guloader | cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b.exe
Size

721KB
MD5

4b38e08cbd84e6372b1dcc86082629d1
SHA1

00c4ce241b1eaec6f93ae70b2ceaa6d43187f6be
SHA256

cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b
SHA512

4a7826ac37653aaf7f719ea2fa8745cc8dc3a62b58565a8c6443c9cd3178c9520075c8d5f3dbb85b5dcdcc2bd2d01a04b058e5b94a54137d133905a2f4f41cfd
SSDEEP

12288:O9cizFijDzDFbKS5ZuSwcIllZzoLHtB7Y59jFkmDHThxL5DfJr:O9wDFJxIWLANFHDzhxLP

Score

10^/10

guloader discovery downloader execution

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1180	powershell.exe

Blocklisted process makes network request 10 IoCs

flow	pid	Process
26	4412	msiexec.exe
40	4412	msiexec.exe
41	4412	msiexec.exe
46	4412	msiexec.exe
50	4412	msiexec.exe
55	4412	msiexec.exe
68	4412	msiexec.exe
69	4412	msiexec.exe
70	4412	msiexec.exe
73	4412	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1180	powershell.exe
4412	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1180	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeIncreaseQuotaPrivilege	1180	powershell.exe
Token: SeSecurityPrivilege	1180	powershell.exe
Token: SeTakeOwnershipPrivilege	1180	powershell.exe
Token: SeLoadDriverPrivilege	1180	powershell.exe
Token: SeSystemProfilePrivilege	1180	powershell.exe
Token: SeSystemtimePrivilege	1180	powershell.exe
Token: SeProfSingleProcessPrivilege	1180	powershell.exe
Token: SeIncBasePriorityPrivilege	1180	powershell.exe
Token: SeCreatePagefilePrivilege	1180	powershell.exe
Token: SeBackupPrivilege	1180	powershell.exe
Token: SeRestorePrivilege	1180	powershell.exe
Token: SeShutdownPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeSystemEnvironmentPrivilege	1180	powershell.exe
Token: SeRemoteShutdownPrivilege	1180	powershell.exe
Token: SeUndockPrivilege	1180	powershell.exe
Token: SeManageVolumePrivilege	1180	powershell.exe
Token: 33	1180	powershell.exe
Token: 34	1180	powershell.exe
Token: 35	1180	powershell.exe
Token: 36	1180	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1180	4932	cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b.exe	84
PID 4932 wrote to memory of 1180	4932	cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b.exe	84
PID 4932 wrote to memory of 1180	4932	cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b.exe	84
PID 1180 wrote to memory of 4412	1180	powershell.exe	97
PID 1180 wrote to memory of 4412	1180	powershell.exe	97
PID 1180 wrote to memory of 4412	1180	powershell.exe	97
PID 1180 wrote to memory of 4412	1180	powershell.exe	97

C:\Users\Admin\AppData\Local\Temp\cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b.exe
"C:\Users\Admin\AppData\Local\Temp\cfe93a43570d7f0a52ba72065ad15d9ac80a568a619576812749a47fc0cb3e3b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "$Counterweighted=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\deuteronomistic\lipotropic\Tegnerens\Fortrinsrettighedens\Kildesprogenes.Vir';$Lvindernes=$Counterweighted.SubString(55681,3);.$Lvindernes($Counterweighted)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\SysWOW64\msiexec.exe"
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mpwpagqq.00h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\deuteronomistic\lipotropic\Tegnerens\Fortrinsrettighedens\Kildesprogenes.Vir

Filesize
54KB

MD5
3f03617943c93785889b0b33151afd75

SHA1
1358c716ba802fdb105b160a8895f0b9d6fb8770

SHA256
dce53a205e1cdd0938ec514c4ee631101130e98dd0019e2a200c6eed4491a8d8

SHA512
e90d83751d66c922814f0bceda63f498becdaf1216ff659a2835a16eacb1a361d924a7689c78bbdeacac47f993775d5b445eaecd4d31373b70921c9eaebc026f

Download Submit
C:\Users\Admin\AppData\Local\Temp\deuteronomistic\lipotropic\Tegnerens\Misbill245.Spe

Filesize
307KB

MD5
7348bb75b2edaf91423504073d07af2a

SHA1
686531086021b3a4abb700f7e8d52b0d7adec509

SHA256
6103eb60067a974aa5026afaf3af6f039c5cb5d5f872ab7e0fc0976705e23c7b

SHA512
29db731697b7026a11cc509f7b527e0050d022618fada47d768df54716d1b471857f783951f932f14c6649da5dea1202b06dbdbdb2d2af4b24377e94bc825339

Download Submit
memory/1180-44-0x00000000072E0000-0x00000000072FE000-memory.dmp

Filesize
120KB

Download
memory/1180-24-0x0000000005E40000-0x0000000005E5E000-memory.dmp

Filesize
120KB

Download
memory/1180-11-0x0000000004D90000-0x0000000004DB2000-memory.dmp

Filesize
136KB

Download
memory/1180-47-0x0000000007310000-0x00000000073B3000-memory.dmp

Filesize
652KB

Download
memory/1180-13-0x0000000005720000-0x0000000005786000-memory.dmp

Filesize
408KB

Download
memory/1180-48-0x0000000007410000-0x000000000741A000-memory.dmp

Filesize
40KB

Download
memory/1180-23-0x0000000005790000-0x0000000005AE4000-memory.dmp

Filesize
3.3MB

Download
memory/1180-46-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-25-0x0000000005E70000-0x0000000005EBC000-memory.dmp

Filesize
304KB

Download
memory/1180-26-0x0000000007050000-0x00000000070E6000-memory.dmp

Filesize
600KB

Download
memory/1180-28-0x0000000006390000-0x00000000063B2000-memory.dmp

Filesize
136KB

Download
memory/1180-27-0x0000000006340000-0x000000000635A000-memory.dmp

Filesize
104KB

Download
memory/1180-29-0x00000000076A0000-0x0000000007C44000-memory.dmp

Filesize
5.6MB

Download
memory/1180-8-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-31-0x00000000082D0000-0x000000000894A000-memory.dmp

Filesize
6.5MB

Download
memory/1180-32-0x00000000072A0000-0x00000000072D2000-memory.dmp

Filesize
200KB

Download
memory/1180-34-0x0000000070910000-0x0000000070C64000-memory.dmp

Filesize
3.3MB

Download
memory/1180-33-0x0000000070540000-0x000000007058C000-memory.dmp

Filesize
304KB

Download
memory/1180-45-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-6-0x00000000740BE000-0x00000000740BF000-memory.dmp

Filesize
4KB

Download
memory/1180-12-0x0000000004E30000-0x0000000004E96000-memory.dmp

Filesize
408KB

Download
memory/1180-10-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-9-0x0000000004F80000-0x00000000055A8000-memory.dmp

Filesize
6.2MB

Download
memory/1180-49-0x0000000007590000-0x00000000075BA000-memory.dmp

Filesize
168KB

Download
memory/1180-50-0x00000000075C0000-0x00000000075E4000-memory.dmp

Filesize
144KB

Download
memory/1180-51-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-53-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-7-0x0000000002420000-0x0000000002456000-memory.dmp

Filesize
216KB

Download
memory/1180-56-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-55-0x00000000740BE000-0x00000000740BF000-memory.dmp

Filesize
4KB

Download
memory/1180-57-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-59-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-58-0x0000000008950000-0x000000000A0DE000-memory.dmp

Filesize
23.6MB

Download
memory/1180-60-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-61-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-62-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-63-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/1180-64-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/4412-65-0x0000000001B40000-0x00000000032CE000-memory.dmp

Filesize
23.6MB

Download
memory/4412-66-0x00000000008E0000-0x0000000001B34000-memory.dmp

Filesize
18.3MB

Download
memory/4412-67-0x0000000001B40000-0x00000000032CE000-memory.dmp

Filesize
23.6MB

Download