guloader | 850f227ef098450656a0704b5507caba6bd1128de78ffc7ac037a4801716b497

General

Target

Bakir#.exe
Size

641KB
MD5

b973b8507af79f55cc863a7a592a41bd
SHA1

d53144ad185aa5587e674a459c782b508b8480fb
SHA256

1c13af8c86d902c0479b21327655caa1be826ac6129f03e61e093d6ec39b0fbe
SHA512

26bd2b1fd356a57919c7daae366bcac5091a56969a42295507e96bcd23ec208941952b94f45d2f20957baa3d23ca4c363b96d5adf93fe3771caff1a363846cd4
SSDEEP

6144:amOPe6H2QcxV+0M7dCy6WeZMnLqJTo+uMJXW30TtbLz3ZST70mw21NKl1+B/nSGc:WA+0MhCyteZMnGJ1uMJm30Jbn291YLWc

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 7 IoCs

pid	Process
2320	Bakir#.exe
2320	Bakir#.exe
2320	Bakir#.exe
2320	Bakir#.exe
2320	Bakir#.exe
2320	Bakir#.exe
2320	Bakir#.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2320	Bakir#.exe
2820	Bakir#.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 2820	2320	Bakir#.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bakir#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bakir#.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2320	Bakir#.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2820	2320	Bakir#.exe	31
PID 2320 wrote to memory of 2820	2320	Bakir#.exe	31
PID 2320 wrote to memory of 2820	2320	Bakir#.exe	31
PID 2320 wrote to memory of 2820	2320	Bakir#.exe	31
PID 2320 wrote to memory of 2820	2320	Bakir#.exe	31
PID 2320 wrote to memory of 2820	2320	Bakir#.exe	31

C:\Users\Admin\AppData\Local\Temp\Bakir#.exe
"C:\Users\Admin\AppData\Local\Temp\Bakir#.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\Bakir#.exe
  "C:\Users\Admin\AppData\Local\Temp\Bakir#.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdD75C.tmp\AdvSplash.dll

Filesize
6KB

MD5
e8b67a37fb41d54a7eda453309d45d97

SHA1
96be9bf7a988d9cea06150d57cd1de19f1fec19e

SHA256
2ad232bccf4ca06cf13475af87b510c5788aa790785fd50509be483afc0e0bcf

SHA512
20effae18eebb2df90d3186a281fa9233a97998f226f7adead0784fbc787feee419973962f8369d8822c1bbcdfb6e7948d9ca6086c9cf90190c8ab3ec97f4c38

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD75C.tmp\Banner.dll

Filesize
4KB

MD5
0d5428f7920274caedfa8f2ae980e196

SHA1
ce2ca2381a4b9ed9f06f6af5a183a840de290c3f

SHA256
4083bef584ad6793b3d57e3e3f764a31afac876412df65c5da5afee76bbd1e10

SHA512
78419752f3e6579f7caf1f9bab70a46ac2b0a7c5f08eb8604e927baea611c182133ce8d58929a059f22e6c2befb5ff0c24ee6500d0708bc884a65e395ea7c4cf

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD75C.tmp\LangDLL.dll

Filesize
5KB

MD5
376c1b784a3cca9d10ba4ca5d8cb55d2

SHA1
ad12f8ebab5b4b58eb7d5368469e82e2442b089f

SHA256
5bee24fef5c0f643adc7ee02ccb6e80a72a4eb30d9d326023ac03f0ffbc4e624

SHA512
6f02f0d878c228de114dee6b0df85152745b43893a252b2e9c309ba943ea56ab1ee678e42d9b0a89162e2bda627d396c2933c02e1c42d0169ac6e05ff3af4bbb

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD75C.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
memory/2320-45-0x0000000004230000-0x00000000067B4000-memory.dmp

Filesize
37.5MB

Download
memory/2320-46-0x00000000772A1000-0x00000000773A2000-memory.dmp

Filesize
1.0MB

Download
memory/2320-47-0x00000000772A0000-0x0000000077449000-memory.dmp

Filesize
1.7MB

Download
memory/2320-48-0x0000000004230000-0x00000000067B4000-memory.dmp

Filesize
37.5MB

Download
memory/2320-83-0x0000000004230000-0x00000000067B4000-memory.dmp

Filesize
37.5MB

Download
memory/2820-49-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2820-50-0x00000000772A0000-0x0000000077449000-memory.dmp

Filesize
1.7MB

Download
memory/2820-71-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing