guloader | 2fba62d26b23162edc673374335d575688b00d1467d936618793d28ec3729ad6

General

Target

Stadigheder43.exe
Size

894KB
MD5

aa160f24e5670e39abcc8a33c6f51f2f
SHA1

eb8f77c8f6c5699614e304d8e7f8a3950ba41a4a
SHA256

2fba62d26b23162edc673374335d575688b00d1467d936618793d28ec3729ad6
SHA512

8261633df47cad2dab42508a8f1c9d421b0b0c91d62a8b08bf3787c19b7116f3f091791800983bcd9d75d92b0097c08c670a38963ef4effd04e70ffc4cb9565e
SSDEEP

24576:2x+rcb2ZkoncoAzPLqt62HnQIQMOKOaeKf:2x+4b2SoncFzPLH2HTzOKOwf

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

Processes:

Stadigheder43.exe

pid	Process
2824	Stadigheder43.exe
2824	Stadigheder43.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
3	drive.google.com
4	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Stadigheder43.exe

pid	Process
2540	Stadigheder43.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Stadigheder43.exeStadigheder43.exe

pid	Process
2824	Stadigheder43.exe
2540	Stadigheder43.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Stadigheder43.exe

description	pid	Process	procid_target
PID 2824 set thread context of 2540	2824	Stadigheder43.exe	30

Drops file in Program Files directory 1 IoCs

Processes:

Stadigheder43.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Reoil.mul	Stadigheder43.exe

Drops file in Windows directory 6 IoCs

Processes:

Stadigheder43.exe

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Spodium39.int	Stadigheder43.exe
File opened for modification	C:\Windows\Belringernes\Dermatophony.ini	Stadigheder43.exe
File opened for modification	C:\Windows\resources\nringsmiddelet.ini	Stadigheder43.exe
File opened for modification	C:\Windows\resources\stenhjsplanternes\fordreves.ini	Stadigheder43.exe
File opened for modification	C:\Windows\Fonts\karrooers.ini	Stadigheder43.exe
File opened for modification	C:\Windows\Fonts\brunsttiderne.tri	Stadigheder43.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Stadigheder43.exeStadigheder43.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stadigheder43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stadigheder43.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Stadigheder43.exe

pid	Process
2540	Stadigheder43.exe
2540	Stadigheder43.exe
2540	Stadigheder43.exe
2540	Stadigheder43.exe
2540	Stadigheder43.exe
2540	Stadigheder43.exe
2540	Stadigheder43.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Stadigheder43.exe

pid	Process
2824	Stadigheder43.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Stadigheder43.exe

description	pid	Process	procid_target
PID 2824 wrote to memory of 2540	2824	Stadigheder43.exe	30
PID 2824 wrote to memory of 2540	2824	Stadigheder43.exe	30
PID 2824 wrote to memory of 2540	2824	Stadigheder43.exe	30
PID 2824 wrote to memory of 2540	2824	Stadigheder43.exe	30
PID 2824 wrote to memory of 2540	2824	Stadigheder43.exe	30
PID 2824 wrote to memory of 2540	2824	Stadigheder43.exe	30

C:\Users\Admin\AppData\Local\Temp\Stadigheder43.exe
"C:\Users\Admin\AppData\Local\Temp\Stadigheder43.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\Stadigheder43.exe
  "C:\Users\Admin\AppData\Local\Temp\Stadigheder43.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso6385.tmp\System.dll

Filesize
11KB

MD5
c9473cb90d79a374b2ba6040ca16e45c

SHA1
ab95b54f12796dce57210d65f05124a6ed81234a

SHA256
b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352

SHA512
eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b

Download Submit
memory/2540-50-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2540-52-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2540-59-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2540-53-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2540-51-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2540-24-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2540-26-0x0000000076D60000-0x0000000076F09000-memory.dmp

Filesize
1.7MB

Download
memory/2540-48-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2540-49-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2824-20-0x0000000003680000-0x0000000005EA3000-memory.dmp

Filesize
40.1MB

Download
memory/2824-21-0x0000000003680000-0x0000000005EA3000-memory.dmp

Filesize
40.1MB

Download
memory/2824-25-0x0000000003680000-0x0000000005EA3000-memory.dmp

Filesize
40.1MB

Download
memory/2824-23-0x0000000076D60000-0x0000000076F09000-memory.dmp

Filesize
1.7MB

Download
memory/2824-22-0x0000000076D61000-0x0000000076E62000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads