guloader | bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
Size

399KB
MD5

86ab45f914a047213012a783615a54fa
SHA1

42166d9321e30e79c33583e77a0d3de67e6142f2
SHA256

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527
SHA512

cbb6a1ccb8c4e28c8ea22c2ad881b7ef8c243c8e6f3abd5fc818d080a6b4417fb0ac5f412d488e46865fd5fe5db64e83b70c965e28fb65df9ac03696ee240a1f
SSDEEP

6144:bVGdx6xuO1TzGL7Bq0XtpZ+lsMA2Usp58ie1VvfpK70qkmXkbgn3/2tw7:ht1TzGLFtXtKxxEr1xg70ZEkbM3/2tw7

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 4 IoCs

Processes:

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

pid	process
2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exebb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

pid process

2160 bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
876 bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

description	pid	process	target process
PID 2160 set thread context of 876	2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

Drops file in Windows directory 1 IoCs

Processes:

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

description ioc process

File opened for modification C:\Windows\Sjavs.ini bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

pid process

2160 bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

description	ioc	process
File opened for modification	C:\Windows\Sjavs.ini	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

description	pid	process	target process
PID 2160 wrote to memory of 876	2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
PID 2160 wrote to memory of 876	2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
PID 2160 wrote to memory of 876	2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
PID 2160 wrote to memory of 876	2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
PID 2160 wrote to memory of 876	2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
PID 2160 wrote to memory of 876	2160	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe	bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe

C:\Users\Admin\AppData\Local\Temp\bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
"C:\Users\Admin\AppData\Local\Temp\bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2160

C:\Users\Admin\AppData\Local\Temp\bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe
"C:\Users\Admin\AppData\Local\Temp\bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:876

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy7179.tmp\BgImage.dll
Filesize
7KB

MD5
e9f3051a79f12aed819b91f028a463c1

SHA1
d088868584cdc04d391ec27cd318034a5ce562bc

SHA256
91b8073e8e67945e14fb10963fc9101fae8c298bd4cd7080b4e47b5bdd4af85c

SHA512
eac1fb48403959dc8a5ed20d8ced83c2276c510a781191c9f850bd3a9214c10c8ae0a4d9159dc3bb08f9686bc62f25dd31cccdcc48f568cc8678012333afe894

Download Submit
\Users\Admin\AppData\Local\Temp\nsy7179.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
\Users\Admin\AppData\Local\Temp\nsy7179.tmp\UserInfo.dll
Filesize
4KB

MD5
a6f622a2f12ac10bca04e23deff5cada

SHA1
abf851b5ccfb64004e9b49718a467bd754545887

SHA256
b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500

SHA512
35c8b0db179104e638f1b40f3f8038a41fdc327e112de5cb0dbb97cbf1dfa276fcf6400fcb46b88cb5ba233ca769becbdb4b4d40920adca831e3c0f38193c50f

Download Submit
memory/876-38-0x00000000004A0000-0x0000000001502000-memory.dmp

Filesize
16.4MB

Download
memory/2160-34-0x0000000003320000-0x0000000005D09000-memory.dmp

Filesize
41.9MB

Download
memory/2160-35-0x0000000003320000-0x0000000005D09000-memory.dmp

Filesize
41.9MB

Download
memory/2160-36-0x0000000077521000-0x0000000077622000-memory.dmp

Filesize
1.0MB

Download
memory/2160-37-0x0000000077520000-0x00000000776C9000-memory.dmp

Filesize
1.7MB

Download
memory/2160-43-0x0000000003320000-0x0000000005D09000-memory.dmp

Filesize
41.9MB

Download