guloader | 7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AWB.exe
Size

734KB
MD5

0c9009a01f16ae4f68f806f30fad5ed2
SHA1

c92ad48134ec43427462c3657cd229dd31e239df
SHA256

7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9
SHA512

d894bb452e05548a757bfbd8ddc0c3b55686690923ca01c58e68d399afe88d5d013076fcf83fcb51483e887373ad5bc76671998b3b738cd01c5752511a10db63
SSDEEP

12288:EI0YglGokRtZYxDuT5+tofxytZ4FbVjLfWJRuDnEFGuAY2eAuVLZEqhaH/e5rS++:EI0blXUEx4+ptZ4/WJAgHA8AuVLZEkLm

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 7 IoCs

pid	Process
1980	AWB.exe
1980	AWB.exe
1980	AWB.exe
1980	AWB.exe
1980	AWB.exe
1980	AWB.exe
1980	AWB.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eritas.fat	AWB.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1980	AWB.exe
3972	AWB.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 3972	1980	AWB.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AWB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AWB.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1980	AWB.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3972	1980	AWB.exe	94
PID 1980 wrote to memory of 3972	1980	AWB.exe	94
PID 1980 wrote to memory of 3972	1980	AWB.exe	94
PID 1980 wrote to memory of 3972	1980	AWB.exe	94
PID 1980 wrote to memory of 3972	1980	AWB.exe	94

C:\Users\Admin\AppData\Local\Temp\AWB.exe
"C:\Users\Admin\AppData\Local\Temp\AWB.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\AWB.exe
  "C:\Users\Admin\AppData\Local\Temp\AWB.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz7FAA.tmp\LangDLL.dll

Filesize
5KB

MD5
c5351b7c9aa48e9e7872288a3e7dd583

SHA1
69efcf341345625a4a855f03f2a9d9e8f50319b2

SHA256
982954ea90a10844bff23d595ac2449c6fae300aee2ab4c23077aac1197b7c2e

SHA512
6e655e02aa05bc52beec428686622c4c1c1ffc7e5aba0f6d429495cba29bee5733b26ac7aecbeaa9e525eae52706a2513035d17cc7b0ccbcf792c765c9427d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz7FAA.tmp\System.dll

Filesize
11KB

MD5
c61501f07cf09bcfcdfe4cc8a1ebbbe3

SHA1
e8581b4359651b857646ae727efaaef372daa0fc

SHA256
7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55

SHA512
9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24

Download Submit
memory/1980-29-0x0000000004A10000-0x000000000793B000-memory.dmp

Filesize
47.2MB

Download
memory/1980-30-0x0000000004A10000-0x000000000793B000-memory.dmp

Filesize
47.2MB

Download
memory/1980-31-0x0000000076FA1000-0x00000000770C1000-memory.dmp

Filesize
1.1MB

Download
memory/1980-32-0x0000000076FA1000-0x00000000770C1000-memory.dmp

Filesize
1.1MB

Download
memory/1980-33-0x0000000073BF5000-0x0000000073BF6000-memory.dmp

Filesize
4KB

Download
memory/1980-42-0x0000000004A10000-0x000000000793B000-memory.dmp

Filesize
47.2MB

Download
memory/3972-34-0x00000000016E0000-0x000000000460B000-memory.dmp

Filesize
47.2MB

Download
memory/3972-35-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/3972-36-0x00000000016E0000-0x000000000460B000-memory.dmp

Filesize
47.2MB

Download