guloader | 5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96

General

Target
5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe
Size 332KB
Sample260727-gchsrswdne
SHA256 5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96
MD5 530fa7cf76659139fd50a9dfe19a88b2
SHA1 51658f25522df4e2cdb94a54e3ffcc6c41d7e3d0
SHA512 3f12a02f2147f63158a1a1e8098a93ce4cb28eec16ec9d7e4e765152a9d7be24686c6e571dcbb3ba967650e175dc7abc7e83374cc8d92196a6a597a44cdccfad
SSDEEP 6144:ffY+onfH95NB2BKuIDFBG3oDF9OzqbwyQWl2iqZ193tvP5NR70aX1:ffYbH95NBs9Im3E9gq2Wl9qVN57TF
TLSH
T15C742212B340C456DAB142302CB785B1DEBE69AD52898B4B9760FF093FF1745AE5F2A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
1808	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1808	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe
1180	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Tilfredshedens\Haandvrksmssig241.ini	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Egenkapitalerne210\ankerkden.ini	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe
File opened for modification	C:\Windows\Fonts\disfurnished.jpg	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1808	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3740	1808	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe	90
PID 1808 wrote to memory of 1180	1808	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe	91
PID 1808 wrote to memory of 1180	1808	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe	91
PID 1180 wrote to memory of 616	1180	5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe	92

C:\Users\Admin\AppData\Local\Temp\5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe
"C:\Users\Admin\AppData\Local\Temp\5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe
  "C:\Users\Admin\AppData\Local\Temp\5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe"
  2⤵
  PID:3740
- C:\Users\Admin\AppData\Local\Temp\5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe
  "C:\Users\Admin\AppData\Local\Temp\5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe
    "C:\Users\Admin\AppData\Local\Temp\5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96.exe"
    3⤵
    PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nszBFEC.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sprhager.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Sprhager.lnk
Size 824B
SHA256 1981d8dcc3f97f3fe00a881ac860d5f02075725cd40464dce39ba516323e18e2
MD5 f4a76216ce6801b76b62286790302aa0
SHA1 09f912cc786532329d72995a7d711adf0e49d81b
SHA512 ebc5d6ca2b4b4e3853ebf8426c7f113ab6eeb67ec859ce7c1f96908041361d5ea9dabaa9630939c43a90f58ec6eed92eb7931bc5400da3f3e8a993fcc9d56899
TLSH
T14301F6185BF52B24E7F68B3650B76611CA3A3C57EEA11F0C004692C415F6B52EEA4F2F
MD5 SHA1 SHA512 TLSH

Submit Download

afguderis.ini

Path C:\Users\Admin\AppData\Roaming\afguderis.ini
Size 41B
SHA256 25d1519ce061d78b9a749ffe8a1f88e6b16993f06020a3ce441e199172ade9be
MD5 6ae8e20365be70290a0f5e7aabd25154
SHA1 88ff2f97d6e1fe2cdd1178745f7a9880fbf5ddd7
SHA512 ca8490f288ce18a33fb00578c8cba89acb64de434bf76a7cc76194cd365572eb7cacc1e5f0cbd1042f3920e97ceff6a6525601945bd0616c7bacc477495e626e
MD5 SHA1 SHA512

Submit Download

memory/1180-35-0x0000000001780000-0x00000000040DD000-memory.dmp

Download

memory/1180-36-0x0000000000490000-0x0000000001776000-memory.dmp

Download

memory/1180-37-0x0000000001780000-0x00000000040DD000-memory.dmp

Download

memory/1808-33-0x0000000005110000-0x0000000007A6D000-memory.dmp

Download

memory/1808-34-0x0000000074605000-0x0000000074606000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads