Malware Analysis Report

2024-11-13 17:38

Sample ID 241107-rn3meswnal
Target ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe
SHA256 ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66
Tags
discovery guloader downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66

Threat Level: Known bad

The file ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe was found to be: Known bad.

Malicious Activity Summary

discovery guloader downloader

Guloader,Cloudeye

Guloader family

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Suspicious use of NtCreateThreadExHideFromDebugger

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

NSIS installer

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 14:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 14:21

Reported

2024-11-07 14:23

Platform

win7-20240903-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe"

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe

"C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 472

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nsoEF5F.tmp\System.dll

MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f

memory/2696-16-0x0000000003520000-0x0000000005C9F000-memory.dmp

memory/2696-17-0x0000000003520000-0x0000000005C9F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 14:21

Reported

2024-11-07 14:23

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe"

Signatures

Guloader family

guloader

Guloader,Cloudeye

downloader guloader

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe

"C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe"

C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe

"C:\Users\Admin\AppData\Local\Temp\ca59e14180c4b88c328f4704724a32c82295a9324bcbb9bf146a895f2f8eaa66.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3100 -ip 3100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 1516

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.187.206:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.212.227:80 c.pki.goog tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.16.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 227.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsr8ACC.tmp\System.dll

MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f

memory/4188-14-0x0000000003190000-0x000000000590F000-memory.dmp

memory/4188-15-0x0000000003190000-0x000000000590F000-memory.dmp

memory/4188-16-0x0000000076F31000-0x0000000077051000-memory.dmp

memory/4188-18-0x00000000743D5000-0x00000000743D6000-memory.dmp

memory/4188-17-0x0000000076F31000-0x0000000077051000-memory.dmp

memory/4188-19-0x0000000003190000-0x000000000590F000-memory.dmp

memory/3100-20-0x0000000000400000-0x0000000001654000-memory.dmp

memory/3100-21-0x0000000001660000-0x0000000003DDF000-memory.dmp

memory/3100-34-0x0000000000400000-0x0000000001654000-memory.dmp

memory/3100-35-0x0000000000400000-0x0000000001654000-memory.dmp

memory/3100-36-0x0000000001660000-0x0000000003DDF000-memory.dmp

memory/3100-37-0x0000000000400000-0x0000000001654000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-07 14:21

Reported

2024-11-07 14:23

Platform

win7-20240708-en

Max time kernel

122s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 220

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-07 14:21

Reported

2024-11-07 14:23

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

135s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5088 wrote to memory of 2180 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5088 wrote to memory of 2180 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5088 wrote to memory of 2180 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2180 -ip 2180

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

N/A