Overview

overview

10

Static

static

981d483b80...e4.exe

windows7_x64

10

981d483b80...e4.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    22-04-2021 12:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    981d483b809a8d146115d1a1feb7bb8d588e014a0f009deb528662d39f5657e4.exe

  • Size

    156KB

  • MD5

    d5b8e2ce449917bf395454082de6cba9

  • SHA1

    fe872c03ceef39422218003bc5a34be4faf47e55

  • SHA256

    981d483b809a8d146115d1a1feb7bb8d588e014a0f009deb528662d39f5657e4

  • SHA512

    54dc37f2345a4b70786920c80adf8c1fc72c9ab97edf95b239453c081ab221134fbbc8ae8d8fd3ce635d4b3aec8f42fbc44005930e917e10e1a72cbd5e442e48

Score
10/10
guloaderdownloaderguloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Guloader Payload 3 IoCs
    guloader
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\981d483b809a8d146115d1a1feb7bb8d588e014a0f009deb528662d39f5657e4.exe
    "C:\Users\Admin\AppData\Local\Temp\981d483b809a8d146115d1a1feb7bb8d588e014a0f009deb528662d39f5657e4.exe"
    1⤵
    • Checks QEMU agent file
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\981d483b809a8d146115d1a1feb7bb8d588e014a0f009deb528662d39f5657e4.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1100-62-0x00000000002E0000-0x00000000002ED000-memory.dmp
    Filesize

    52KB

    Download
  • memory/1100-64-0x0000000075A31000-0x0000000075A33000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1360-65-0x0000000000D4CE5E-mapping.dmp
    Download
  • memory/1360-67-0x0000000000270000-0x0000000000370000-memory.dmp
    Filesize

    1024KB

    Download