guloader | 9f82994c5a9245dfd9233933c272efc2ae69c6b731bb090b10bdc3fc1d0df46a

General

Target

zamowienie_22.exe
Size

770KB
MD5

43a9a9cf3242f8b4b17cdd4ebbe2cd67
SHA1

bfb47cefbc03dfd4bc868971dcce323234d5c92a
SHA256

0f941fbecb454d715d1d229b0a2daaa099a9dd03599485131c49241c2ff62cce
SHA512

417c7db404e5f052057973ac71d7be3d101a439b82ac983a06dda22253db13b504ddbcba07410b09110a73548934766d248260c7d9c16dff559cad27885d4cfc
SSDEEP

24576:bkkDNBR1KThGMMCxMdhnPnsLy1LCMNnk+ot664:VNBbAMuMdhnPnsKGMNnk5Q64

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
1720	zamowienie_22.exe
1720	zamowienie_22.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4756	zamowienie_22.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1720	zamowienie_22.exe
4756	zamowienie_22.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 4756	1720	zamowienie_22.exe	94

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\synderegistres.lnk	zamowienie_22.exe
File opened for modification	C:\Windows\negotiate\Anstdeligheden.ini	zamowienie_22.exe
File created	C:\Windows\resources\synderegistres.lnk	zamowienie_22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zamowienie_22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zamowienie_22.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe
4756	zamowienie_22.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1720	zamowienie_22.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 4756	1720	zamowienie_22.exe	94
PID 1720 wrote to memory of 4756	1720	zamowienie_22.exe	94
PID 1720 wrote to memory of 4756	1720	zamowienie_22.exe	94
PID 1720 wrote to memory of 4756	1720	zamowienie_22.exe	94
PID 1720 wrote to memory of 4756	1720	zamowienie_22.exe	94

C:\Users\Admin\AppData\Local\Temp\zamowienie_22.exe
"C:\Users\Admin\AppData\Local\Temp\zamowienie_22.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\zamowienie_22.exe
  "C:\Users\Admin\AppData\Local\Temp\zamowienie_22.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\eksportafgrde.ini

Filesize
38B

MD5
a0d91a2f9acb4dec3b5260aba27839c4

SHA1
8a9037c691a2bdeebcab8bf3d4c954e62aca9207

SHA256
773cd6fba7d53550b4c41aa889e330b744a7a579df2bb02212773b67e72f5844

SHA512
d3df7852aea197e901c787cd8d943faaa30ee9a6678c4853ed0bb494679897854e4e7556f420f1c176443a485cf1e02e0b4bff86f8da4017a053362b2c9a0608

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb8937.tmp\System.dll

Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
C:\Windows\Resources\synderegistres.lnk

Filesize
826B

MD5
f876ce14553159b9c901c9eb56598b51

SHA1
46ff196aba18d7ebbf0788ac02ae01cc2a823139

SHA256
725bfa69dde8893c13aac197ebab8139e2e440eb00f9a19c959c66d739e9b0ea

SHA512
598ea50f018a6553537cbfadae8fb73957f2ccfd44d655ab285c6704efddbbb41961bcfbef8b2cfa591c59ddd71abad3d13aafad6b535ed1f170e64823e51c21

Download Submit
memory/1720-826-0x00000000034C0000-0x0000000004F63000-memory.dmp

Filesize
26.6MB

Download
memory/1720-827-0x0000000077A31000-0x0000000077B51000-memory.dmp

Filesize
1.1MB

Download
memory/1720-828-0x00000000034C0000-0x0000000004F63000-memory.dmp

Filesize
26.6MB

Download
memory/1720-829-0x0000000074725000-0x0000000074726000-memory.dmp

Filesize
4KB

Download
memory/1720-831-0x00000000034C0000-0x0000000004F63000-memory.dmp

Filesize
26.6MB

Download
memory/4756-830-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4756-832-0x0000000001660000-0x0000000003103000-memory.dmp

Filesize
26.6MB

Download
memory/4756-833-0x0000000077AB8000-0x0000000077AB9000-memory.dmp

Filesize
4KB

Download
memory/4756-835-0x0000000077AD5000-0x0000000077AD6000-memory.dmp

Filesize
4KB

Download
memory/4756-834-0x0000000001660000-0x0000000003103000-memory.dmp

Filesize
26.6MB

Download
memory/4756-839-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4756-840-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4756-841-0x0000000077A31000-0x0000000077B51000-memory.dmp

Filesize
1.1MB

Download
memory/4756-842-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4756-845-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4756-846-0x0000000001660000-0x0000000003103000-memory.dmp

Filesize
26.6MB

Download

Analysis

Sharing