guloader | 23aa67983111007b432bd4d2b55d78800fba7fe895f923e2b923153e50c10d28

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order#073.exe
Size

212KB
MD5

d6912e3cfb5a944107ab95ffbd9c60b0
SHA1

3c2a33f7f9c2eb50ce4cb4d31edbec5a99d14a90
SHA256

978097862e5a0a1051cf9edb9f6bb2c6399b48ed50bcfb93fc8930fae993f4b3
SHA512

346d7563f20c406ab973ef78ac88c7943e3c6ba88e22dbe99e92d5de4e229e06cbeaa6020c6295f95e9a339dcc066895144d5e3227cfc4589a06d280e923e9a1
SSDEEP

1536:aUR1Ted1IXc+nL76qk5GWGweW/+/XXFTy2gPZMp0wxHSPJ3BXlUgtWa3NMA/:fRled1QL76qlWQVlgBM1HSPH1Ya99/

Score

10^/10

guloader downloader guloader persistence

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=1cXTi1WNzcett61Pgnqcr5rFctey0JuUG

https://www.sendspace.com/pro/dl/jels8m

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Guloader payload 2 IoCs
guloader

Processes:

resource yara_rule

behavioral2/memory/372-2-0x0000000002200000-0x0000000002210000-memory.dmp family_guloader
behavioral2/memory/2880-4-0x0000000000D90000-0x0000000000E90000-memory.dmp family_guloader

resource	yara_rule
behavioral2/memory/372-2-0x0000000002200000-0x0000000002210000-memory.dmp	family_guloader
behavioral2/memory/2880-4-0x0000000000D90000-0x0000000000E90000-memory.dmp	family_guloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BUNDFLDEDE = "C:\\Users\\Admin\\HALV\\TARMREN.exe"	RegAsm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

7 drive.google.com
8 drive.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Order#073.exeRegAsm.exe

pid process

372 Order#073.exe
2880 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Order#073.exe

description pid process target process

PID 372 set thread context of 2880 372 Order#073.exe RegAsm.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Order#073.exe

pid process

372 Order#073.exe
372 Order#073.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Order#073.exe

pid process

372 Order#073.exe

flow	ioc
7	drive.google.com
8	drive.google.com

pid	process
372	Order#073.exe
2880	RegAsm.exe

description	pid	process	target process
PID 372 set thread context of 2880	372	Order#073.exe	RegAsm.exe

pid	process
372	Order#073.exe
372	Order#073.exe

pid	process
372	Order#073.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Order#073.exe

description	pid	process	target process
PID 372 wrote to memory of 4204	372	Order#073.exe	RegAsm.exe
PID 372 wrote to memory of 4204	372	Order#073.exe	RegAsm.exe
PID 372 wrote to memory of 4204	372	Order#073.exe	RegAsm.exe
PID 372 wrote to memory of 2880	372	Order#073.exe	RegAsm.exe
PID 372 wrote to memory of 2880	372	Order#073.exe	RegAsm.exe
PID 372 wrote to memory of 2880	372	Order#073.exe	RegAsm.exe
PID 372 wrote to memory of 2880	372	Order#073.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Order#073.exe
"C:\Users\Admin\AppData\Local\Temp\Order#073.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\Order#073.exe"
2⤵
PID:4204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\Order#073.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4332 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4056

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/372-2-0x0000000002200000-0x0000000002210000-memory.dmp

Filesize
64KB

Download
memory/372-3-0x0000000077871000-0x0000000077991000-memory.dmp

Filesize
1.1MB

Download
memory/372-19-0x0000000002200000-0x0000000002210000-memory.dmp

Filesize
64KB

Download
memory/372-20-0x0000000077871000-0x0000000077991000-memory.dmp

Filesize
1.1MB

Download
memory/372-21-0x0000000002200000-0x0000000002210000-memory.dmp

Filesize
64KB

Download
memory/2880-4-0x0000000000D90000-0x0000000000E90000-memory.dmp

Filesize
1024KB

Download
memory/2880-5-0x0000000077871000-0x0000000077991000-memory.dmp

Filesize
1.1MB

Download