guloader | 5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545

General

Target
_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
Size 942KB
Sample260618-gnc2nae19q
SHA256 5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545
MD5 4b27440dc8cb57d6b77632e6520af4c1
SHA1 f3ef3854aa7f344c46587b63c93c97d4bf63b9e5
SHA512 4149ecf5c59b89fec9e8e27a21448742955678f838ea695874d85f28dd75a28ea7fe0da9aba8bcbffa8a7f711790e3c873b79ba5131445a8e7b341fe3197430c
SSDEEP 24576:tn3ClvMI4qfv4Qv3K5ItTpT3KfSa2o1HOWfVvc:t3Cxhfv4Qv3qIzrKfz2o1uW90
TLSH
T1EA250181AA50C176D9A602B0DBEBFDF41167BC1FF8A1194B3AE1BEDA3D72160441718F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
4068	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5240	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4068	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
5240	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\initialers.ini	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\tagrygningernes\anthropomorphizing.ini	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
412	5240	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5240	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4068	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3824	4068	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe	81
PID 4068 wrote to memory of 5240	4068	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe	82
PID 4068 wrote to memory of 5240	4068	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe	82
PID 5240 wrote to memory of 5448	5240	_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe	83

C:\Users\Admin\AppData\Local\Temp\_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
"C:\Users\Admin\AppData\Local\Temp\_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
  "C:\Users\Admin\AppData\Local\Temp\_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe"
  2⤵
  PID:3824
- C:\Users\Admin\AppData\Local\Temp\_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
  "C:\Users\Admin\AppData\Local\Temp\_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5240
- - C:\Users\Admin\AppData\Local\Temp\_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
    "C:\Users\Admin\AppData\Local\Temp\_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe"
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 1604
    3⤵
    - Program crash
    PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5240 -ip 5240
1⤵
PID:488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiE62C.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4068-19-0x0000000004ED0000-0x00000000081B3000-memory.dmp

Download

memory/4068-20-0x0000000074305000-0x0000000074306000-memory.dmp

Download

memory/4068-22-0x0000000004ED0000-0x00000000081B3000-memory.dmp

Download

memory/5240-21-0x0000000000400000-0x0000000001717000-memory.dmp

Download

memory/5240-34-0x0000000000400000-0x0000000001717000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads