guloader | 70eb47b85640e392cc6389d23ec064cb52dcbe2e0f2d604ff4b7e56646de1b39 | Triage

Sharing

General

Target

70eb47b85640e392cc6389d23ec064cb52dcbe2e0f2d604ff4b7e56646de1b39.exe
Size

729KB
Sample

240920-btbsws1gmg
MD5

52e2a80fbddde1068aac21483072382b
SHA1

32b3206fe35bf321901b90424c8373233d2b0a1e
SHA256

70eb47b85640e392cc6389d23ec064cb52dcbe2e0f2d604ff4b7e56646de1b39
SHA512

bc1d2bba0f108069d288580d911e490c6cd1ffc037be6bfa5ce758354062ffb28a18c38202be12aec3d0169d7e1b2b99f010887f0eedcc45d37de76155dd693a
SSDEEP

12288:LfLuzYhlcQmISA0DRswhfzuOVJBtR8G8jbcsqK7hkNocdAtPgT4JZNYgtrtsX08k:LfLu0sQ5SJRVVJLR78jbcsxNBcEVZ2M9

Score

10^/10

guloader discovery downloader persistence

Malware Config

Targets

- Target
  
  70eb47b85640e392cc6389d23ec064cb52dcbe2e0f2d604ff4b7e56646de1b39.exe
- Size
  
  729KB
- MD5
  
  52e2a80fbddde1068aac21483072382b
- SHA1
  
  32b3206fe35bf321901b90424c8373233d2b0a1e
- SHA256
  
  70eb47b85640e392cc6389d23ec064cb52dcbe2e0f2d604ff4b7e56646de1b39
- SHA512
  
  bc1d2bba0f108069d288580d911e490c6cd1ffc037be6bfa5ce758354062ffb28a18c38202be12aec3d0169d7e1b2b99f010887f0eedcc45d37de76155dd693a
- SSDEEP
  
  12288:LfLuzYhlcQmISA0DRswhfzuOVJBtR8G8jbcsqK7hkNocdAtPgT4JZNYgtrtsX08k:LfLu0sQ5SJRVVJLR78jbcsxNBcEVZ2M9
Score

10^/10

discovery guloader downloader persistence
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  4add245d4ba34b04f213409bfe504c07
- SHA1
  
  ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA256
  
  9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- SHA512
  
  1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP
  
  192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

guloaderdiscoverydownloaderpersistence

behavioral3

behavioral4