guloader | b16348cc5b9dd8003e8c82929521ea3a8b6296945b5548e5d67fd40bc61067b8

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b16348cc5b9dd8003e8c82929521ea3a8b6296945b5548e5d67fd40bc61067b8.vbs
Size 843KB
Sample240823-c1fabstbpk
SHA256 b16348cc5b9dd8003e8c82929521ea3a8b6296945b5548e5d67fd40bc61067b8
MD5 24681ff0ad8394288b34ce877dde3795
SHA1 919fb96d8532096e5e5014cd0ef205484534428d
SHA512 64d05c3ec28f88e44f35c0be7b34a1404aa79f796679a621a10f3e431cc3fa4148fd7823ac55e2a4cb95d0c4b4afd84b89827c64637f8d8fd9a40c7b67063ac9
SSDEEP 12288:g3Oa1H+EF0NPKD7L2JDqIrFriYnsVeLA2S2862993BIazUMsXJEzG2ki0dA:Lu7L2Jx5sU8D286sxvsS63i0dA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4580	x.exe

Loads dropped DLL 2 IoCs

pid	Process
4580	x.exe
1720	x.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4580	x.exe
1720	x.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4580 set thread context of 1720	4580	x.exe	95

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Badon.cop	x.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PIF	x.exe
File opened for modification	C:\Windows\resources\0409\motortrafikvej.ini	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000c000000023450-4.dat	nsis_installer_1
behavioral2/files/0x000c000000023450-4.dat	nsis_installer_2

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4580	x.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4580	2960	WScript.exe	84
PID 2960 wrote to memory of 4580	2960	WScript.exe	84
PID 2960 wrote to memory of 4580	2960	WScript.exe	84
PID 4580 wrote to memory of 1720	4580	x.exe	95
PID 4580 wrote to memory of 1720	4580	x.exe	95
PID 4580 wrote to memory of 1720	4580	x.exe	95
PID 4580 wrote to memory of 1720	4580	x.exe	95
PID 4580 wrote to memory of 1720	4580	x.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b16348cc5b9dd8003e8c82929521ea3a8b6296945b5548e5d67fd40bc61067b8.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA172.tmp\System.dll
Size 11KB
SHA256 b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2
MD5 6ad39193ed20078aa1b23c33a1e48859
SHA1 95e70e4f47aa1689cc08afbdaef3ec323b5342fa
SHA512 78c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b
SSDEEP 96:qIsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9Fug:ZVL7ikJb76BQUoUm+RnyXVYO2RvHFug
MD5 SHA1 SHA512 SSDEEP

Submit Download

unsensate.pif

Path C:\Users\Admin\AppData\Local\Temp\nsqA172.tmp\unsensate.pif
Size 2KB
SHA256 00cedb58412e75fef8e6b1b48404c1d35c79ece59d376d2f9433902ff96bdb92
MD5 06969cab66a888c76b0a275642685154
SHA1 18729da10ce4c16b358fd17a5cb0135baedca4ef
SHA512 37876a0ea46f364051a3cd1e0008bdfa26572b24c0bdab8466ea54c55085e7c0de9e084b8fa0ebcc300122a3f85aab85e25ad51f34baa0bb05759cc17ef448bd
MD5 SHA1 SHA512

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 573KB
SHA256 ae39bd82c43e6c35a4abe380de953b2eab8558cb6cb7ec75ff11dba7afcc7479
MD5 81e3fde6055dab5a1a446c1302dbfabb
SHA1 88a5bc03017c5ecebd84e7d21aa9803bd4da6407
SHA512 0e4f7a2adea3dd168744353d6e7bb7a13e2bae51fa86b789f68adce23384fa691d7037293b16fa20aca955460221d83009535288ba20233122f5416a3cc984d3
SSDEEP 12288:ME7Q/ArJEoy/3peInrPqC+mO2EaLo1F+TUpWvBvrxQR:YiJEoSPrSC+xLhF7pW1xQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

unsensate.pif

Path C:\unsensate.pif
Size 2KB
SHA256 32a682df90f95d1dc4cbb6cae27019de4071d9fdb00f01fa2ba1eac3a501141d
MD5 8085c506ba00b9d94d59cad6e7c6271f
SHA1 7607f1034d2184ec7730eccdb5b31fd0ee47b015
SHA512 dce063f24623cf5226051fa9ddb0bae20f9a9233a10bba2286de378820e42f8d214919531e9ed2810d6e6c6691eee56c52b7e617944df81713fbd39dcca55056
MD5 SHA1 SHA512

Submit Download

unsensate.pif

Path C:\unsensate.pif
Size 2KB
SHA256 8fe7cb714089e53e6a9a1a5c69a497b55fdf5be2431dcead3ad7d833ba19bcc6
MD5 baf28eb05c2908a9f1cd38466d94c8a7
SHA1 41a77a1b5eec2fa392d136340b20d134a2568b35
SHA512 cfc561fef7232af268a02fd8a57f27da9cbd7b1587b6fbc95ed9ec7eaa31020129975e5566d9f8f8afdf1b62ce2beeffcd6c7787b9c1935ff9f9cfe295189680
MD5 SHA1 SHA512

Submit Download

memory/1720-572-0x00000000016C0000-0x00000000030F9000-memory.dmp

Download

memory/1720-579-0x0000000000460000-0x00000000016B4000-memory.dmp

Download

memory/1720-580-0x00000000016C0000-0x00000000030F9000-memory.dmp

Download

memory/4580-568-0x0000000077981000-0x0000000077AA1000-memory.dmp

Download

memory/4580-569-0x00000000036F0000-0x0000000005129000-memory.dmp

Download

memory/4580-570-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/4580-567-0x00000000036F0000-0x0000000005129000-memory.dmp

Download

memory/4580-586-0x00000000036F0000-0x0000000005129000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads