guloader | f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb

General

Target

f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe
Size

810KB
MD5

f7fc33c3bcded454047a6bfaf99f1452
SHA1

a23a2448f373a4319fc0722b72595815d27c62c6
SHA256

f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb
SHA512

0211b32321c50653fbf67190cd24455d997016f7cc9fe7e86457dfeda647ba326c2e0c2fa5d352a98ef4ec82724cd7ab50dc9988cb7e354f99623e0aa6740d29
SSDEEP

24576:pG+yftcZ0DbBTVsVQ7LE8oy9jRKta3uja581Cj:wPcZ0BuO7L7o/a5

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

Processes:

f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

pid	process
2992	f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe
2992	f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

Drops file in Program Files directory 1 IoCs

Processes:

f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\customization.rom	f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

Drops file in Windows directory 1 IoCs

Processes:

f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

description ioc process

File opened for modification C:\Windows\resources\primy.ini f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3896 4972 WerFault.exe f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

description	ioc	process
File opened for modification	C:\Windows\resources\primy.ini	f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

pid	pid_target	process	target process
3896	4972	WerFault.exe	f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe

C:\Users\Admin\AppData\Local\Temp\f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe
"C:\Users\Admin\AppData\Local\Temp\f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2992
- C:\Users\Admin\AppData\Local\Temp\f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe
  "C:\Users\Admin\AppData\Local\Temp\f392bfa146ad86308fa464a9505708645f99618d54483cbc6b746b656f26a3fb.exe"
  2⤵
  PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1068
    3⤵
    - Program crash
    PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsx23EF.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
C:\Windows\Resources\primy.ini

Filesize
33B

MD5
76d9175a3db7407eb0bfc3c07ddcd9d2

SHA1
72071127e9a44935cb02650ed715ccaf6a8f8418

SHA256
1f7119996dd17af05bf05e497104715bbbc3909676afa4329fbd59502be1a1a5

SHA512
5032dab71e70a4bd1dad2f5cf9380e0097be7993bc46886fed6e4bdd8781f2b10d31338d90d0dc5804665bda2cbfe93f1172250e1a8ab7c9118baf9f156e3c69

Download Submit
memory/2992-23237-0x0000000002F20000-0x0000000003CD5000-memory.dmp

Filesize
13.7MB

Download
memory/2992-23238-0x0000000077DE1000-0x0000000077F01000-memory.dmp

Filesize
1.1MB

Download
memory/2992-23239-0x0000000002F20000-0x0000000003CD5000-memory.dmp

Filesize
13.7MB

Download
memory/4972-23243-0x0000000077E85000-0x0000000077E86000-memory.dmp

Filesize
4KB

Download
memory/4972-23250-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4972-23242-0x0000000077E68000-0x0000000077E69000-memory.dmp

Filesize
4KB

Download
memory/4972-23240-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4972-23247-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4972-23248-0x0000000001660000-0x0000000002415000-memory.dmp

Filesize
13.7MB

Download
memory/4972-23249-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/4972-23241-0x0000000001660000-0x0000000002415000-memory.dmp

Filesize
13.7MB

Download
memory/4972-23251-0x0000000077DE1000-0x0000000077F01000-memory.dmp

Filesize
1.1MB

Download
memory/4972-23252-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4972-23253-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/4972-23254-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4972-23255-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4972-23257-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads