guloader | a813abee8420a861bc302be836472317911813d945a45b061a03c48ab6c0dfc3

General

Target

Impressionist.exe
Size

875KB
MD5

7f31ecb15c3d93d700a630f4cf7f5b57
SHA1

0523205edcc8f140898a13a42a09fd9046cc1678
SHA256

a813abee8420a861bc302be836472317911813d945a45b061a03c48ab6c0dfc3
SHA512

067b1d89f4fcb84ae7083f8c3864c1bd109f5b7c34a7d3a71afaf57166a270918b5fb5198c836eb309d589140355dc071bc3f2de63a5fe1b01f75a7e4c2ac0b7
SSDEEP

24576:XiGFaq43NvCYqoSWmujTrl192YvmvvqOJ/QOeae:XiGFu3Nvzrddf2YvwvqOJ/qae

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
2008	Impressionist.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1736	Impressionist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2008	Impressionist.exe
1736	Impressionist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 1736	2008	Impressionist.exe	31

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\storsejlenes\blackweed.hor	Impressionist.exe
File opened for modification	C:\Windows\Arder.lnk	Impressionist.exe
File created	C:\Windows\Arder.lnk	Impressionist.exe
File opened for modification	C:\Windows\resources\0409\figenkaktusses\Ea40.ini	Impressionist.exe
File opened for modification	C:\Windows\Fonts\heraclitic.Wom	Impressionist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Impressionist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Impressionist.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1736	Impressionist.exe
1736	Impressionist.exe
1736	Impressionist.exe
1736	Impressionist.exe
1736	Impressionist.exe
1736	Impressionist.exe
1736	Impressionist.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2008	Impressionist.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1736	2008	Impressionist.exe	31
PID 2008 wrote to memory of 1736	2008	Impressionist.exe	31
PID 2008 wrote to memory of 1736	2008	Impressionist.exe	31
PID 2008 wrote to memory of 1736	2008	Impressionist.exe	31
PID 2008 wrote to memory of 1736	2008	Impressionist.exe	31
PID 2008 wrote to memory of 1736	2008	Impressionist.exe	31

C:\Users\Admin\AppData\Local\Temp\Impressionist.exe
"C:\Users\Admin\AppData\Local\Temp\Impressionist.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\Impressionist.exe
  "C:\Users\Admin\AppData\Local\Temp\Impressionist.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Arder.lnk

Filesize
714B

MD5
96a7adcf54b3d770d15116bbcd64cbf9

SHA1
0c6d7e7bb5dddaef2f5dcab9c9570f59872fd422

SHA256
3723a74ee7671653f07aa763b008e386befee42223b017a21c9abe18b6a08e69

SHA512
6dfc28921fbf9d01685648206de4e42155160af59fa2c0643781682f6e79b1112a46adc62b80d0de3134080bf64492ae1360fccaf30c2fc0fd4c7a6aec8b120d

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8622.tmp\System.dll

Filesize
11KB

MD5
34442e1e0c2870341df55e1b7b3cccdc

SHA1
99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

SHA256
269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

SHA512
4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

Download Submit
memory/1736-307-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1736-316-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1736-310-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1736-309-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1736-308-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1736-286-0x00000000771F0000-0x0000000077399000-memory.dmp

Filesize
1.7MB

Download
memory/1736-285-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2008-283-0x0000000002E40000-0x00000000053BC000-memory.dmp

Filesize
37.5MB

Download
memory/2008-287-0x0000000002E40000-0x00000000053BC000-memory.dmp

Filesize
37.5MB

Download
memory/2008-284-0x00000000771F0000-0x0000000077399000-memory.dmp

Filesize
1.7MB

Download
memory/2008-282-0x00000000773E0000-0x00000000774B6000-memory.dmp

Filesize
856KB

Download
memory/2008-281-0x00000000771F1000-0x00000000772F2000-memory.dmp

Filesize
1.0MB

Download
memory/2008-280-0x0000000002E40000-0x00000000053BC000-memory.dmp

Filesize
37.5MB

Download

Analysis

Sharing