guloader | 7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d

General

Target

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
Size

1009KB
MD5

5b9520cdce201fecd22a108edc4b9927
SHA1

6afb7c1ee328ec47ff4aabe5a19cd2d26ab54c1f
SHA256

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d
SHA512

73e30d7e7f6519216f96638b025f4ce844c11ee90176bb4c49a0923b63423b246f22638db2c5bf61d7c874203edabdd7d4fdd0c651bfdf7b17311278fc67d750
SSDEEP

12288:l0g77CaJ/85VedbvaOvTks8Eac9Q7RS3iDpDUJMDVb8hAvaiKz4R39HzIluzTB:PCm85VwaOLkTjcGciDUJ2bsV21IAJ

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
1012	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 1012	4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	97

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\realisme.ini	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
File opened for modification	C:\Windows\resources\0409\busher.Hed	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1012	4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	97
PID 4616 wrote to memory of 1012	4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	97
PID 4616 wrote to memory of 1012	4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	97
PID 4616 wrote to memory of 1012	4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	97
PID 4616 wrote to memory of 1012	4616	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	97

C:\Users\Admin\AppData\Local\Temp\7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
"C:\Users\Admin\AppData\Local\Temp\7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
  "C:\Users\Admin\AppData\Local\Temp\7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsaD2F1.tmp\System.dll

Filesize
11KB

MD5
34442e1e0c2870341df55e1b7b3cccdc

SHA1
99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

SHA256
269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

SHA512
4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

Download Submit
C:\Windows\realisme.ini

Filesize
36B

MD5
54098ab42483d0d9baafb98e754befed

SHA1
e355e59f79fcd4f5e2c8916a1009e6ac36788c9b

SHA256
37863e9da60268fc68e1c602ee02fed62705704ba3bf1c2e607e0cfe22487d22

SHA512
c960a4365b12b92bbf89d62492db50c79ded4523c9ec86c38dd3fdb2050f1d68caa42d4572d86f2e03069f3e3c638769a4b8d1269de2391c22fde996c3ad2fbb

Download Submit
memory/1012-30-0x0000000001700000-0x0000000003842000-memory.dmp

Filesize
33.3MB

Download
memory/1012-27-0x0000000001700000-0x0000000003842000-memory.dmp

Filesize
33.3MB

Download
memory/1012-29-0x0000000077358000-0x0000000077359000-memory.dmp

Filesize
4KB

Download
memory/1012-31-0x0000000077375000-0x0000000077376000-memory.dmp

Filesize
4KB

Download
memory/1012-32-0x00000000004A0000-0x00000000016F4000-memory.dmp

Filesize
18.3MB

Download
memory/1012-33-0x00000000772D1000-0x00000000773F1000-memory.dmp

Filesize
1.1MB

Download
memory/4616-24-0x00000000029B0000-0x0000000004AF2000-memory.dmp

Filesize
33.3MB

Download
memory/4616-25-0x00000000772D1000-0x00000000773F1000-memory.dmp

Filesize
1.1MB

Download
memory/4616-26-0x0000000074774000-0x0000000074775000-memory.dmp

Filesize
4KB

Download
memory/4616-28-0x00000000029B0000-0x0000000004AF2000-memory.dmp

Filesize
33.3MB

Download
memory/4616-23-0x00000000029B0000-0x0000000004AF2000-memory.dmp

Filesize
33.3MB

Download

Analysis

Sharing