guloader | 59c3c8cd9f4cf71654987b95564db2b56ab4dc16857bfb704cf45c32d31213ba

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe
Size

76KB
MD5

5b38f1c2c42a6fa5b8be200bac9ea9e3
SHA1

2c1658d44301145f62285054a48c98594796d31c
SHA256

59c3c8cd9f4cf71654987b95564db2b56ab4dc16857bfb704cf45c32d31213ba
SHA512

8afe9e86d00559355e505d3ad879f772fff3373e840bca91d969f665a1fd3474f04f2f4edb2eee2fcbdbbd0bb8338f6bc16520f3d63fbe2608b980424ddf626d
SSDEEP

1536:89KX78wbo2UG2Q2Qe1b47PhS9uggeLxHBwbo67:IKL8wbRUTb47PhS9uggGxHBwbV

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=15gcqQfg0ADpvE07SqoFtR4e6ThCU2nan

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Guloader payload 1 IoCs
guloader

Processes:

resource yara_rule

behavioral2/memory/3860-4-0x0000000000D00000-0x0000000000E00000-memory.dmp family_guloader
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

18 drive.google.com
19 drive.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exeRegAsm.exe

pid process

3428 5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe
3860 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe

description pid process target process

PID 3428 set thread context of 3860 3428 5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe

pid process

3428 5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe
3428 5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe

pid process

3428 5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/3860-4-0x0000000000D00000-0x0000000000E00000-memory.dmp	family_guloader

flow	ioc
18	drive.google.com
19	drive.google.com

pid	process
3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe
3860	RegAsm.exe

description	pid	process	target process
PID 3428 set thread context of 3860	3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe	RegAsm.exe

pid	process
3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe
3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe

pid	process
3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe

description	pid	process	target process
PID 3428 wrote to memory of 3996	3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe	RegAsm.exe
PID 3428 wrote to memory of 3996	3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe	RegAsm.exe
PID 3428 wrote to memory of 3996	3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe	RegAsm.exe
PID 3428 wrote to memory of 3860	3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe	RegAsm.exe
PID 3428 wrote to memory of 3860	3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe	RegAsm.exe
PID 3428 wrote to memory of 3860	3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe	RegAsm.exe
PID 3428 wrote to memory of 3860	3428	5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe"
2⤵
PID:3996

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\5b38f1c2c42a6fa5b8be200bac9ea9e3_JaffaCakes118.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3860

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3428-3-0x00000000773F1000-0x0000000077511000-memory.dmp

Filesize
1.1MB

Download
memory/3428-2-0x0000000002920000-0x0000000002929000-memory.dmp

Filesize
36KB

Download
memory/3428-14-0x0000000002920000-0x0000000002929000-memory.dmp

Filesize
36KB

Download
memory/3428-15-0x0000000002920000-0x0000000002929000-memory.dmp

Filesize
36KB

Download
memory/3860-4-0x0000000000D00000-0x0000000000E00000-memory.dmp

Filesize
1024KB

Download