guloader | ea1a4c76b4dfcf22211e33a630ae0318f4ef26f9962caebc945e9e793ad3c730

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bdec6c1910f93889fcffbc992301deaca66a028734bacdf642b374339b6e0bd6.vbs
Size 727KB
Sample240827-bg71kaxapp
SHA256 bdec6c1910f93889fcffbc992301deaca66a028734bacdf642b374339b6e0bd6
MD5 3403a2eda1b395b0b52459dd0797c94f
SHA1 7474c9377f59e0664b011fe9847887a10bec0225
SHA512 5e082393eeb31761825fc855dd3e67b6e79f49d0606d5a5b28678e673c1dcd2daae42b5887f649935c923883917f98611b58ff50ebc71e8bb9fc33dcad8178ad
SSDEEP 12288:k/+WfeHxut4cCoIfJR0IOBMGYZ36XROIE1zAPZ1yiK3TD7D4GPA5GU:nMBbXVxYUhOvaunH457
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3684	x.exe

Loads dropped DLL 2 IoCs

pid	Process
3684	x.exe
1600	x.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1600	x.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3684	x.exe
1600	x.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3684 set thread context of 1600	3684	x.exe	96

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\udsprge.ini	x.exe
File created	C:\Program Files (x86)\Aareladningen9.lnk	x.exe
File opened for modification	C:\Program Files (x86)\Aareladningen9.lnk	x.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Nednormeres84\vrouw.ini	x.exe
File opened for modification	C:\Windows\resources\0409\annoncerede.del	x.exe
File opened for modification	C:\Windows\resources\0409\satori.ops	x.exe
File opened for modification	C:\Windows\biopsychical.tub	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe
1600	x.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3684	x.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3684	392	WScript.exe	84
PID 392 wrote to memory of 3684	392	WScript.exe	84
PID 392 wrote to memory of 3684	392	WScript.exe	84
PID 3684 wrote to memory of 1600	3684	x.exe	96
PID 3684 wrote to memory of 1600	3684	x.exe	96
PID 3684 wrote to memory of 1600	3684	x.exe	96
PID 3684 wrote to memory of 1600	3684	x.exe	96
PID 3684 wrote to memory of 1600	3684	x.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bdec6c1910f93889fcffbc992301deaca66a028734bacdf642b374339b6e0bd6.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aareladningen9.lnk

Path C:\Program Files (x86)\Aareladningen9.lnk
Size 822B
SHA256 1cc1c136a369f275cb1bb0371c1d702b66fcaa1c42c435efe32cc20cebdf2b82
MD5 dbb78d16ef8f21af29d5d913939ca44b
SHA1 838592da91699e28a8dcd9e6a920d723a299b8d3
SHA512 da0752aafb17ae6b4d541a16265b020882e15d6bc47b4bc99f56071978712277594dff0b71e92c594479bdbb2ffdf8264c3a1e448f8449f41d0ba7b29ed29df8
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd8F51.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 495KB
SHA256 308e433c6caa8d81a92591f50f1867c85b2c71afd4bf23afc287f5f40ba27210
MD5 8bccd402648151d17f890e37d3b2d553
SHA1 0b06dfc0d133f0306e3cfaa46da5c30323bf100b
SHA512 deb907819b506e3c68b0254a0c56e0fda40b6e1ff5cc7d03fd7c858d2424e14472b40cf8dbad4d814d8135d424cddd6b9e721bd16ed371f70d150a99fe318e67
SSDEEP 12288:DY2/eVVRSGpwOhZ1ZQ0hhFhiQ8HgHkrTt:DY2/8SGFbhjhKrTt
MD5 SHA1 SHA512 SSDEEP

Submit Download

constantinian.ini

Path C:\Users\Admin\Music\constantinian.ini
Size 32B
SHA256 463b9ed24cfc842af86f043ab6a13005b36a15b7e1ff4ed493c02c25499463b6
MD5 1edd842653739b3e4e739819666d770d
SHA1 a522290cc79af78ebc16dce41ffdae939a553766
SHA512 889a339ac677ef4149e3a284a0922ec63e28019657be0a80b5042551f0bf9f6c05adae39f94fb95a779c951f5db7315b1b2325245221aec06f8175e02f28a054
MD5 SHA1 SHA512

Submit Download

memory/1600-313-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/1600-321-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/1600-318-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/1600-317-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/1600-316-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/1600-312-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/3684-303-0x00000000031A0000-0x0000000005F3D000-memory.dmp

Download

memory/3684-315-0x00000000031A0000-0x0000000005F3D000-memory.dmp

Download

memory/3684-306-0x0000000077371000-0x0000000077491000-memory.dmp

Download

memory/3684-307-0x0000000074815000-0x0000000074816000-memory.dmp

Download

memory/3684-305-0x0000000077371000-0x0000000077491000-memory.dmp

Download

memory/3684-304-0x00000000031A0000-0x0000000005F3D000-memory.dmp

Download