guloader | 56042f13c376561a18bbb07d01512e3178cb44ff3be70e7d0814a19d0549cfbb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 12:51

Target

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
Size

112KB
MD5

a0bad57e9f99b74bf3aa862ec8d792fd
SHA1

54b8320cbbfc3ef22bf2641731c39c2efedcf112
SHA256

56042f13c376561a18bbb07d01512e3178cb44ff3be70e7d0814a19d0549cfbb
SHA512

5a185c307e03632bb63c8f88eca32d8c2907dfc15f32f09a122fd0dd1b688448a9bfa17a5013845b0f2610b6f5f3df51cae565b4b36e0aae62b33047133c4a65
SSDEEP

1536:LxIsaRSTBlzHPtipUv+2frPAX77RhC9ipRz33EYod:t8ROlrjrs7OIRj3od

Score

10^/10

Family

guloader

http://fblottery.net/me_encrypted_18567E0.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Guloader payload 1 IoCs
guloader

Processes:

resource yara_rule

behavioral2/memory/3176-4-0x0000000001100000-0x0000000001200000-memory.dmp family_guloader
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exeRegAsm.exe

pid process

968 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
3176 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

description pid process target process

PID 968 set thread context of 3176 968 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

pid process

968 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

pid process

968 a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/3176-4-0x0000000001100000-0x0000000001200000-memory.dmp	family_guloader

pid	process
968	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe
3176	RegAsm.exe

description	pid	process	target process
PID 968 set thread context of 3176	968	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe

pid	process
968	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

pid	process
968	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe

description	pid	process	target process
PID 968 wrote to memory of 3176	968	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 968 wrote to memory of 3176	968	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 968 wrote to memory of 3176	968	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe
PID 968 wrote to memory of 3176	968	a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\a0bad57e9f99b74bf3aa862ec8d792fd_JaffaCakes118.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3176

memory/968-2-0x00000000020F0000-0x00000000020F8000-memory.dmp

Filesize
32KB

Download
memory/968-3-0x0000000077861000-0x0000000077981000-memory.dmp

Filesize
1.1MB

Download
memory/968-6-0x00000000020F0000-0x00000000020F8000-memory.dmp

Filesize
32KB

Download
memory/3176-4-0x0000000001100000-0x0000000001200000-memory.dmp

Filesize
1024KB

Download
memory/3176-5-0x0000000077861000-0x0000000077981000-memory.dmp

Filesize
1.1MB

Download