guloader | 28d29ff8363e71797bd687b5d42b715633e42ce76f4649c7ae68f5a229a36ac9

General

Target

Gansa.exe
Size

529KB
MD5

8ef9b2c45f53d18d18a7da795d5a6a50
SHA1

353bb94c823123080c9c06e2f05fdd2fc5dd9b77
SHA256

8602f2a77c0f0829d49f4ad809b8edf2dc3f86d89cf067e02718edda51ef0ab0
SHA512

af3afdcbb1521088a2e8b4cb30b16cd9fa97cb1a61ea4bcf8c1ae5cf55cb6a0c66c5ce0f6b95d40d5bcc0173586a65f4186aedcf9d7c0a4e3dd6332b0676572c
SSDEEP

12288:DMSfP91E/UwWb8FKQBmuipC4HKzvgmBQ6Ds+ZHmkHN3HiPCpfBVx:ISN1UFWgFKQXi9HKZ2eHnHpHiwV

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
2368	Gansa.exe
2368	Gansa.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2016	Gansa.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2368	Gansa.exe
2016	Gansa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 2016	2368	Gansa.exe	31

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Trnregimenternes\totalsanerende.Obs202	Gansa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gansa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gansa.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2016	Gansa.exe
2016	Gansa.exe
2016	Gansa.exe
2016	Gansa.exe
2016	Gansa.exe
2016	Gansa.exe
2016	Gansa.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2368	Gansa.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2016	2368	Gansa.exe	31
PID 2368 wrote to memory of 2016	2368	Gansa.exe	31
PID 2368 wrote to memory of 2016	2368	Gansa.exe	31
PID 2368 wrote to memory of 2016	2368	Gansa.exe	31
PID 2368 wrote to memory of 2016	2368	Gansa.exe	31
PID 2368 wrote to memory of 2016	2368	Gansa.exe	31

C:\Users\Admin\AppData\Local\Temp\Gansa.exe
"C:\Users\Admin\AppData\Local\Temp\Gansa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\Gansa.exe
  "C:\Users\Admin\AppData\Local\Temp\Gansa.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Music\incinerations.lnk

Filesize
754B

MD5
1c2b8790978c2e8c8ce45d3c029e87ab

SHA1
7e864b161457faa2360606167c7ac61479e128e2

SHA256
26917d24d97b03c146f45fa8e9035077b4c6973d2513b60cb1c5e9b1951d1a88

SHA512
f4a117da4c0d09684bf19a63f419a8ba8c617b795abac470d3bc273f70b03e6e1001e701af472addbc28289faa227714f6d4dcdcff4da6ddf7bccf7c4d9c3b84

Download Submit
\Users\Admin\AppData\Local\Temp\nsjCCD2.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
memory/2016-456-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2016-433-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2016-434-0x0000000077170000-0x0000000077319000-memory.dmp

Filesize
1.7MB

Download
memory/2016-457-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2016-459-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2016-458-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2016-460-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2016-466-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2368-430-0x00000000035D0000-0x0000000006513000-memory.dmp

Filesize
47.3MB

Download
memory/2368-432-0x0000000077170000-0x0000000077319000-memory.dmp

Filesize
1.7MB

Download
memory/2368-431-0x0000000077171000-0x0000000077272000-memory.dmp

Filesize
1.0MB

Download
memory/2368-435-0x00000000035D0000-0x0000000006513000-memory.dmp

Filesize
47.3MB

Download
memory/2368-429-0x00000000035D0000-0x0000000006513000-memory.dmp

Filesize
47.3MB

Download

Analysis

Sharing