guloader | 559027c9d5837bad9dec04bd294ec56e41e82b4bacc958fa2f9b03aa5a1a3215

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EMBARGO_021217447696270869286003_78519527942036422_5062060_291813391023562_4244700155139402815.exe
Size

497KB
MD5

0c9bc230ec8e4a8078d28dd6a768e63c
SHA1

d9b13ba7230952003ee0d3ef5629a17c021aedbe
SHA256

ca4f6c4fef54ec3c95a2acb358032846a1764d4561ffa6e90ec310a9dc12f043
SHA512

20961f822a4fa97b8b7a8232390a453a9c9a83cb7634052f4c294295a8d346d5fbf2fba3fef2b290a2887fd917ea030dc2cb437cb8ef3325de7fc359f409f973
SSDEEP

3072:LbG7N2kDTHUpoucLuXoblOng5JrelbAPVto+mjoledeR/rVWfvWVKqQ1mGAjKnPW:LbE/HU05B+fA9mqBrIfvs+AmnAazk/

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
3672	EMBARGO_021217447696270869286003_78519527942036422_5062060_291813391023562_4244700155139402815.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMBARGO_021217447696270869286003_78519527942036422_5062060_291813391023562_4244700155139402815.exe

C:\Users\Admin\AppData\Local\Temp\EMBARGO_021217447696270869286003_78519527942036422_5062060_291813391023562_4244700155139402815.exe
"C:\Users\Admin\AppData\Local\Temp\EMBARGO_021217447696270869286003_78519527942036422_5062060_291813391023562_4244700155139402815.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Embellishing193.ini

Filesize
42B

MD5
7bebf1c3a3126984eb2f1c0f33b849a9

SHA1
e994a2eafc4f5bfe983ffa4ef1eccc3bec43ca5a

SHA256
e0feaa8a104a32e68bc5fc0842815c9bb4934450b634b8e4de527041376d0a6e

SHA512
9c138f36421a94f6875a54772e1021c33b1e34f24108f7250cc2d7a982ae9571560c8d98e8a10728bc85ca2850ef6325b54ba9896ee90b4425ac5e18b9c00134

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu851F.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/3672-319-0x0000000002AB0000-0x0000000002BB0000-memory.dmp

Filesize
1024KB

Download
memory/3672-320-0x0000000002AB0000-0x0000000002BB0000-memory.dmp

Filesize
1024KB

Download