guloader | 79eed46c88756872f16e9b00e5dd0e66e4af80d1c5476ca5f5377162d1aa396f

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ-SMC-PO-5547-SUPPLY.com.exe
Size 496KB
Sample240809-k4vs7ayepm
SHA256 79eed46c88756872f16e9b00e5dd0e66e4af80d1c5476ca5f5377162d1aa396f
MD5 367bc3012f9176825cf6ce3ca32ebb51
SHA1 dcd2f8acf4186d2616744953a3e4b1ff0038b438
SHA512 9ecef44fb7c48a01fb747167ffe912d1b8b8e2994213ffd36934da1b4993667c34eb3e6f2417fda04eaa122f668c60f451dd194946959848de224777d5c70f32
SSDEEP 12288:XHadbvMUT139nFU6XL1Xd190v7mnrlZfgOp53Xd8Q:3adLMUhBFPxXOvoj3X6Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4832	RFQ-SMC-PO-5547-SUPPLY.com.exe
4832	RFQ-SMC-PO-5547-SUPPLY.com.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4832	RFQ-SMC-PO-5547-SUPPLY.com.exe
1608	RFQ-SMC-PO-5547-SUPPLY.com.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 1608	4832	RFQ-SMC-PO-5547-SUPPLY.com.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ-SMC-PO-5547-SUPPLY.com.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ-SMC-PO-5547-SUPPLY.com.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4832	RFQ-SMC-PO-5547-SUPPLY.com.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 1608	4832	RFQ-SMC-PO-5547-SUPPLY.com.exe	88
PID 4832 wrote to memory of 1608	4832	RFQ-SMC-PO-5547-SUPPLY.com.exe	88
PID 4832 wrote to memory of 1608	4832	RFQ-SMC-PO-5547-SUPPLY.com.exe	88
PID 4832 wrote to memory of 1608	4832	RFQ-SMC-PO-5547-SUPPLY.com.exe	88
PID 4832 wrote to memory of 1608	4832	RFQ-SMC-PO-5547-SUPPLY.com.exe	88

C:\Users\Admin\AppData\Local\Temp\RFQ-SMC-PO-5547-SUPPLY.com.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-SMC-PO-5547-SUPPLY.com.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\RFQ-SMC-PO-5547-SUPPLY.com.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ-SMC-PO-5547-SUPPLY.com.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nscBF5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscBF5A.tmp
Size 28B
SHA256 bb92b5197bb4677950b78f816a8170797d0392af55e31d0f0744fe9c99f7e9b8
MD5 2490402a1d7d19949dd2a237b95af06f
SHA1 9a960e98c750e3fc7e44cdd6e1af20e690d893b1
SHA512 f3d299910eee8e8ace51ae3e7d79d12f7f68bfbcdaa0d7b8b66d505c4bdba7d95a97aeefc9f22868989115a99f81e0e3e9480e0d3e9af5fa27d2d9b0e961b52e
MD5 SHA1 SHA512

Submit Download

nscBF5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscBF5A.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
MD5 SHA1 SHA512

Submit Download

nscBF5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscBF5A.tmp
Size 33B
SHA256 0ca259e86b73dc8d2f375e3860b6bf91b78b3680b5b90c262fdd82432492a77a
MD5 5555876f2521b3ae2424dd9d6ce983aa
SHA1 5dd9296584980764dc0bebb55e721e6f9aacc86b
SHA512 71992459867bdb629a697d2f1e750390983fd752fe46f3c753eb0671d8e7498850320145b5662c714229cfcad6f0a2fbffac4c5a6ff40c87a90701bfa69763dd
MD5 SHA1 SHA512

Submit Download

nscBF5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscBF5A.tmp
Size 47B
SHA256 4d9933ad3cb07723bac43a5c519fb12e5950334cf688b284acdfa4d8931d5620
MD5 3463a4cc4cc8584279b312ee3ae746dc
SHA1 512bb30dc772b97916374c4ba7ac0263dab1ffa5
SHA512 239e174c3cea06f716dfc802fd32bddfa78d51f07d91f1cfc28ab0bf125d22bd18c6f05af672b0b8edbb6a618f4e6492fe1b41150c34cc3196070961c34c010c
MD5 SHA1 SHA512

Submit Download

nscBF5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscBF5A.tmp
Size 68B
SHA256 860e81e337b378b1d03c4f9205ef876d901e44758d7068a43f7d80eaec9c59aa
MD5 acc8e2dc8ef177e828af296be96c6a4e
SHA1 7cc55fd8ac9beeedff4b42acbe7a99d0559f178c
SHA512 ba120dda31785f9ff6d9c4ba55eee99c8c0fffa7cc84afac054387da49dd5085e454996a4acd9018cfb4eea887e7610b6265533b9be8bbb2c5063ed071bb9e33
MD5 SHA1 SHA512

Submit Download

nscBF5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscBF5A.tmp
Size 63B
SHA256 325f317c63480734ea71c33422a2416e25a678cc45e33edd33e939ac6f5e2fd6
MD5 6a82ea02494893b849d7b981609561e4
SHA1 c4ab8d0a95600197c0517fb0c30e4d67683efb4a
SHA512 86f06d769bd277e2f75c0843df79a17f878c7c4c9f5412b68ade304b7bcdc35abf6714be2aa6166230d358d007799be703ed2e673df153aa96602799009674fe
MD5 SHA1 SHA512

Submit Download

nsiC01B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiC01B.tmp
Size 30B
SHA256 c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
MD5 f15bfdebb2df02d02c8491bde1b4e9bd
SHA1 93bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA512 1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
MD5 SHA1 SHA512

Submit Download

nsnBF9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnBF9B.tmp
Size 49B
SHA256 bbd283b5a658ac95e8811c820de41f911e7559e982d9378b5b14c3f7cb5ccb6d
MD5 1aeb67240bc704bf6cc2fa0a6f52a970
SHA1 0d5cbc71d7e606e7f1a68332be8a7a5a7b4be02d
SHA512 c64bdb3c49ff5ca422fe5a4a03fac5145072f7cf692addc23e811ce39c25fc7fcb8e15a07fd770eb8d392d86cfc12c3520b080899a4d2c85646c09b181f2b47c
MD5 SHA1 SHA512

Submit Download

nsnBF9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnBF9B.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
MD5 SHA1 SHA512

Submit Download

nssBFBB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nssBFBB.tmp
Size 60B
SHA256 7ab02220c1cc2a726e851d579d293e95ca5db36da8fd8a2d5c5441d188d5b3e2
MD5 ce6207f2c1e03307e8b5e954a5e1f93e
SHA1 79d548e92bb1706e3f2494c71725d09775d538a6
SHA512 0dc43d0f4e473eb3f3fa9e611a1eb7c48a66db55021ee9372b05130affe6d606178f3c31f34d0118081cc335e4f38793406165ef7e86fbd3d271517fa7ae21d6
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxBF8A.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsxBFDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsxBFDB.tmp
Size 56B
SHA256 3c109fc9343c44e7935a81d2d067803c18120e2b9f399f9d06c5beb20702fe6e
MD5 14172aade968c23c68af23a7cc2162d6
SHA1 bd8029846a9e2e8c505f1cdda50356a3981cff11
SHA512 8c76e1a710b93eff476a30344be1e5d8d2a3b1a64383292e12eeb8559e175feda7f80708d3ed55fd8c4269c2321f0d72f37c4cb7cdf12b255ea9102fdb5b31bf
MD5 SHA1 SHA512

Submit Download

nsxBFDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsxBFDB.tmp
Size 20B
SHA256 d30356374aa30cfbc7c370471ebd3eb85f2024b777d159118b830c6e249003b8
MD5 c107db39d0997077c3355387b58642da
SHA1 ccb33ed432ab7bf44d4613c12593739e1ae32aa9
SHA512 856bc5968be310569a4e657c240311bff57c2ca1489f0b391b192ac111ecf377ea0e300b8abb270de4fcfbc4f374b98f850c7538f3ee3ddc166279116e1e5241
MD5 SHA1 SHA512

Submit Download

memory/1608-574-0x0000000000470000-0x00000000016C4000-memory.dmp

Download

memory/1608-570-0x00000000016D0000-0x000000000231B000-memory.dmp

Download

memory/1608-571-0x0000000077228000-0x0000000077229000-memory.dmp

Download

memory/1608-572-0x0000000077245000-0x0000000077246000-memory.dmp

Download

memory/1608-575-0x00000000016D0000-0x000000000231B000-memory.dmp

Download

memory/1608-577-0x00000000771A1000-0x00000000772C1000-memory.dmp

Download

memory/4832-568-0x00000000771A1000-0x00000000772C1000-memory.dmp

Download

memory/4832-569-0x0000000074005000-0x0000000074006000-memory.dmp

Download

memory/4832-573-0x0000000004A10000-0x000000000565B000-memory.dmp

Download

memory/4832-567-0x0000000004A10000-0x000000000565B000-memory.dmp

Download

memory/4832-582-0x0000000004A10000-0x000000000565B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads