File name:

fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41

Full analysis: https://app.any.run/tasks/179a79d7-ce58-47b6-8768-a719641c8cac
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Analysis date: January 10, 2025, 21:43:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
guloader
loader
evasion
snake
keylogger
telegram
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

6A5B8C6057DFF681139FD609FFC6B21D

SHA1:

B37B7A2168980B4772978A640EBF5A02F41697E6

SHA256:

FA6B246130A460AA8915DB3F56FC3735F767A5950A12D71DC3A70C400682CC41

SSDEEP:

24576:tkuILYQzQ4tHX/khQ0GJLuu2sODFRrRrZQRDgQS6ZjwlxdD/g2CdaZqW7BNKTCS9:tPOYQzptHX/khQ0GJLuu2sODFRr9ZQRf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • GULOADER has been detected

      • fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe (PID: 936)
    • Steals credentials from Web Browsers

      • Bivejens.exe (PID: 5788)
    • SNAKEKEYLOGGER has been detected (SURICATA)

      • Bivejens.exe (PID: 5788)
    • Actions looks like stealing of personal data

      • Bivejens.exe (PID: 5788)
  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe (PID: 936)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7116)
    • Reads security settings of Internet Explorer

      • Bivejens.exe (PID: 5788)
    • Checks Windows Trust Settings

      • Bivejens.exe (PID: 5788)
    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 7116)
    • Checks for external IP

      • Bivejens.exe (PID: 5788)
      • svchost.exe (PID: 2192)
    • The process verifies whether the antivirus software is installed

      • Bivejens.exe (PID: 5788)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Bivejens.exe (PID: 5788)
  • INFO

    • Create files in a temporary directory

      • fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe (PID: 936)
    • The sample compiled with english language support

      • fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe (PID: 936)
      • powershell.exe (PID: 7116)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7116)
    • Reads the computer name

      • fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe (PID: 936)
    • The process uses the downloaded file

      • powershell.exe (PID: 7116)
    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7116)
    • Checks supported languages

      • fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe (PID: 936)
      • Bivejens.exe (PID: 5788)
    • The executable file from the user directory is run by the Powershell process

      • Bivejens.exe (PID: 5788)
    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7116)
    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 7116)
    • Reads the software policy settings

      • Bivejens.exe (PID: 5788)
    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 7116)
    • Creates files or folders in the user directory

      • Bivejens.exe (PID: 5788)
    • Checks proxy server information

      • Bivejens.exe (PID: 5788)
    • Reads the machine GUID from the registry

      • Bivejens.exe (PID: 5788)
    • Attempting to use instant messaging service

      • Bivejens.exe (PID: 5788)
      • svchost.exe (PID: 2192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

ProductName: bristly sublustrously frgende
LegalTrademarks: civilisationer markild goalless
LegalCopyright: dulcigenic asterix
FileVersion: 3.1.0.0
FileDescription: udstykningsplan uidentificerbares vrdipapircentralerne
CompanyName: alarmsystems
Comments: dusren barcarole sulcalize
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 3.1.0.0
FileVersionNumber: 3.1.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3359
UninitializedDataSize: 2048
InitializedDataSize: 141824
CodeSize: 25600
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2018:12:15 22:24:27+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GULOADER fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe no specs powershell.exe conhost.exe no specs #SNAKEKEYLOGGER bivejens.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
936"C:\Users\admin\AppData\Local\Temp\fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe" C:\Users\admin\AppData\Local\Temp\fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe
explorer.exe
User:
admin
Company:
alarmsystems
Integrity Level:
MEDIUM
Description:
udstykningsplan uidentificerbares vrdipapircentralerne
Exit code:
4294967295
Version:
3.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7116"powershell.exe" -windowstyle minimized "$Fuffy=Get-Content -Raw 'C:\Users\admin\AppData\Local\Temp\depersonaliseredes\Thalamiflorous.Tus209';$Antigenes=$Fuffy.SubString(5130,3);.$Antigenes($Fuffy)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5788"C:\Users\admin\AppData\Local\Temp\Bivejens.exe"C:\Users\admin\AppData\Local\Temp\Bivejens.exe
powershell.exe
User:
admin
Company:
alarmsystems
Integrity Level:
MEDIUM
Description:
udstykningsplan uidentificerbares vrdipapircentralerne
Version:
3.1.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\bivejens.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
9 539
Read events
9 522
Write events
17
Delete events
0

Modification events

(PID) Process:(936) fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exeKey:HKEY_CURRENT_USER\skurestriber\Absee
Operation:writeName:grandevous
Value:
%islandhood%\oveni\restaureredes.con
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5788) Bivejens.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Bivejens_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
1
Suspicious files
14
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7116powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nhg1apj4.wcy.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7116powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3lpy25y0.hyi.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
936fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exeC:\Users\admin\AppData\Local\Temp\depersonaliseredes\montricens.fusbinary
MD5:0B038FD9C23C723696185E52EBCCB874
SHA256:1E6B1012ABE05CD0B6409C6844E61C6314CF9EE5E04AF6E89352E09166C80B13
7116powershell.exeC:\Users\admin\AppData\Local\Temp\Bivejens.exeexecutable
MD5:6A5B8C6057DFF681139FD609FFC6B21D
SHA256:FA6B246130A460AA8915DB3F56FC3735F767A5950A12D71DC3A70C400682CC41
936fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exeC:\Users\admin\AppData\Local\Temp\depersonaliseredes\udsds.autbinary
MD5:152C1126D35B77FC957526436ADBEA38
SHA256:67780594962B62DD23C55340C9AB1CD11858C15F464E8EE312A690A1759EAFD3
936fa6b246130a460aa8915db3f56fc3735f767a5950a12d71dc3a70c400682cc41.exeC:\Users\admin\AppData\Local\Temp\depersonaliseredes\Fleece.karbinary
MD5:8A6A8A75FE9A08909B09C7242C1B0C73
SHA256:1AAD58A3F50A3EF4E50AFCECBAF81D840F4E3F0C512BCC5844A1AEC594A06FF7
5788Bivejens.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_8C0D12F01B5D981AACF8BFC375CA0F2Bbinary
MD5:273E853ECC801AD2A5B2B9B2B158076A
SHA256:B0EA2EE647CC760B34B5ED6B27C27C2D9DAA353859B1CC64B881EA0B5EB7E093
5788Bivejens.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:E935BC5762068CAF3E24A2683B1B8A88
SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D
5788Bivejens.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_252B35A0C9E78A87AECDDBB68FF7B1F0binary
MD5:A5B96D7D49CF49BF29A6B67A3BAE7DF3
SHA256:445BE4087FF1D9B6DC1B9E64D2243E18278F662586BDB9E5C4C1CCF7FC1E448A
7116powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:5F62DFB53E47D6CD6715ABE772A855F8
SHA256:C327736DF96A1BC7AC8A64CFC9935A7665EE601ACCC469BAB24E3822FA7AEFC0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
41
DNS requests
27
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4512
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
2356
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
2356
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5788
Bivejens.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
whitelisted
5788
Bivejens.exe
GET
200
172.217.16.195:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0
unknown
whitelisted
6240
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
5788
Bivejens.exe
GET
200
172.217.16.195:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
2356
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2356
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
1176
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.37.237.227
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.75
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.4
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
drive.google.com
  • 142.250.185.110
whitelisted
ocsp.pki.goog
  • 172.217.16.195
whitelisted

Threats

PID
Process
Class
Message
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
No debug info