guloader | bdad372e1916a731f45edde8e2db92eadfb2eda17441fb58963e87002bd4dbbd

General

Target

.vbs
Size

1.2MB
MD5

77ff74408e0e839a58733518b4f5fd65
SHA1

a69bd28eef3b94fcd3f1792141de8f0bc28bae7e
SHA256

bdad372e1916a731f45edde8e2db92eadfb2eda17441fb58963e87002bd4dbbd
SHA512

4a497a1fc7d8180afcb5d81baaf199a8b9710fe7ca5c8cd4256f0337a6a409c5a4d7331c2f18c32ae47899426d2b418f37b6ba653e688b7e01d7e84d38298fcf
SSDEEP

12288:niREMhU7JceNaOBqtVbjoOT3GMQtBzWu5aV0dGh4GwrQH:nihUNHBqfJWMWUo9GsQH

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2428	x.exe

Loads dropped DLL 2 IoCs

pid	Process
2428	x.exe
2760	x.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2760	x.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2428	x.exe
2760	x.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2428 set thread context of 2760	2428	x.exe	93

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Anticytolysin.Nep62	x.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Oiler.mil	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x00090000000233cd-4.dat	nsis_installer_1
behavioral2/files/0x00090000000233cd-4.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe
2760	x.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2428	x.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2428	1536	WScript.exe	86
PID 1536 wrote to memory of 2428	1536	WScript.exe	86
PID 1536 wrote to memory of 2428	1536	WScript.exe	86
PID 2428 wrote to memory of 2760	2428	x.exe	93
PID 2428 wrote to memory of 2760	2428	x.exe	93
PID 2428 wrote to memory of 2760	2428	x.exe	93
PID 2428 wrote to memory of 2760	2428	x.exe	93
PID 2428 wrote to memory of 2760	2428	x.exe	93

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsf87CE.tmp\System.dll

Filesize
11KB

MD5
6ad39193ed20078aa1b23c33a1e48859

SHA1
95e70e4f47aa1689cc08afbdaef3ec323b5342fa

SHA256
b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2

SHA512
78c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
690KB

MD5
5a029a7d1995bab98d18e71526ed4e4d

SHA1
47e7a2071aa57b14ea97858adf7779717b1a833a

SHA256
c1ff35ef1a3a1c183b133991bacb90660b01934cf484dd13c5d833e5cb4499d8

SHA512
d27123f84caae04ae23b0b1465d09c20a9e5431611de3700e18e893cfe84297d2d0453dd46fa9a5be804fdb6dfb1f854d3467e9f9d34baf179c2dbca4a42db9b

Download Submit
memory/2428-35-0x0000000002890000-0x0000000004279000-memory.dmp

Filesize
25.9MB

Download
memory/2428-21-0x0000000002890000-0x0000000004279000-memory.dmp

Filesize
25.9MB

Download
memory/2428-22-0x0000000076F71000-0x0000000077091000-memory.dmp

Filesize
1.1MB

Download
memory/2428-23-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/2428-24-0x0000000002890000-0x0000000004279000-memory.dmp

Filesize
25.9MB

Download
memory/2760-26-0x00000000016F0000-0x00000000030D9000-memory.dmp

Filesize
25.9MB

Download
memory/2760-33-0x0000000000490000-0x00000000016E4000-memory.dmp

Filesize
18.3MB

Download
memory/2760-37-0x00000000016F0000-0x00000000030D9000-memory.dmp

Filesize
25.9MB

Download
memory/2760-36-0x0000000000490000-0x00000000016E4000-memory.dmp

Filesize
18.3MB

Download
memory/2760-38-0x0000000000490000-0x00000000016E4000-memory.dmp

Filesize
18.3MB

Download
memory/2760-41-0x0000000000490000-0x00000000016E4000-memory.dmp

Filesize
18.3MB

Download

Analysis

Sharing