guloader | a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order2883.exe
Size 772KB
Sample240826-gdfd2axgra
SHA256 a7ce140d12ae3b2180a2f170bd9cf812034046b5b4da2bc0725240445264a404
MD5 17eb8202cd25ebfb49eb1347ddbbe1d1
SHA1 cc59c2f0d3b4ad9cebdca36ede5182f6746cff87
SHA512 6338f1da11bc3e33a864aca2b349401cf190f5bca8a7b18a21ad1f3ab40f110ba9f32474a7e0d0a4813a5911b974c70d107d8f3acebcbf0759a21f32b486ebda
SSDEEP 12288:I1xZkxtCt777js4n4OdpvhVlp/+sH2WDAqQnm:I1xmCtLbBvpRH2WkqQm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
2308	Purchase Order2883.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2308	Purchase Order2883.exe
1932	Purchase Order2883.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 1932	2308	Purchase Order2883.exe	30

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\surmounts.ini	Purchase Order2883.exe
File opened for modification	C:\Windows\resources\flagstaves.ini	Purchase Order2883.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purchase Order2883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purchase Order2883.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2308	Purchase Order2883.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1932	2308	Purchase Order2883.exe	30
PID 2308 wrote to memory of 1932	2308	Purchase Order2883.exe	30
PID 2308 wrote to memory of 1932	2308	Purchase Order2883.exe	30
PID 2308 wrote to memory of 1932	2308	Purchase Order2883.exe	30
PID 2308 wrote to memory of 1932	2308	Purchase Order2883.exe	30
PID 2308 wrote to memory of 1932	2308	Purchase Order2883.exe	30

C:\Users\Admin\AppData\Local\Temp\Purchase Order2883.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order2883.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\Purchase Order2883.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order2883.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sanatoriernes.ini

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\sanatoriernes.ini
Size 32B
SHA256 ef0d70a6fada6f48c1a8c8cb26b9f1c0457283451c184acecb2f3fe3afd84d70
MD5 43e60c91e5b06ecaf84feebeb71c20d0
SHA1 1ad9ac635b43d4f798c4153ee7e650fc1d5cdf67
SHA512 357568b9dec128a3f39f900054401c72e28ffbb1e25d5b03b51a326b1b0bdea2a5d97111abc552bc56d40baa9f5e58929648c9ee7920fcc5114f906e328fb5d2
MD5 SHA1 SHA512

Submit Download

fordaervet.lnk

Path C:\Users\Admin\Music\fordaervet.lnk
Size 866B
SHA256 bf50f7d4cbc69b80ca796a7e27cb9cd52db4b17c4db93e75c6b3c20450f35264
MD5 1851cd174e11b844aa2c7fc9f466a0fe
SHA1 87268d88d677ad1c5e1d69f5ee2cd2475ba50030
SHA512 2c1844ce0ea59b27f3b3d7cc2aad0489c56de72ee010d11ccbcbd57414644046b7533afa6934a8878c3483516b14fbbc63f78d9318de7c9bbe4aab3af00d78c9
MD5 SHA1 SHA512

Submit Download

surmounts.ini

Path C:\Windows\Resources\surmounts.ini
Size 39B
SHA256 03d8a96ed613f8e88ceaaa246d9f7ddb3928aacd2603d2d0242506df6c460db1
MD5 45c38e788dcfe31f2fc5db90732bcbe0
SHA1 bb5c34609782471155b27aad7647c2f0d03c00d7
SHA512 dee940546bcf5fbca0894083480613b3bff4176ebef4bdb86c9423ff0ef438cbf3985991c098835ca2e2f54e3dcd3b1416db0ed74a964635c6272543e657426f
MD5 SHA1 SHA512

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nszA9C8.tmp\System.dll
Size 11KB
SHA256 90f3cebb5b3759eb1bd72cee7cd8b694440ee398fe970b763db7a7b67208e4c8
MD5 8508fa0ab17e36e071687243283c2aef
SHA1 d45391d0454fbb9eb66fa72ecf0e2cadf0522bfe
SHA512 241cf26e57006402897d8adaff37f3006c1bdbb09d6c5d10c32d556996df5785dc81c35ccbbc74384f80853a3e4aea7be251a4fa2613be42108e11a00692df5a
SSDEEP 192:S9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:SJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1932-1382-0x0000000077870000-0x0000000077A19000-memory.dmp

Download

memory/1932-1383-0x0000000000810000-0x0000000001872000-memory.dmp

Download

memory/2308-1378-0x00000000041B0000-0x0000000006E77000-memory.dmp

Download

memory/2308-1379-0x00000000041B0000-0x0000000006E77000-memory.dmp

Download

memory/2308-1381-0x0000000077870000-0x0000000077A19000-memory.dmp

Download

memory/2308-1380-0x0000000077871000-0x0000000077972000-memory.dmp

Download

memory/2308-1389-0x00000000041B0000-0x0000000006E77000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads