guloader | 2e22c6bd477f822942d1900435f0e879a1f7e41b6e8f118c8df2e2119520de14

General

Target

f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe
Size

40KB
MD5

f6ef1a6136f4020eea6211db56904d50
SHA1

7ebd6339ea304e1dbe96117250d11758e2286382
SHA256

2e22c6bd477f822942d1900435f0e879a1f7e41b6e8f118c8df2e2119520de14
SHA512

73da1fefaec327bc57381d0ae0be59c062817a653ca7a4b9b916f0a4b4f88e22dadc072d3ceef0fd22a5c431d7a4ee19a27891fbc6c3e453a350949e043f6ca3
SSDEEP

768:UsQvcH/JfZ8bCOXOxXxL7X0f877Z84EFHjy:UsQ0HhhnJu87V8xjy

Score

10^/10

guloader discovery downloader guloader

Malware Config

Extracted

Family

guloader

C2

http://bnsddfhjdfgvbxc.ru/disabler_encrypted_F0749AF.bin

https://drive.google.com/file/d/1XCdocfzNt5EO13N2GeXmsTfCEgvMuPqk/view?usp=sharing

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

resource	yara_rule
behavioral1/memory/3052-2-0x00000000003E0000-0x00000000003E7000-memory.dmp	family_guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe
2308	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3052 set thread context of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe
3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe
3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2292	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	31
PID 3052 wrote to memory of 2292	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	31
PID 3052 wrote to memory of 2292	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	31
PID 3052 wrote to memory of 2292	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	31
PID 3052 wrote to memory of 2292	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	31
PID 3052 wrote to memory of 2292	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	31
PID 3052 wrote to memory of 2292	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	31
PID 3052 wrote to memory of 2324	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2324	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2324	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2324	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2324	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2324	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2324	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33
PID 3052 wrote to memory of 2308	3052	f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\f6ef1a6136f4020eea6211db56904d50_JaffaCakes118.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-5-0x0000000077380000-0x0000000077529000-memory.dmp

Filesize
1.7MB

Download
memory/3052-2-0x00000000003E0000-0x00000000003E7000-memory.dmp

Filesize
28KB

Download
memory/3052-3-0x0000000077381000-0x0000000077482000-memory.dmp

Filesize
1.0MB

Download
memory/3052-4-0x0000000077380000-0x0000000077529000-memory.dmp

Filesize
1.7MB

Download
memory/3052-6-0x00000000003E0000-0x00000000003E7000-memory.dmp

Filesize
28KB

Download
memory/3052-7-0x00000000003E0000-0x00000000003E7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing