guloader | 14dc8337d3f3440122fac2808c6706ede3b1d1f83fb5a6aa991e10699e341ba9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Request for Quotation - sample catalog.vbs
Size 727KB
Sample240826-rp86laybne
SHA256 bdec6c1910f93889fcffbc992301deaca66a028734bacdf642b374339b6e0bd6
MD5 3403a2eda1b395b0b52459dd0797c94f
SHA1 7474c9377f59e0664b011fe9847887a10bec0225
SHA512 5e082393eeb31761825fc855dd3e67b6e79f49d0606d5a5b28678e673c1dcd2daae42b5887f649935c923883917f98611b58ff50ebc71e8bb9fc33dcad8178ad
SSDEEP 12288:k/+WfeHxut4cCoIfJR0IOBMGYZ36XROIE1zAPZ1yiK3TD7D4GPA5GU:nMBbXVxYUhOvaunH457
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
316	x.exe

Loads dropped DLL 2 IoCs

pid	Process
316	x.exe
4276	x.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4276	x.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
316	x.exe
4276	x.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 316 set thread context of 4276	316	x.exe	95

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\udsprge.ini	x.exe
File created	C:\Program Files (x86)\Aareladningen9.lnk	x.exe
File opened for modification	C:\Program Files (x86)\Aareladningen9.lnk	x.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\annoncerede.del	x.exe
File opened for modification	C:\Windows\resources\0409\satori.ops	x.exe
File opened for modification	C:\Windows\biopsychical.tub	x.exe
File opened for modification	C:\Windows\Fonts\Nednormeres84\vrouw.ini	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe
4276	x.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
316	x.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 316	1328	WScript.exe	83
PID 1328 wrote to memory of 316	1328	WScript.exe	83
PID 1328 wrote to memory of 316	1328	WScript.exe	83
PID 316 wrote to memory of 4276	316	x.exe	95
PID 316 wrote to memory of 4276	316	x.exe	95
PID 316 wrote to memory of 4276	316	x.exe	95
PID 316 wrote to memory of 4276	316	x.exe	95
PID 316 wrote to memory of 4276	316	x.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for Quotation - sample catalog.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aareladningen9.lnk

Path C:\Program Files (x86)\Aareladningen9.lnk
Size 822B
SHA256 33e5610d1ccbb055f47bd748ede9070e0f5ed6043ca5c0ffc3de84b75182d8f3
MD5 03ce84bc64c20302d628f09c7f7e42d7
SHA1 464b7c9d3a7180f207ebecfbf8046558b565ce1d
SHA512 54ff1c37bdd8b18cec612ed5865c8897bfffab99f932a16bb42a69553b0d3ce2ce9b747f47b0a501f2ea659ad73a5290408912a31a835de6772fe7a563be4ff5
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh9963.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 495KB
SHA256 308e433c6caa8d81a92591f50f1867c85b2c71afd4bf23afc287f5f40ba27210
MD5 8bccd402648151d17f890e37d3b2d553
SHA1 0b06dfc0d133f0306e3cfaa46da5c30323bf100b
SHA512 deb907819b506e3c68b0254a0c56e0fda40b6e1ff5cc7d03fd7c858d2424e14472b40cf8dbad4d814d8135d424cddd6b9e721bd16ed371f70d150a99fe318e67
SSDEEP 12288:DY2/eVVRSGpwOhZ1ZQ0hhFhiQ8HgHkrTt:DY2/8SGFbhjhKrTt
MD5 SHA1 SHA512 SSDEEP

Submit Download

constantinian.ini

Path C:\Users\Admin\Music\constantinian.ini
Size 32B
SHA256 463b9ed24cfc842af86f043ab6a13005b36a15b7e1ff4ed493c02c25499463b6
MD5 1edd842653739b3e4e739819666d770d
SHA1 a522290cc79af78ebc16dce41ffdae939a553766
SHA512 889a339ac677ef4149e3a284a0922ec63e28019657be0a80b5042551f0bf9f6c05adae39f94fb95a779c951f5db7315b1b2325245221aec06f8175e02f28a054
MD5 SHA1 SHA512

Submit Download

memory/316-305-0x0000000077C71000-0x0000000077D91000-memory.dmp

Download

memory/316-304-0x00000000032C0000-0x000000000605D000-memory.dmp

Download

memory/316-303-0x00000000032C0000-0x000000000605D000-memory.dmp

Download

memory/316-306-0x0000000077C71000-0x0000000077D91000-memory.dmp

Download

memory/316-307-0x0000000075115000-0x0000000075116000-memory.dmp

Download

memory/316-315-0x00000000032C0000-0x000000000605D000-memory.dmp

Download

memory/4276-312-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/4276-313-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/4276-316-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/4276-317-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/4276-320-0x0000000000480000-0x00000000016D4000-memory.dmp

Download