guloader | 74889c0dfbf5d5281bc934e561819a604554321586c47f26500f69f23f0f0d7e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG45466464242444674747884Immigreret27.exe
Size 909KB
Sample240814-k8xtcathmg
SHA256 74889c0dfbf5d5281bc934e561819a604554321586c47f26500f69f23f0f0d7e
MD5 77f63a3115d94f46f7f26db18403cad4
SHA1 3ad8a39bf1a7a48c521f044ea85973c40115320a
SHA512 6da1f28e8ab5ace8a627f0ce0bc19cb33c307329fe0bf8b0de75b82281d94fe41c523b0992726c3847a050b6263a63967d7bff6e954fd2b287610ce9645be5d9
SSDEEP 12288:4KQqt6ga1nGHXK24N3YrggC1Ou9Y6cZnt/DShQQc6uif/jMokH8uCb8cqLKljx:D891GHkgC1ZInYQQcp2QFKlN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader execution

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2944	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
2944	powershell.exe
2884	Reflektorerne.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2884	Reflektorerne.exe
2884	Reflektorerne.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2944	powershell.exe
2884	Reflektorerne.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 2884	2944	powershell.exe	34

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\ledning.god	IMG45466464242444674747884Immigreret27.exe
File opened for modification	C:\Program Files (x86)\Common Files\sygebesgene.out	IMG45466464242444674747884Immigreret27.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reflektorerne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMG45466464242444674747884Immigreret27.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000e00000001227f-18.dat	nsis_installer_1
behavioral1/files/0x000e00000001227f-18.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2884	Reflektorerne.exe
2884	Reflektorerne.exe
2884	Reflektorerne.exe
2884	Reflektorerne.exe
2884	Reflektorerne.exe
2884	Reflektorerne.exe
2884	Reflektorerne.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2944	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2944	2476	IMG45466464242444674747884Immigreret27.exe	30
PID 2476 wrote to memory of 2944	2476	IMG45466464242444674747884Immigreret27.exe	30
PID 2476 wrote to memory of 2944	2476	IMG45466464242444674747884Immigreret27.exe	30
PID 2476 wrote to memory of 2944	2476	IMG45466464242444674747884Immigreret27.exe	30
PID 2944 wrote to memory of 2884	2944	powershell.exe	34
PID 2944 wrote to memory of 2884	2944	powershell.exe	34
PID 2944 wrote to memory of 2884	2944	powershell.exe	34
PID 2944 wrote to memory of 2884	2944	powershell.exe	34
PID 2944 wrote to memory of 2884	2944	powershell.exe	34
PID 2944 wrote to memory of 2884	2944	powershell.exe	34

C:\Users\Admin\AppData\Local\Temp\IMG45466464242444674747884Immigreret27.exe
"C:\Users\Admin\AppData\Local\Temp\IMG45466464242444674747884Immigreret27.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$extrusion=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Louk\percha\Jenbrynsfarvens27.Bol';$Fejlfaktorers=$extrusion.SubString(53547,3);.$Fejlfaktorers($extrusion)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Reflektorerne.exe
    "C:\Users\Admin\AppData\Local\Temp\Reflektorerne.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Antidumpingregler.kik

Path C:\Users\Admin\AppData\Local\Temp\Louk\percha\Antidumpingregler.kik
Size 362KB
SHA256 5d58fb21bdbc9453a77208610ff40678d55c078b66f7cd743d1b7fc76ad8f61c
MD5 d9533ab613c6ccfea0f35d82794b0294
SHA1 2ec983b2f880bd93b0706f3e08aa960223041d10
SHA512 dd3a239376d00ff1e72a88bdccb06e379473fa32bfca925f42394696668b585267eed62247cf29dc6c697f5274fb46ad22fc27d557a7e104b07a4fc13a1be0e1
SSDEEP 6144:RJlthYRd1NUV3Wy2T2SDF/2DAkqKScJSCo7tnkFqmAf1Zv0yBkVN0snon:R9GfUV3Wy2/eBlsn4qd1ZnBQDon
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jenbrynsfarvens27.Bol

Path C:\Users\Admin\AppData\Local\Temp\Louk\percha\Jenbrynsfarvens27.Bol
Size 52KB
SHA256 39f9576ca46dc92e29d5305f1fd125b2e5f3a1cdca517652dd4d8ad5bc4e6066
MD5 fb85896593b6e558fd46df91f5a91b73
SHA1 5849b6f4196b9159c598369dfea59186d6f240f4
SHA512 3e4455c9f3b46781e754100536e22059f15bc758ddbc18db6b39ee9ed0da3be5be942d95bd1fd265859b8254d0e907d38ccfbc76c7bfb7ef4584fd8015288864
SSDEEP 1536:v++xy/8VdHg/cm6pZj1qNIp+o55ohwqRg:v3c/Sg/6p1p/nN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reflektorerne.exe

Path \Users\Admin\AppData\Local\Temp\Reflektorerne.exe
Size 909KB
SHA256 74889c0dfbf5d5281bc934e561819a604554321586c47f26500f69f23f0f0d7e
MD5 77f63a3115d94f46f7f26db18403cad4
SHA1 3ad8a39bf1a7a48c521f044ea85973c40115320a
SHA512 6da1f28e8ab5ace8a627f0ce0bc19cb33c307329fe0bf8b0de75b82281d94fe41c523b0992726c3847a050b6263a63967d7bff6e954fd2b287610ce9645be5d9
SSDEEP 12288:4KQqt6ga1nGHXK24N3YrggC1Ou9Y6cZnt/DShQQc6uif/jMokH8uCb8cqLKljx:D891GHkgC1ZInYQQcp2QFKlN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2884-50-0x0000000001470000-0x0000000004C6C000-memory.dmp

Download

memory/2884-37-0x0000000001470000-0x0000000004C6C000-memory.dmp

Download

memory/2884-23-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/2944-14-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Download

memory/2944-7-0x00000000736B1000-0x00000000736B2000-memory.dmp

Download

memory/2944-16-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Download

memory/2944-17-0x0000000006810000-0x000000000A00C000-memory.dmp

Download

memory/2944-9-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Download

memory/2944-22-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Download

memory/2944-11-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Download

memory/2944-10-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Download

memory/2944-8-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Download