guloader | a52f4772ff09ea508aa2d77a24d40c34589210e540c44c9a4413667461bf9281

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3d17dc75f339dcc75cc86d5dd8ad5996.exe
Size

120KB
MD5

3d17dc75f339dcc75cc86d5dd8ad5996
SHA1

74226e5179f2d985dfaf280db7abeca08bfccda4
SHA256

a52f4772ff09ea508aa2d77a24d40c34589210e540c44c9a4413667461bf9281
SHA512

72400df7abe7c192b6c63e88e5aa16db2ab77fddc2c707139eed7f998b659b26855a516ba3cbfbca5fb7976789fa7c167d113b3ba9cd8f7b00153fba890d6c1a
SSDEEP

1536:g4n5FsLk+kbEiJt7lxRCuK3LZp13V+7RXwL0JyEr5D:JsLhkYAi3LZpD+BKgb5

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d17dc75f339dcc75cc86d5dd8ad5996.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
828	JaffaCakes118_3d17dc75f339dcc75cc86d5dd8ad5996.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d17dc75f339dcc75cc86d5dd8ad5996.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d17dc75f339dcc75cc86d5dd8ad5996.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-2-0x00000000024E0000-0x00000000024F1000-memory.dmp

Filesize
68KB

Download