guloader | bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a

General

Target

bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe
Size

1.0MB
MD5

d4c7aab6ed29a31a27712f4536614667
SHA1

ad0bd0a27fa90bbcd0d7fa853fef23f2692bea45
SHA256

bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a
SHA512

10f4fb24825a09992b4fc2064a53c317f749d1146f5dc09d8b106bd75ebc137d3b013723897d79fd96e5d948fb185dd008be29c2da728d15ba990af5deae54ea
SSDEEP

12288:x9XMnptEWw7TAIh1LSw84bjZgyrMNAzP6RtRQXl51KBkpw8+QZJ:rcnsWw7sIh1uQba4mRjQVP2UkC

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe
568	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 568	1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe	31

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\sorteringsordenens.lnk	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe
File opened for modification	C:\Program Files (x86)\sorteringsordenens.lnk	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 568	1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe	31
PID 1636 wrote to memory of 568	1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe	31
PID 1636 wrote to memory of 568	1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe	31
PID 1636 wrote to memory of 568	1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe	31
PID 1636 wrote to memory of 568	1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe	31
PID 1636 wrote to memory of 568	1636	bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe	31

C:\Users\Admin\AppData\Local\Temp\bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe
"C:\Users\Admin\AppData\Local\Temp\bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe
  "C:\Users\Admin\AppData\Local\Temp\bcc652b9e147d7e052c9a239e7e2330c9b3fd04743cb40804ea2616aa4f50f1a.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\sorteringsordenens.lnk

Filesize
890B

MD5
e90c93685f022dbe8d9e90d985e7eb90

SHA1
5142af2737f8e26376988288f230c0ade4162050

SHA256
469983e7bc57135e572ebe69c2870b2af9f40acf6c374c8989dca4929ab616c9

SHA512
e1f1421ae48db4a490d04ae5a8bb394191a9d58487d2840246aefc2b74bdd13bde1394c9fb160327cde9d7cf6583430377af075c0ebdde1341cd71050675835f

Download Submit
\Users\Admin\AppData\Local\Temp\nstE39C.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
memory/568-287-0x0000000001520000-0x0000000002C85000-memory.dmp

Filesize
23.4MB

Download
memory/568-288-0x0000000077BE0000-0x0000000077D89000-memory.dmp

Filesize
1.7MB

Download
memory/568-289-0x00000000004B0000-0x0000000001512000-memory.dmp

Filesize
16.4MB

Download
memory/1636-283-0x0000000002BA0000-0x0000000004305000-memory.dmp

Filesize
23.4MB

Download
memory/1636-285-0x0000000077BE0000-0x0000000077D89000-memory.dmp

Filesize
1.7MB

Download
memory/1636-284-0x0000000077BE1000-0x0000000077CE2000-memory.dmp

Filesize
1.0MB

Download
memory/1636-286-0x0000000002BA0000-0x0000000004305000-memory.dmp

Filesize
23.4MB

Download
memory/1636-295-0x0000000002BA0000-0x0000000004305000-memory.dmp

Filesize
23.4MB

Download

Analysis

Sharing