guloader | a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a.exe
Size

624KB
MD5

f08d6545c74d5a429d8225885b81f55a
SHA1

f95b76f2d791105cd9c942c704fbf223d27892ad
SHA256

a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a
SHA512

325f87497a9994b4213eb14bde7e62aa586644a6eba0ef3323a095e4f1d4f43547e6f1363079df165a2c2ec39853ce22d4617eaa05676bd61ec745d852e92fc6
SSDEEP

12288:B/tGh4HqBbV0/tQv6o1xMKZoRmpfSJ9OI1rbIAPxEq:BQhW9/66mMK2kpaJdbpPxX

Score

10^/10

guloader discovery downloader execution

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4172	powershell.exe

Blocklisted process makes network request 9 IoCs

flow	pid	Process
23	4288	msiexec.exe
37	4288	msiexec.exe
38	4288	msiexec.exe
42	4288	msiexec.exe
43	4288	msiexec.exe
47	4288	msiexec.exe
48	4288	msiexec.exe
49	4288	msiexec.exe
50	4288	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4172	powershell.exe
4288	msiexec.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\solubilizes.ded	a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4172	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeIncreaseQuotaPrivilege	4172	powershell.exe
Token: SeSecurityPrivilege	4172	powershell.exe
Token: SeTakeOwnershipPrivilege	4172	powershell.exe
Token: SeLoadDriverPrivilege	4172	powershell.exe
Token: SeSystemProfilePrivilege	4172	powershell.exe
Token: SeSystemtimePrivilege	4172	powershell.exe
Token: SeProfSingleProcessPrivilege	4172	powershell.exe
Token: SeIncBasePriorityPrivilege	4172	powershell.exe
Token: SeCreatePagefilePrivilege	4172	powershell.exe
Token: SeBackupPrivilege	4172	powershell.exe
Token: SeRestorePrivilege	4172	powershell.exe
Token: SeShutdownPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeSystemEnvironmentPrivilege	4172	powershell.exe
Token: SeRemoteShutdownPrivilege	4172	powershell.exe
Token: SeUndockPrivilege	4172	powershell.exe
Token: SeManageVolumePrivilege	4172	powershell.exe
Token: 33	4172	powershell.exe
Token: 34	4172	powershell.exe
Token: 35	4172	powershell.exe
Token: 36	4172	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4172	4560	a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a.exe	86
PID 4560 wrote to memory of 4172	4560	a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a.exe	86
PID 4560 wrote to memory of 4172	4560	a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a.exe	86
PID 4172 wrote to memory of 4288	4172	powershell.exe	101
PID 4172 wrote to memory of 4288	4172	powershell.exe	101
PID 4172 wrote to memory of 4288	4172	powershell.exe	101
PID 4172 wrote to memory of 4288	4172	powershell.exe	101

C:\Users\Admin\AppData\Local\Temp\a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a.exe
"C:\Users\Admin\AppData\Local\Temp\a3c3fcc02a6ad19d388304f15f2b9661f46a24c2151e9e725db514e8a69c8f6a.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Phthalic=Get-Content -raw 'C:\Users\Admin\AppData\Local\dockers\fabriksguvlet\Crystalizer.Syn';$Medialises=$Phthalic.SubString(54841,3);.$Medialises($Phthalic)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\SysWOW64\msiexec.exe"
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxq31i4j.xrv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\dockers\fabriksguvlet\Crystalizer.Syn

Filesize
53KB

MD5
b6a2296e8b10cd624e538e4d115344d2

SHA1
a121b8415406491326ff8a15af93fc8b6c1657d9

SHA256
13b35482d6f13a556d05c3eb00235ccc32138ae94f7d3fe3917081c35adc7925

SHA512
ad216d5308e80a366f6c28ec7a676b187971199c4d8c15b1b7511528c78768d588fb445f86ea2520e930f018bb9b51153b2bd9f39951ff04118e2e68e8634815

Download Submit
C:\Users\Admin\AppData\Local\dockers\fabriksguvlet\Isbrydende.afr

Filesize
286KB

MD5
a1b94b654c739e207a77ad8005c85af0

SHA1
45f0f0c78c1311168d0d76f182170c910ff1370c

SHA256
1e32700523bba02e59560527d35c63d8abd04418a9434f5fbc5dd51e5dee3144

SHA512
3705019ec49cee8b68ef9535ee4290c00045a57a0da172e473fce805f4b1f016d063d4b6bd2ff58cf4b57d25b82530a623376069a4f34d9823f76ed1971202ef

Download Submit
memory/4172-38-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-65-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-14-0x0000000005900000-0x0000000005F28000-memory.dmp

Filesize
6.2MB

Download
memory/4172-17-0x0000000006110000-0x0000000006176000-memory.dmp

Filesize
408KB

Download
memory/4172-16-0x00000000060A0000-0x0000000006106000-memory.dmp

Filesize
408KB

Download
memory/4172-27-0x00000000061C0000-0x0000000006514000-memory.dmp

Filesize
3.3MB

Download
memory/4172-28-0x00000000067A0000-0x00000000067BE000-memory.dmp

Filesize
120KB

Download
memory/4172-29-0x00000000067E0000-0x000000000682C000-memory.dmp

Filesize
304KB

Download
memory/4172-32-0x0000000006D10000-0x0000000006D32000-memory.dmp

Filesize
136KB

Download
memory/4172-31-0x0000000006CB0000-0x0000000006CCA000-memory.dmp

Filesize
104KB

Download
memory/4172-30-0x0000000007850000-0x00000000078E6000-memory.dmp

Filesize
600KB

Download
memory/4172-33-0x0000000007EA0000-0x0000000008444000-memory.dmp

Filesize
5.6MB

Download
memory/4172-13-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-39-0x0000000070170000-0x00000000704C4000-memory.dmp

Filesize
3.3MB

Download
memory/4172-37-0x0000000070000000-0x000000007004C000-memory.dmp

Filesize
304KB

Download
memory/4172-49-0x0000000007C30000-0x0000000007C4E000-memory.dmp

Filesize
120KB

Download
memory/4172-50-0x0000000007C60000-0x0000000007D03000-memory.dmp

Filesize
652KB

Download
memory/4172-11-0x0000000073B8E000-0x0000000073B8F000-memory.dmp

Filesize
4KB

Download
memory/4172-51-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-15-0x0000000005790000-0x00000000057B2000-memory.dmp

Filesize
136KB

Download
memory/4172-35-0x0000000008AD0000-0x000000000914A000-memory.dmp

Filesize
6.5MB

Download
memory/4172-36-0x0000000007BF0000-0x0000000007C22000-memory.dmp

Filesize
200KB

Download
memory/4172-55-0x0000000007DD0000-0x0000000007DF4000-memory.dmp

Filesize
144KB

Download
memory/4172-54-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-53-0x0000000007DA0000-0x0000000007DCA000-memory.dmp

Filesize
168KB

Download
memory/4172-56-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-58-0x0000000073B8E000-0x0000000073B8F000-memory.dmp

Filesize
4KB

Download
memory/4172-59-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-60-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-12-0x00000000051D0000-0x0000000005206000-memory.dmp

Filesize
216KB

Download
memory/4172-62-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-63-0x0000000009150000-0x000000000A36C000-memory.dmp

Filesize
18.1MB

Download
memory/4172-64-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-52-0x0000000007D60000-0x0000000007D6A000-memory.dmp

Filesize
40KB

Download
memory/4172-66-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4172-67-0x0000000073B80000-0x0000000074330000-memory.dmp

Filesize
7.7MB

Download
memory/4288-68-0x0000000002240000-0x000000000345C000-memory.dmp

Filesize
18.1MB

Download
memory/4288-70-0x0000000002240000-0x000000000345C000-memory.dmp

Filesize
18.1MB

Download
memory/4288-69-0x0000000000FE0000-0x0000000002234000-memory.dmp

Filesize
18.3MB

Download