guloader | 28d29ff8363e71797bd687b5d42b715633e42ce76f4649c7ae68f5a229a36ac9

General

Target

Gansa.exe
Size

529KB
MD5

8ef9b2c45f53d18d18a7da795d5a6a50
SHA1

353bb94c823123080c9c06e2f05fdd2fc5dd9b77
SHA256

8602f2a77c0f0829d49f4ad809b8edf2dc3f86d89cf067e02718edda51ef0ab0
SHA512

af3afdcbb1521088a2e8b4cb30b16cd9fa97cb1a61ea4bcf8c1ae5cf55cb6a0c66c5ce0f6b95d40d5bcc0173586a65f4186aedcf9d7c0a4e3dd6332b0676572c
SSDEEP

12288:DMSfP91E/UwWb8FKQBmuipC4HKzvgmBQ6Ds+ZHmkHN3HiPCpfBVx:ISN1UFWgFKQXi9HKZ2eHnHpHiwV

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4956	Gansa.exe
4956	Gansa.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
30	drive.google.com
29	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2080	Gansa.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4956	Gansa.exe
2080	Gansa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4956 set thread context of 2080	4956	Gansa.exe	94

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Trnregimenternes\totalsanerende.Obs202	Gansa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gansa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gansa.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe
2080	Gansa.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4956	Gansa.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 2080	4956	Gansa.exe	94
PID 4956 wrote to memory of 2080	4956	Gansa.exe	94
PID 4956 wrote to memory of 2080	4956	Gansa.exe	94
PID 4956 wrote to memory of 2080	4956	Gansa.exe	94
PID 4956 wrote to memory of 2080	4956	Gansa.exe	94

C:\Users\Admin\AppData\Local\Temp\Gansa.exe
"C:\Users\Admin\AppData\Local\Temp\Gansa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\Gansa.exe
  "C:\Users\Admin\AppData\Local\Temp\Gansa.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdB47C.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
C:\Users\Admin\Music\incinerations.lnk

Filesize
762B

MD5
f9842e93387b3e6e52d3055df84dbabc

SHA1
7da25f0b4ac3962a0b84f56833a980a7b7d6a1ab

SHA256
0f4f832bc7594227f8dbe02612a20aaac0248c5e2e1334db8f8810b92d79cb9f

SHA512
d722c963fafefa334787e831e8f8fd1d979baa17c3f47592edc4cfb19543c42d736425d0f19a462dd38293c8d654bb690a25bcd513f18bffafbc87eceeddb124

Download Submit
memory/2080-450-0x0000000001660000-0x00000000045A3000-memory.dmp

Filesize
47.3MB

Download
memory/2080-457-0x0000000001660000-0x00000000045A3000-memory.dmp

Filesize
47.3MB

Download
memory/2080-456-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2080-453-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2080-452-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2080-434-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2080-451-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2080-436-0x0000000001660000-0x00000000045A3000-memory.dmp

Filesize
47.3MB

Download
memory/2080-449-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4956-431-0x0000000077A51000-0x0000000077B71000-memory.dmp

Filesize
1.1MB

Download
memory/4956-435-0x00000000033D0000-0x0000000006313000-memory.dmp

Filesize
47.3MB

Download
memory/4956-433-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/4956-432-0x0000000077A51000-0x0000000077B71000-memory.dmp

Filesize
1.1MB

Download
memory/4956-430-0x00000000033D0000-0x0000000006313000-memory.dmp

Filesize
47.3MB

Download
memory/4956-429-0x00000000033D0000-0x0000000006313000-memory.dmp

Filesize
47.3MB

Download

Analysis

Sharing