guloader | d6813757afcbe2ff75e3c7d249a7f198cd841db9438dd7dc85d7cf377276af00

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AMOS PO- 20085 20096 PR #11662526_PDF.exe
Size

36KB
MD5

8a2742a793634a68f07d58ae49f9d7b0
SHA1

e8ad9922b80847ecf6c8bd1e6dff4b9d4cf7bd0e
SHA256

da0971d1e481eb8d5e02d74f90c8705797a8d516f8439ad26e53484e9d3f3895
SHA512

4fec39ace3d00c65be3ded4852736851b9ecde927b09ad5d2a6d2ed4db829e55ab078864b4970962ad7f33ed4997879b29d79b15e5d32b9b915a33b46deec64a
SSDEEP

384:xHF/epx0BzZY2TTZt+XrhWFjaqtFy6rJmBfZ0giSmWDcbnYd7nlwv/VX5:xl/epx0dZY2TTy7Uu6rXgcWwbnSnKvt

Score

10^/10

guloader discovery downloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=1XLfZkhnbdY8eUmrfl4WTeHNxpgUqP4jN

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AMOS PO- 20085 20096 PR #11662526_PDF.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2508	AMOS PO- 20085 20096 PR #11662526_PDF.exe

C:\Users\Admin\AppData\Local\Temp\AMOS PO- 20085 20096 PR #11662526_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\AMOS PO- 20085 20096 PR #11662526_PDF.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-2-0x00000000003E0000-0x00000000003E8000-memory.dmp

Filesize
32KB

Download
memory/2508-3-0x0000000077001000-0x0000000077102000-memory.dmp

Filesize
1.0MB

Download
memory/2508-4-0x00000000003E0000-0x00000000003E8000-memory.dmp

Filesize
32KB

Download