guloader | 422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/11/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe
Size 684KB
Sample241108-c2575swkgn
SHA256 422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e
MD5 679962fd58f49f4d2f57a70a60aa287d
SHA1 3e3a3e5bc5e49ab7212e5ae5f340dd820fccd643
SHA512 597a1678322ade7c14d1181b9a2e4e09a7a9f841d5c2f3f0e0e64c40801eec25112dca1c5eaf53834dd1fdf8f5003f69d64e6cf5dd4ea46e42c73018690d4348
SSDEEP 12288:aMwa4IgEP4mLbAcLit9eIAnZ21gvG4nwNtsgw3PgAeeVhGctb7U:aMwa4BEP3Qc+t9eIAnEgB2Mobej7U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\diskussionsklubbens.ini	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe
2592	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 2592	2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe	31

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\mooktar\julekaktussers.ini	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2592	2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe	31
PID 2072 wrote to memory of 2592	2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe	31
PID 2072 wrote to memory of 2592	2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe	31
PID 2072 wrote to memory of 2592	2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe	31
PID 2072 wrote to memory of 2592	2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe	31
PID 2072 wrote to memory of 2592	2072	422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe	31

C:\Users\Admin\AppData\Local\Temp\422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe
"C:\Users\Admin\AppData\Local\Temp\422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe
  "C:\Users\Admin\AppData\Local\Temp\422ea7c485f3c82c72b2adf62961cb61ded05226ceb12ec503bccba25e23886e.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CabFD45.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabFD45.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarFD77.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarFD77.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsdD00C.tmp\System.dll
Size 12KB
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2072-13-0x0000000003670000-0x000000000469A000-memory.dmp

Download

memory/2072-14-0x0000000076F21000-0x0000000077022000-memory.dmp

Download

memory/2072-15-0x0000000076F20000-0x00000000770C9000-memory.dmp

Download

memory/2072-17-0x0000000003670000-0x000000000469A000-memory.dmp

Download

memory/2592-16-0x0000000076F20000-0x00000000770C9000-memory.dmp

Download

memory/2592-70-0x0000000000460000-0x00000000014C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads