guloader | d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d

General

Target

d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe
Size

1011KB
MD5

e5fe1c0aabcf82525765543518b10947
SHA1

51327f7690a266384123b9f2eb4a51b97638f2dd
SHA256

d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d
SHA512

76f0b85daddeed0ef280bf5aeb6126bc0b5dfba9b01c99d5ae7f2f61eb371a2e8c42bed9d7e9bb7dcfcc1acf861a720856b541f6f56f35c2d9c800c42985c0a7
SSDEEP

24576:rkvVNzWWyMVtQSKkyt2Jfu+dUph4u+E83WB0N48cLpT15+G3:rmLFZVtQkyq2iUph4U83WBxZdpYu

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe
2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
4	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe
1548	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\bouts.ini	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Sharer.cam	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1548	2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe	31
PID 2428 wrote to memory of 1548	2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe	31
PID 2428 wrote to memory of 1548	2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe	31
PID 2428 wrote to memory of 1548	2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe	31
PID 2428 wrote to memory of 1548	2428	d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe	31

C:\Users\Admin\AppData\Local\Temp\d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe
"C:\Users\Admin\AppData\Local\Temp\d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe
  "C:\Users\Admin\AppData\Local\Temp\d30b99cefc552af16433fc29e1c02696677d8b2727677ed5fcac6465b419ad3d.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\bouts.ini

Filesize
34B

MD5
c5b6ed57c78f93e1200a2b7f05af4d89

SHA1
299326b64ab38fc50affed801b2959427e3b3853

SHA256
70e7c4f9534d3ef250f0e2ad5cd2b68fba8eccba9e7d311e0c2ed08e6f340d5f

SHA512
1895a78aa7c10c0642bbad00f82a5f869a1afa0581ff7d0e3fcd9070789c09d8bee216319ae3f5da5283bd9eb5c82fd8d1076f488f4ecd6b2b63e217f91b6a7e

Download Submit
C:\Users\Admin\skattekistes.lnk

Filesize
982B

MD5
d34dee511390a6920e9c809000c2f9a0

SHA1
f5ec757f180a3afbc8af4b10113ccf225ef45d9a

SHA256
229dd5ef2146250a76ca223a618b594703ebfb8599faef9773cd2fc71895d50b

SHA512
1ef38e356b9059ad4769d5a6f09f3b5e572a107ed4919ec328569d17e63a2aecf2d85fbe860bd7c396e8868d08f58c857997414da20679cd155d8a4ea7c5ad99

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB29F.tmp\System.dll

Filesize
11KB

MD5
ee260c45e97b62a5e42f17460d406068

SHA1
df35f6300a03c4d3d3bd69752574426296b78695

SHA256
e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27

SHA512
a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3

Download Submit
memory/1548-295-0x00000000014E0000-0x0000000004D31000-memory.dmp

Filesize
56.3MB

Download
memory/1548-296-0x0000000077B00000-0x0000000077CA9000-memory.dmp

Filesize
1.7MB

Download
memory/1548-317-0x0000000000470000-0x00000000014D2000-memory.dmp

Filesize
16.4MB

Download
memory/2428-293-0x0000000077B01000-0x0000000077C02000-memory.dmp

Filesize
1.0MB

Download
memory/2428-294-0x0000000077B00000-0x0000000077CA9000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing