guloader | c54d46be1dd0d687d50db2940777c0cbcf31db55b7b8daec8a6921cb21661483

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO_#20202502.scr
Size

52KB
MD5

aa98858ca9f1521c29db264c52271758
SHA1

4ef7073f733fe78aa058f9a8cd8c460790b1c14f
SHA256

589839605568c90ecea1bcf14ce7a1076695fc5acf3e9111fb84702bb19af07f
SHA512

11b69c30a50112431c54ebbfda933cf61d54b1941f47e59af3cfc5d40727a6f0f499eb0111d9542e7922f8e910613530a95abc29ca1ab11bbe146efea2918813
SSDEEP

768:90B7O8pP/gNe4AYLVeCZ1fQRxrjqQY4XAXxi5H:90B68pP/mLLVeCZSB6xyH

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=1wVyC3O3_fEGjFDFp7iYa9vn_Wj-PUf7T

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Guloader payload 1 IoCs
guloader

Processes:

resource yara_rule

behavioral2/memory/1540-4-0x0000000000F00000-0x0000000001000000-memory.dmp family_guloader
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

19 drive.google.com
20 drive.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

PO_#20202502.scrRegAsm.exe

pid process

3044 PO_#20202502.scr
1540 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO_#20202502.scr

description pid process target process

PID 3044 set thread context of 1540 3044 PO_#20202502.scr RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

PO_#20202502.scr

pid process

3044 PO_#20202502.scr
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PO_#20202502.scr

pid process

3044 PO_#20202502.scr

resource	yara_rule
behavioral2/memory/1540-4-0x0000000000F00000-0x0000000001000000-memory.dmp	family_guloader

flow	ioc
19	drive.google.com
20	drive.google.com

pid	process
3044	PO_#20202502.scr
1540	RegAsm.exe

description	pid	process	target process
PID 3044 set thread context of 1540	3044	PO_#20202502.scr	RegAsm.exe

pid	process
3044	PO_#20202502.scr

pid	process
3044	PO_#20202502.scr

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PO_#20202502.scr

description	pid	process	target process
PID 3044 wrote to memory of 1540	3044	PO_#20202502.scr	RegAsm.exe
PID 3044 wrote to memory of 1540	3044	PO_#20202502.scr	RegAsm.exe
PID 3044 wrote to memory of 1540	3044	PO_#20202502.scr	RegAsm.exe
PID 3044 wrote to memory of 1540	3044	PO_#20202502.scr	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\PO_#20202502.scr
"C:\Users\Admin\AppData\Local\Temp\PO_#20202502.scr" /S
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\PO_#20202502.scr" /S
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-4-0x0000000000F00000-0x0000000001000000-memory.dmp

Filesize
1024KB

Download
memory/3044-2-0x00000000020E0000-0x00000000020E8000-memory.dmp

Filesize
32KB

Download
memory/3044-3-0x0000000077AB1000-0x0000000077BD1000-memory.dmp

Filesize
1.1MB

Download
memory/3044-14-0x00000000020E0000-0x00000000020E8000-memory.dmp

Filesize
32KB

Download