guloader | eb2c1dbb06ff18a2d69cc9ad183271137cc5f232ee27e1d79563484276a22470

Analysis

max time kernel
94s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Facturas Pagadas al VencimientoPDF.exe
Size

318KB
MD5

342d0c130289f5941de534c01a13ed75
SHA1

18d64bf2b72eaf0d90734fc34dcb747b7547b593
SHA256

3ba4a5f488ad5a0c682e896a01a1ff8965da8e274a4fb108a058299cc9246b40
SHA512

2f3c8ad5ceebccd2b8529d660dbedc86b70423b993cba80c742a91e57f648cce9dd4d20189d2021993fe52899027a842d28515378d034d29ad1844f7877bd0b8
SSDEEP

6144:z1kal0PZVheNA+ff0314vWXl6lh9ljpl3wz2QmKS0OJ:z14nhe2eImvIl6PK2jdJ

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
5060	Facturas Pagadas al VencimientoPDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Facturas Pagadas al VencimientoPDF.exe

C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al VencimientoPDF.exe
"C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al VencimientoPDF.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsaAD29.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
memory/5060-36-0x0000000004A50000-0x0000000004B51000-memory.dmp

Filesize
1.0MB

Download
memory/5060-37-0x0000000004A50000-0x0000000004B51000-memory.dmp

Filesize
1.0MB

Download