guloader | 17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
Size

813KB
MD5

82f847d7438012fb7aaf92cf0dc2b640
SHA1

dea5f43c50f261ed5b36581d5c5d0d53d3956f6b
SHA256

17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10
SHA512

abdde907593c7c41b7980678fb4847f942212ebd20d93834e7933e1f01cb85cd0e2c7b01f393fd228d9409937ae374c767f794b8cf2a169aea08c33df4a82ac0
SSDEEP

24576:GT5ewakMlLQj9cFbRtjD6seSE94Zqq5uIum9:Ub9ajDVum9

Score

10^/10

guloader discovery downloader persistence upx

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Crink = "C:\\Users\\Admin\\AppData\\Roaming\\Indias\\Rootier.exe"	dxdiag.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
228	dxdiag.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
228	dxdiag.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 228	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	100

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/228-304-0x0000000000400000-0x00000000005E4000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Renegading59.Lau	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\meditance\solvens.uns	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
File opened for modification	C:\Windows\resources\styrthjelms.ini	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiag.exe

Suspicious behavior: MapViewOfSection 12 IoCs

pid	Process
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
228	dxdiag.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1540	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	86
PID 916 wrote to memory of 1540	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	86
PID 916 wrote to memory of 1540	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	86
PID 916 wrote to memory of 5024	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	87
PID 916 wrote to memory of 5024	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	87
PID 916 wrote to memory of 5024	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	87
PID 916 wrote to memory of 3672	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	88
PID 916 wrote to memory of 3672	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	88
PID 916 wrote to memory of 3672	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	88
PID 916 wrote to memory of 2304	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	89
PID 916 wrote to memory of 2304	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	89
PID 916 wrote to memory of 2304	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	89
PID 916 wrote to memory of 3620	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	90
PID 916 wrote to memory of 3620	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	90
PID 916 wrote to memory of 3620	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	90
PID 916 wrote to memory of 2516	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	91
PID 916 wrote to memory of 2516	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	91
PID 916 wrote to memory of 2516	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	91
PID 916 wrote to memory of 464	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	92
PID 916 wrote to memory of 464	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	92
PID 916 wrote to memory of 464	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	92
PID 916 wrote to memory of 3576	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	93
PID 916 wrote to memory of 3576	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	93
PID 916 wrote to memory of 3576	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	93
PID 916 wrote to memory of 2916	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	95
PID 916 wrote to memory of 2916	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	95
PID 916 wrote to memory of 2916	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	95
PID 916 wrote to memory of 1952	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	97
PID 916 wrote to memory of 1952	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	97
PID 916 wrote to memory of 1952	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	97
PID 916 wrote to memory of 1764	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	98
PID 916 wrote to memory of 1764	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	98
PID 916 wrote to memory of 1764	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	98
PID 916 wrote to memory of 228	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	100
PID 916 wrote to memory of 228	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	100
PID 916 wrote to memory of 228	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	100
PID 916 wrote to memory of 228	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	100
PID 916 wrote to memory of 228	916	17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe	100

C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe
"C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:1540
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:5024
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:3672
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:2516
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:464
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:3576
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:2916
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:1952
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\dxdiag.exe
  "C:\Users\Admin\AppData\Local\Temp\17726decabe2319d3a12e18ef362bea822b78a29719ccc7fbcc27298d8816f10N.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk857E.tmp\System.dll

Filesize
12KB

MD5
d968cb2b98b83c03a9f02dd9b8df97dc

SHA1
d784c9b7a92dce58a5038beb62a48ff509e166a0

SHA256
a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c

SHA512
2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e

Download Submit
C:\Windows\Resources\styrthjelms.ini

Filesize
57B

MD5
fd6025a4e37e613fc3b95c4b9dcde998

SHA1
bc9ece04e4a3ea27ed5f6249aa52cbc45d2cb1c3

SHA256
3370956ec8f0d20143598826298e97b6a07ebc7aba20becd4a7545e75847c7a8

SHA512
4c882c456b282b5d16a8257e4f00f26c83df390ac83675c030aceb244cbb44c4350e9c7902fa43613ecfbb1030a9c6ff96fcf4581d2519c23072954d107b36f3

Download Submit
memory/228-297-0x0000000001000000-0x00000000038F5000-memory.dmp

Filesize
41.0MB

Download
memory/228-299-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/228-303-0x0000000001000000-0x00000000038F5000-memory.dmp

Filesize
41.0MB

Download
memory/228-304-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/916-291-0x0000000005350000-0x0000000007C45000-memory.dmp

Filesize
41.0MB

Download
memory/916-292-0x0000000077CB1000-0x0000000077DD1000-memory.dmp

Filesize
1.1MB

Download
memory/916-293-0x0000000074905000-0x0000000074906000-memory.dmp

Filesize
4KB

Download
memory/916-294-0x0000000074900000-0x0000000074907000-memory.dmp

Filesize
28KB

Download
memory/916-295-0x0000000005350000-0x0000000007C45000-memory.dmp

Filesize
41.0MB

Download
memory/916-296-0x0000000005350000-0x0000000007C45000-memory.dmp

Filesize
41.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads