guloader | 057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf

General

Target

057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe
Size

901KB
MD5

6cb35cad38c80bbb552c99caf75f9371
SHA1

f1dcc7d9805738aaf1f30b32383674ea30706269
SHA256

057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf
SHA512

638594b7228a8e747c34f1ab7916774feaff1ce58e875e64bb28cc6742472a305c5aa06e709ec708aad990d9e78ce828509af8a575b3fe62082699de1bb81734
SSDEEP

12288:TSlZI9dcNnPmsS7wkJW7DQFeh2FCCMntz6I8128TsXULDh+gDBf6j4Ydcv+l:2lTnpc/J2d2UVf+DLD1BbYGW

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe
2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\oecus\svante.Eft	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2552	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe
2552	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2880 set thread context of 2552	2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	33

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\sankthansaftnerne\clodpoll.saf	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
456	2552	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2552	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2552	2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	33
PID 2880 wrote to memory of 2552	2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	33
PID 2880 wrote to memory of 2552	2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	33
PID 2880 wrote to memory of 2552	2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	33
PID 2880 wrote to memory of 2552	2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	33
PID 2880 wrote to memory of 2552	2880	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	33
PID 2552 wrote to memory of 456	2552	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	35
PID 2552 wrote to memory of 456	2552	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	35
PID 2552 wrote to memory of 456	2552	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	35
PID 2552 wrote to memory of 456	2552	057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe	35

C:\Users\Admin\AppData\Local\Temp\057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe
"C:\Users\Admin\AppData\Local\Temp\057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe
  "C:\Users\Admin\AppData\Local\Temp\057e7554f7a499adfd2c0a3485675fef4f602b23e2e0a1fd4e07da5b993e4ebf.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 68
    3⤵
    - Program crash
    PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\peripheries.lnk

Filesize
856B

MD5
35051d8132b702d06ae92d716daa8325

SHA1
d780139bce873b9cea9f3d067d03dd0e2e43dc28

SHA256
8913c70de6fb9f789eb8c7c214d1ec534b2463173d634b57bb730fb931d04839

SHA512
afa2bc9a7b6aef6d9d10d94bf2530bf17e5681b863ba89e73a19a6181a569d2711b5cabf9bb7efae57a73aab9c7e1d43277a752a7637aa4477455d5de14f3aa6

Download Submit
C:\Users\Admin\Desktop\peripheries.lnk

Filesize
826B

MD5
1b5dba842f7f0d5f0a1c9fdfb670bfa8

SHA1
9dd9bf5e0eb756ab8dbdec0869b6b156700fc5bd

SHA256
3cdd4d8bb60d898851735427e4ea085161c09194da3dec593c1868cf59dbcebd

SHA512
f7bb2b820bfb352e769dc5991c13b769cc57d5e7c039cfccc223b90cc3c4068b70606ed210be80cb3441061c6c417bea788c03fb2cfc5ac3c5db7c6f741a59de

Download Submit
\Users\Admin\AppData\Local\Temp\nst3850.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
memory/2552-24673-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2552-24677-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2552-24675-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2552-24676-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2552-24674-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2552-24650-0x0000000077BD0000-0x0000000077D79000-memory.dmp

Filesize
1.7MB

Download
memory/2552-24649-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2880-24644-0x0000000002EE0000-0x000000000474B000-memory.dmp

Filesize
24.4MB

Download
memory/2880-24648-0x0000000002EE0000-0x000000000474B000-memory.dmp

Filesize
24.4MB

Download
memory/2880-24647-0x0000000077BD0000-0x0000000077D79000-memory.dmp

Filesize
1.7MB

Download
memory/2880-24646-0x0000000077BD1000-0x0000000077CD2000-memory.dmp

Filesize
1.0MB

Download
memory/2880-24645-0x0000000002EE0000-0x000000000474B000-memory.dmp

Filesize
24.4MB

Download

Analysis

Sharing