guloader | 7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe
Size

734KB
MD5

0c9009a01f16ae4f68f806f30fad5ed2
SHA1

c92ad48134ec43427462c3657cd229dd31e239df
SHA256

7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9
SHA512

d894bb452e05548a757bfbd8ddc0c3b55686690923ca01c58e68d399afe88d5d013076fcf83fcb51483e887373ad5bc76671998b3b738cd01c5752511a10db63
SSDEEP

12288:EI0YglGokRtZYxDuT5+tofxytZ4FbVjLfWJRuDnEFGuAY2eAuVLZEqhaH/e5rS++:EI0blXUEx4+ptZ4/WJAgHA8AuVLZEkLm

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 7 IoCs

Processes:

7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe

pid	Process
2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe
2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe
2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe
2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe
2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe
2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe
2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe

Drops file in System32 directory 1 IoCs

Processes:

7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eritas.fat	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2636	2360	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe

description	pid	Process	procid_target
PID 2360 wrote to memory of 2636	2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe	30
PID 2360 wrote to memory of 2636	2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe	30
PID 2360 wrote to memory of 2636	2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe	30
PID 2360 wrote to memory of 2636	2360	7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe	30

C:\Users\Admin\AppData\Local\Temp\7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe
"C:\Users\Admin\AppData\Local\Temp\7263a8930afb910d367c5e228694a8c291c8f797e87c082583bcb425fdc525c9.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 524
  2⤵
  - Program crash
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy8FF1.tmp\LangDLL.dll

Filesize
5KB

MD5
c5351b7c9aa48e9e7872288a3e7dd583

SHA1
69efcf341345625a4a855f03f2a9d9e8f50319b2

SHA256
982954ea90a10844bff23d595ac2449c6fae300aee2ab4c23077aac1197b7c2e

SHA512
6e655e02aa05bc52beec428686622c4c1c1ffc7e5aba0f6d429495cba29bee5733b26ac7aecbeaa9e525eae52706a2513035d17cc7b0ccbcf792c765c9427d7b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8FF1.tmp\System.dll

Filesize
11KB

MD5
c61501f07cf09bcfcdfe4cc8a1ebbbe3

SHA1
e8581b4359651b857646ae727efaaef372daa0fc

SHA256
7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55

SHA512
9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24

Download Submit
memory/2360-36-0x00000000038D0000-0x00000000067FB000-memory.dmp

Filesize
47.2MB

Download
memory/2360-37-0x00000000038D0000-0x00000000067FB000-memory.dmp

Filesize
47.2MB

Download
memory/2360-38-0x00000000038D0000-0x00000000067FB000-memory.dmp

Filesize
47.2MB

Download