600	2068	powershell.exe	89
PID 2068 wrote to memory of 1600	2068	powershell.exe	89
PID 2068 wrote to memory of 1600	2068	powershell.exe	89
PID 2068 wrote to memory of 1600	2068	powershell.exe	89
PID 2068 wrote to memory of 1600	2068	powershell.exe	89
PID 1600 wrote to memory of 4668	1600	wab.exe	90
PID 1600 wrote to memory of 4668	1600	wab.exe	90
PID 1600 wrote to memory of 4668	1600	wab.exe	90
PID 4668 wrote to memory of 3960	4668	cmd.exe	92
PID 4668 wrote to memory of 3960	4668	cmd.exe	92
PID 4668 wrote to memory of 3960	4668	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\document.exe
"C:\Users\Admin\AppData\Local\Temp\document.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Arealmssigt=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Strde148\calumniators\certosa\Lurkers238\Feltnavnes\Arsonite.Som';$Backplane=$Arealmssigt.SubString(47165,3);.$Backplane($Arealmssigt)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "grundlovsstridig" /t REG_EXPAND_SZ /d "%Sarcoid% -windowstyle minimized $Hyalobasalt=(Get-ItemProperty -Path 'HKCU:\filigranarbejdernes\').Justeringsforsg;%Sarcoid% -windowstyle minimized ($Hyalobasalt)"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "grundlovsstridig" /t REG_EXPAND_SZ /d "%Sarcoid% -windowstyle minimized $Hyalobasalt=(Get-ItemProperty -Path 'HKCU:\filigranarbejdernes\').Justeringsforsg;%Sarcoid% -windowstyle minimized ($Hyalobasalt)"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Arsonite.Som

Path C:\Users\Admin\AppData\Local\Temp\Strde148\calumniators\certosa\Lurkers238\Feltnavnes\Arsonite.Som
Size 46KB
SHA256 012becac2fd422b77b583d8e2a04935849efa5a1b9bc0a0b944c0144b2407179
MD5 c1190112ffbcba72d0f414f39474dae2
SHA1 a45fe033c0086fe8135dece4c8bebde83595fa7f
SHA512 8654fccfc1fec0a2783d36a01a84d4a64dc1b2ef9e8722ada4a756c7ddb554aece5423ae007c53294ab55ab6db22c9d6642b8d341838102698046fa5547b86b3
SSDEEP 768:66V5CAqQDDk7fm6ii48F2uL/pbtToJhnzwLMVmWqzgEfflKQS7gAJjowVdv3gM:T5CmACC48Fv5VgzwgYWqUa+5Ldvz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Papmlk.Sir

Path C:\Users\Admin\AppData\Local\Temp\Strde148\calumniators\certosa\Lurkers238\Feltnavnes\Papmlk.Sir
Size 332KB
SHA256 00ac7a7288fdd339a1155750f48b8493cc57a5ed773e843d05a38ce7f6d6aba8
MD5 9334210b5b8307bf6c88f17ed59d5cbb
SHA1 b620ab0fe98140b40eeb357ab6ee127c270f9281
SHA512 511f7f448303178063e01403786db49e15288e81ac291f4c3312567e07e885d8a2d5e39f5a943b1ef46a00787eb153c4e0b069f8fe50fe4e823ab372143a3638
SSDEEP 6144:2VYdg6gQ6eXWyLzGib+ccdJM4Zzezh7XFSLfQ5UmLvwbbb:QYG6gLeXvb8vYIgUm7ubb
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_1ok3yc1t.fbo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ok3yc1t.fbo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1600-75-0x0000000002550000-0x0000000003B8A000-memory.dmp

Download

memory/1600-72-0x00000000012F0000-0x0000000002544000-memory.dmp

Download

memory/1600-57-0x0000000002550000-0x0000000003B8A000-memory.dmp

Download

memory/2068-47-0x00000000078E0000-0x0000000007E84000-memory.dmp

Download

memory/2068-49-0x0000000008510000-0x0000000008B8A000-memory.dmp

Download

memory/2068-30-0x0000000005A10000-0x0000000005A76000-memory.dmp

Download

memory/2068-41-0x0000000005B60000-0x0000000005EB4000-memory.dmp

Download

memory/2068-42-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/2068-43-0x0000000006140000-0x000000000618C000-memory.dmp

Download

memory/2068-44-0x0000000006680000-0x0000000006716000-memory.dmp

Download

memory/2068-46-0x0000000007300000-0x0000000007322000-memory.dmp

Download

memory/2068-24-0x0000000073C3E000-0x0000000073C3F000-memory.dmp

Download

memory/2068-29-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/2068-45-0x0000000006630000-0x000000000664A000-memory.dmp

Download

memory/2068-31-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Download

memory/2068-28-0x0000000073C30000-0x00000000743E0000-memory.dmp

Download

memory/2068-52-0x0000000073C30000-0x00000000743E0000-memory.dmp

Download

memory/2068-54-0x0000000073C30000-0x00000000743E0000-memory.dmp

Download

memory/2068-53-0x0000000008B90000-0x000000000A1CA000-memory.dmp

Download

memory/2068-55-0x0000000073C30000-0x00000000743E0000-memory.dmp

Download

memory/2068-56-0x0000000073C3E000-0x0000000073C3F000-memory.dmp

Download

memory/2068-26-0x0000000073C30000-0x00000000743E0000-memory.dmp

Download

memory/2068-71-0x0000000073C30000-0x00000000743E0000-memory.dmp

Download

memory/2068-27-0x00000000052B0000-0x00000000058D8000-memory.dmp

Download

memory/2068-73-0x0000000073C30000-0x00000000743E0000-memory.dmp

Download

memory/2068-25-0x0000000004B60000-0x0000000004B96000-memory.dmp

Download

memory/2068-80-0x0000000073C30000-0x00000000743E0000-memory.dmp

Download