guloader | 3dbd6b79ffab366c6725afc3d80ca01359e8ddd59694e4caab3be85b72abc4af

Analysis

max time kernel
17s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payroll List_pdf.exe
Size

831KB
MD5

a262509d9e7799ba517432a2468b826e
SHA1

d72c16f19686bf9afbb89347632eda3703396e90
SHA256

f229c284ec539c5ee4feaea921a24a06c900079b4e8cb4b0965bdbb9f2fcef18
SHA512

81fd20cad8f4a3ae4e4f3638b5242061968535d22032e7003288e59bbd7b0aebd719e39731345b2efbf2f2e66950735b05ae124b44d93a08660f6d0df6459c1a
SSDEEP

24576:JUjfV4MC3d0qTpv6IPX9ky5awvY/X6eR8Mw2:kWt3djZ6IPDRqBXn

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
640	Payroll List_pdf.exe
640	Payroll List_pdf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
4	drive.google.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\suppressionens.bin	Payroll List_pdf.exe
File opened for modification	C:\Windows\SysWOW64\quadrigae.jpg	Payroll List_pdf.exe
File opened for modification	C:\Windows\SysWOW64\Disarticulating.ini	Payroll List_pdf.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1860	Payroll List_pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
640	Payroll List_pdf.exe
1860	Payroll List_pdf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\dyppekogerens.ini	Payroll List_pdf.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\mechanicochemical.jpg	Payroll List_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payroll List_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payroll List_pdf.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
640	Payroll List_pdf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1860	640	Payroll List_pdf.exe	29
PID 640 wrote to memory of 1860	640	Payroll List_pdf.exe	29
PID 640 wrote to memory of 1860	640	Payroll List_pdf.exe	29
PID 640 wrote to memory of 1860	640	Payroll List_pdf.exe	29
PID 640 wrote to memory of 1860	640	Payroll List_pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\Payroll List_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payroll List_pdf.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\Payroll List_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payroll List_pdf.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\dyppekogerens.ini

Filesize
44B

MD5
6644a29c4fcb5c51650383ac2625163a

SHA1
75de5a6b73cd9bc47af952ad60679535cf768b27

SHA256
0d9e8205fb30192bec64aa7c4d7a0c9d98e469f6739aa321d3b85da16caa8abc

SHA512
2e6a476b3045a543a322332b2eb9d261002c3a278dc408b9eb5af3e4b136fe1b783c3091ce5edaaa7f3c8d2bffab714408bb23ae2e135cd034e1ff02ef36302a

Download Submit
\Users\Admin\AppData\Local\Temp\nsuE11E.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
memory/640-295-0x0000000076D90000-0x0000000076F39000-memory.dmp

Filesize
1.7MB

Download
memory/640-294-0x0000000076D91000-0x0000000076E92000-memory.dmp

Filesize
1.0MB

Download
memory/1860-296-0x0000000001510000-0x000000000537B000-memory.dmp

Filesize
62.4MB

Download
memory/1860-297-0x0000000076D90000-0x0000000076F39000-memory.dmp

Filesize
1.7MB

Download
memory/1860-319-0x00000000004A0000-0x0000000001502000-memory.dmp

Filesize
16.4MB

Download