guloader | c56e3b354b7cce95f09d642c243ee9851b314028683f3c0e2fa0ce1c8a929bb8

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Product Specification.jpg.exe
Size 92KB
Sample240930-c8henaybkg
SHA256 fcf8c73e6ddc38f6c4da5f525e95aa853edc5334761730ec1eb85a672996021c
MD5 3102f605461887e29318e462dd1ef8cd
SHA1 dde11d3e71974ff54bd32d040802b563c477a1e5
SHA512 dd2373dc1ec961681e2d20b2d2b6fff0a50dc58e6bcfb32866f4122d0d326876aa216490df4f95d14010af7fa89d006b14b9b72c93a5ee1b28281a9de23e654f
SSDEEP 768:kFs9mUrSgcXgnl2+KHueN6UXZv4udRBP5XJSeRVvp2KrhTqPgfuG1c:wBUVyYxeRXFj3R4e/vpZhTqo2/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Extracted

Family

guloader

https://onedrive.live.com/download?cid=604AA6C584DB9137&resid=604AA6C584DB9137%21116&authkey=ABaSWnLIxt-uS2s

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Product Specification.jpg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1180	Product Specification.jpg.exe

C:\Users\Admin\AppData\Local\Temp\Product Specification.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Product Specification.jpg.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-2-0x0000000002350000-0x000000000235B000-memory.dmp

Download

memory/1180-3-0x0000000002350000-0x000000000235B000-memory.dmp