guloader | 6d6e36eaf29e38080d45637d42af428e2cccb9b7e47129c6c70ae84dc7db6489

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
Size

76KB
MD5

7e7fabb1faa04e24a0c3471c60203ec7
SHA1

eba626b2199a3fc7256bf09dba9a72ad2b277959
SHA256

6d6e36eaf29e38080d45637d42af428e2cccb9b7e47129c6c70ae84dc7db6489
SHA512

f2576f40214f24f983c9675dd52f1451976fc602c195db6d84f33fb5ee30e5835c740af65194b7600b89f96950f9efe79933498dd1487d29bb9a5ff0fa6fbeb4
SSDEEP

1536:p4/YORBpLjjoSXffIVA7Z130GAlG/YORBpLjjoSXff:CQORjjoSYVA7zkGAlGQORjjoS

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=14fiYTuh9XFnx8VPpsFqaVqLQKYS82Ur5

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Guloader payload 1 IoCs
guloader

Processes:

resource yara_rule

behavioral2/memory/2032-4-0x0000000000D00000-0x0000000000E00000-memory.dmp family_guloader
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

16 drive.google.com
15 drive.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exeRegAsm.exe

pid process

1344 7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
2032 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe

description pid process target process

PID 1344 set thread context of 2032 1344 7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe

pid process

1344 7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
1344 7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
1344 7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe

pid process

1344 7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/2032-4-0x0000000000D00000-0x0000000000E00000-memory.dmp	family_guloader

flow	ioc
16	drive.google.com
15	drive.google.com

pid	process
1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
2032	RegAsm.exe

description	pid	process	target process
PID 1344 set thread context of 2032	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe

pid	process
1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe

pid	process
1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe

description	pid	process	target process
PID 1344 wrote to memory of 828	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 828	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 828	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 4016	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 4016	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 4016	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 2032	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 2032	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 2032	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe
PID 1344 wrote to memory of 2032	1344	7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe"
2⤵
PID:828

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe"
2⤵
PID:4016

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\7e7fabb1faa04e24a0c3471c60203ec7_JaffaCakes118.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2032

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-2-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download
memory/1344-3-0x0000000077E01000-0x0000000077F21000-memory.dmp

Filesize
1.1MB

Download
memory/1344-14-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download
memory/1344-15-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download
memory/2032-4-0x0000000000D00000-0x0000000000E00000-memory.dmp

Filesize
1024KB

Download