File name: | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a |
Full analysis: | https://app.any.run/tasks/144f2c9e-f2a1-4097-a93b-182e38d28169 |
Verdict: | Malicious activity |
Threats: | GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities. |
Analysis date: | January 10, 2025, 18:51:44 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections |
MD5: | ED6F1C14E085E4FBC7C47F894F2140B9 |
SHA1: | 1757C800B765345D51A261E11EBE1D89F05C4865 |
SHA256: | 815D6B508FAB5D16A8190A479FB4B72A3916D9AFE21393EEB506098CB1A93C3A |
SSDEEP: | 49152:atNtm2+bHSew2K1biOj7svipNibr7cmIPliQ/LEs510Uq+oNiQlnx6iIZYhCmsQ0:0N82eyrrIKCjcnPYQTEs51JfoNiQL6bB |
.exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (14.2) |
.exe | | | Win32 Executable (generic) (9.7) |
.exe | | | Generic Win/DOS Executable (4.3) |
.exe | | | DOS Executable Generic (4.3) |
OriginalFileName: | supraocular tailorizes.exe |
---|---|
LegalCopyright: | blindlandings |
InternalName: | supraocular tailorizes.exe |
FileVersion: | 1.5.0.0 |
FileDescription: | privatbil efterhaandsoplysning |
CompanyName: | mangler bronchia bedrevne |
Comments: | pleurosaurus obfuscates |
CharacterSet: | Windows, Latin1 |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 1.5.0.0 |
FileVersionNumber: | 1.5.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | 6 |
OSVersion: | 4 |
EntryPoint: | 0x34a5 |
UninitializedDataSize: | 2048 |
InitializedDataSize: | 141824 |
CodeSize: | 26112 |
LinkerVersion: | 6 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
TimeStamp: | 2018:12:15 22:24:36+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6164 | "C:\Users\admin\AppData\Local\Temp\815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe" | C:\Users\admin\AppData\Local\Temp\815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | explorer.exe | ||||||||||||
User: admin Company: mangler bronchia bedrevne Integrity Level: MEDIUM Description: privatbil efterhaandsoplysning Exit code: 0 Version: 1.5.0.0 Modules
| |||||||||||||||
6628 | "C:\Users\admin\AppData\Local\Temp\815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe" | C:\Users\admin\AppData\Local\Temp\815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | ||||||||||||
User: admin Company: mangler bronchia bedrevne Integrity Level: MEDIUM Description: privatbil efterhaandsoplysning Version: 1.5.0.0 Modules
| |||||||||||||||
2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (6164) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_CURRENT_USER\Stormskadeserstatninger\Uninstall\Trsteprmie\kartoflerne |
Operation: | write | Name: | trsteges |
Value: 0 | |||
(PID) Process: | (6164) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLI\Start |
Operation: | write | Name: | CLI start |
Value: 2 | |||
(PID) Process: | (6164) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Service |
Operation: | write | Name: | System_Check |
Value: kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5 | |||
(PID) Process: | (6164) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Service |
Operation: | write | Name: | System_Check |
Value: kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0) | |||
(PID) Process: | (6164) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Service |
Operation: | write | Name: | System_Check |
Value: kernel32::VirtualAlloc(i 0,i 25620480, i 0x3000, i 0x40)p.r2 | |||
(PID) Process: | (6164) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Service |
Operation: | write | Name: | System_Check |
Value: kernel32::ReadFile(i r5, i r2, i 25620480,*i 0, i 0) | |||
(PID) Process: | (6164) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Service |
Operation: | write | Name: | System_Check |
Value: user32::EnumWindows(i r2 ,i 0) | |||
(PID) Process: | (6628) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (6628) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
(PID) Process: | (6628) 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_252B35A0C9E78A87AECDDBB68FF7B1F0 | binary | |
MD5:C93D7B0121BCCF622E0024D991B336E4 | SHA256:7A6FB9A52C7BC6F8EFE1CE405C291819EF514B1745A9A5D3554C87CD4578BA48 | |||
6164 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\Local\Iw\Kbmandsskole.str | binary | |
MD5:4D1D72CFC5940B09DFBD7B65916F532E | SHA256:479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496 | |||
6164 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\Local\Iw\Senatsmdets.Uns | binary | |
MD5:34F265250B7ED15DC0990A62F24E4D46 | SHA256:ED4A13E1A9C95FCE5A54AB84B479D07F8900E58C6A4B4CE71D442FA3171F4FF4 | |||
6164 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\Local\Temp\nsw67B8.tmp\System.dll | executable | |
MD5:0D7AD4F45DC6F5AA87F606D0331C6901 | SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA | |||
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | binary | |
MD5:92B839135741069B05829B07B6F3F3FB | SHA256:4AE12FEDBB424DA1938E2BF5B343DC175D9CDAAFD4123715BE68DDA9BB2F18C5 | |||
6164 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\Local\Temp\nsf64E8.tmp | binary | |
MD5:C0586E009617EADA0D82E3C7809D4169 | SHA256:7A3A77EEC2C93A1792B7B2D3BE81E4E3A8296AC20798B163876B768480E8396F | |||
6164 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\Local\Iw\bolsjerne.Uds | binary | |
MD5:E6704DB94EBC651D67A06C37F49BE45B | SHA256:EB2552A216C6B17EDCD5C758F162A778047B8EB25F7927C48591FBE87F7EF21C | |||
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 | der | |
MD5:E935BC5762068CAF3E24A2683B1B8A88 | SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D | |||
6164 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\Local\Iw\Sensuousnesses.opk | binary | |
MD5:A4340182CDDD2EC1F1480360218343F9 | SHA256:B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3 | |||
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 | binary | |
MD5:5793DD6EF8CA42CC6BF12126BAF80361 | SHA256:84105632400E85384C45B57DC5BB124A411F534A3F4728EA028AC72CB5A5B942 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | GET | 200 | 216.58.206.67:80 | http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj | unknown | — | — | whitelisted |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | GET | 200 | 216.58.206.67:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | unknown | — | — | whitelisted |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | GET | 200 | 216.58.206.67:80 | http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0 | unknown | — | — | whitelisted |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | GET | 200 | 193.122.130.0:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | GET | 200 | 142.250.185.131:80 | http://c.pki.goog/r/r1.crl | unknown | — | — | whitelisted |
7020 | SIHClient.exe | GET | 200 | 23.37.237.227:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7020 | SIHClient.exe | GET | 200 | 23.37.237.227:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | GET | 200 | 193.122.130.0:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | GET | 200 | 193.122.130.0:80 | http://checkip.dyndns.org/ | unknown | — | — | malicious |
6544 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
936 | RUXIMICS.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5064 | SearchApp.exe | 2.16.204.139:443 | — | Akamai International B.V. | DE | unknown |
3996 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1176 | svchost.exe | 40.126.32.72:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1176 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1076 | svchost.exe | 23.35.238.131:443 | go.microsoft.com | AKAMAI-AS | DE | whitelisted |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | 172.217.23.110:443 | drive.google.com | GOOGLE | US | whitelisted |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | 216.58.206.67:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
6628 | 815d6b508fab5d16a8190a479fb4b72a3916d9afe21393eeb506098cb1a93c3a.exe | 142.250.185.131:80 | c.pki.goog | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
drive.google.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
c.pki.goog |
| whitelisted |
o.pki.goog |
| whitelisted |
drive.usercontent.google.com |
| whitelisted |
checkip.dyndns.org |
| shared |
PID | Process | Class | Message |
---|---|---|---|
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
— | — | Device Retrieving External IP Address Detected | ET INFO 404/Snake/Matiex Keylogger Style External IP Check |
— | — | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org) |
— | — | Misc activity | ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org) |
— | — | Misc activity | ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI |
— | — | Misc activity | SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram |
— | — | Misc activity | ET HUNTING Telegram API Certificate Observed |
— | — | Misc activity | ET HUNTING Telegram API Domain in DNS Lookup |