guloader | fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d

General

Target

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
Size

687KB
MD5

2031608d4bafa45c4b0bc75d8e807204
SHA1

8719b0608a8d814cc81a437e105bafd8622e76d5
SHA256

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d
SHA512

f87ff9056ef512a51d7a162ac6b10aee06e90c753c9d30936d2434e78bb3242f796410981e7bc12ef2a7db4a6841422a8736128dadc07eaf0b8cc3c5a132678c
SSDEEP

12288:4HadgTG32D4XRzd/Yh4+esb+al82xp/O/DUAIQqvMu+/O6x:8adgT1UhpwDesbFlt4Dh/bx

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

Processes:

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

pid	process
1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exefc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

pid	process
1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
3624	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

description	pid	process	target process
PID 1436 set thread context of 3624	1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

Drops file in Windows directory 2 IoCs

Processes:

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\anderssons\svrdliljernes.elu	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
File opened for modification	C:\Windows\resources\0409\Landgafol76\bojanerne.ini	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exefc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

pid process

1436 fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

description	pid	process	target process
PID 1436 wrote to memory of 3624	1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
PID 1436 wrote to memory of 3624	1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
PID 1436 wrote to memory of 3624	1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
PID 1436 wrote to memory of 3624	1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
PID 1436 wrote to memory of 3624	1436	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe	fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe

C:\Users\Admin\AppData\Local\Temp\fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
"C:\Users\Admin\AppData\Local\Temp\fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe
  "C:\Users\Admin\AppData\Local\Temp\fc73b5466e3c2c0d5d9dc70a8b210eb617ac2fdf74a8caee778d57fdb197690d.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl958B.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
memory/1436-14-0x00000000033B0000-0x0000000005CCF000-memory.dmp

Filesize
41.1MB

Download
memory/1436-15-0x0000000077731000-0x0000000077851000-memory.dmp

Filesize
1.1MB

Download
memory/1436-16-0x0000000074425000-0x0000000074426000-memory.dmp

Filesize
4KB

Download
memory/1436-18-0x00000000033B0000-0x0000000005CCF000-memory.dmp

Filesize
41.1MB

Download
memory/3624-17-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3624-19-0x0000000001660000-0x0000000003F7F000-memory.dmp

Filesize
41.1MB

Download
memory/3624-26-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3624-27-0x0000000001660000-0x0000000003F7F000-memory.dmp

Filesize
41.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads