guloader | b17609b7cf880aa1baf7df58685c8dc2e5609e5eccc0699e13163a6b712e155b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe
Size

100KB
MD5

59fcf7b5ccb0d1ffa8bad8bff4254fcc
SHA1

460211f872351b7550c73a2a1f6362422f43b794
SHA256

b17609b7cf880aa1baf7df58685c8dc2e5609e5eccc0699e13163a6b712e155b
SHA512

403dbad3d5d66cd565b9bbdd96766748a628fa75c1649730789cb084a261ddb25018355940a07931daaf22ccd9093dad21f73a66166190b39e92d9592bcb6d3c
SSDEEP

768:W8t0MTQprGjsaWrTGUV3+0/P8Hm2wB/D6u3mYhOrFQ0AN+MXNw:j01VqszTGUV3+0mcx3NQ+03MC

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=1CcmHMNCuxj_nXaHB3j9KegXULq56dRSd

http://marckasgfdvc.ug/disabler_encrypted_F9BD38F.bin

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Guloader payload 1 IoCs
guloader

Processes:

resource yara_rule

behavioral2/memory/5020-4-0x0000000001030000-0x0000000001130000-memory.dmp family_guloader
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 drive.google.com
3 drive.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exeRegAsm.exe

pid process

4752 59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe
5020 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe

description pid process target process

PID 4752 set thread context of 5020 4752 59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe

pid process

4752 59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe
4752 59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe

pid process

4752 59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/5020-4-0x0000000001030000-0x0000000001130000-memory.dmp	family_guloader

flow	ioc
5	drive.google.com
3	drive.google.com

pid	process
4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe
5020	RegAsm.exe

description	pid	process	target process
PID 4752 set thread context of 5020	4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe	RegAsm.exe

pid	process
4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe
4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe

pid	process
4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe

description	pid	process	target process
PID 4752 wrote to memory of 4576	4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe	RegAsm.exe
PID 4752 wrote to memory of 4576	4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe	RegAsm.exe
PID 4752 wrote to memory of 4576	4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe	RegAsm.exe
PID 4752 wrote to memory of 5020	4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe	RegAsm.exe
PID 4752 wrote to memory of 5020	4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe	RegAsm.exe
PID 4752 wrote to memory of 5020	4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe	RegAsm.exe
PID 4752 wrote to memory of 5020	4752	59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe"
2⤵
PID:4576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\59fcf7b5ccb0d1ffa8bad8bff4254fcc_JaffaCakes118.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-2-0x0000000002140000-0x0000000002150000-memory.dmp

Filesize
64KB

Download
memory/4752-3-0x0000000077461000-0x0000000077581000-memory.dmp

Filesize
1.1MB

Download
memory/4752-17-0x0000000002140000-0x0000000002150000-memory.dmp

Filesize
64KB

Download
memory/4752-19-0x0000000002140000-0x0000000002150000-memory.dmp

Filesize
64KB

Download
memory/5020-4-0x0000000001030000-0x0000000001130000-memory.dmp

Filesize
1024KB

Download
memory/5020-5-0x0000000077461000-0x0000000077581000-memory.dmp

Filesize
1.1MB

Download
memory/5020-18-0x0000000001030000-0x0000000001130000-memory.dmp

Filesize
1024KB

Download