guloader | ca6ef379c8e7a90ae41237380f85229a04c97fa3814f93aba5ac6649cbb88eb7

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
20/08/2024, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
blobrunner.exe
Size 118KB
Sample240820-fdextstfnh
SHA256 25ce2132ea5ead4115ec4ccdd3fb2835c7cde1d93883f35de5e75cf2bf56970e
MD5 a9bc355e27c126e99b8482a0847668e3
SHA1 4b1ab851488aa47343c1557fd168769499ad98bf
SHA512 8b045395682054a6c0aa281d2171f87d684e1ef6b6fbb4ceda891f2e55679835c21698d59ece54f83ce9398d030d960a7274c82447daec060a5ce1956f997fad
SSDEEP 3072:G+yj25BFCOxoGQEYvUbKS4Lo5/HR+jJ9IjTyBE6B3Yrd7WLvDez:pdP3xo6Y2KSDRFTyCmjqz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1528	4240	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blobrunner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1420	4240	blobrunner.exe	81
PID 4240 wrote to memory of 1420	4240	blobrunner.exe	81
PID 4240 wrote to memory of 1420	4240	blobrunner.exe	81

C:\Users\Admin\AppData\Local\Temp\blobrunner.exe
C:\Users\Admin\AppData\Local\Temp\blobrunner.exe MEM_127F19D0_0005ABD8_xor_with_53b46f72_GuLoader.mem
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 260
  2⤵
  - Program crash
  PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4240 -ip 4240
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4240-0-0x0000000000900000-0x000000000095B000-memory.dmp

Download