guloader | ba7731b6dc348e539c3e92a30f7811579de525f4346b223430b0b668e68e30c0

General

Target

SecuriteInfo.com.VBA.Heur.Ursnif.2.F934D3F1.Gen.21585.20914.xls
Size

243KB
MD5

38dad5dbfc291ff10af3af06093e5a1f
SHA1

c98f1cb50a7e0980060e3d78aff5e7d2d1eb38cb
SHA256

ba7731b6dc348e539c3e92a30f7811579de525f4346b223430b0b668e68e30c0
SHA512

69b5a320e2bfd9b8abaab2aa9eea6ee60b0dd1cb069b7a8ecf1da80760b9c8f13f67846a59151b1fe59e95844c7a627715ae9e4cd6de551ab404973feaa122c7

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

ZJQBUZ.exe

pid process

892 ZJQBUZ.exe
Loads dropped DLL 5 IoCs

Processes:

EXCEL.EXE

pid process

1036 EXCEL.EXE
1036 EXCEL.EXE
1036 EXCEL.EXE
1036 EXCEL.EXE
1036 EXCEL.EXE
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
892	ZJQBUZ.exe

pid	process
1036	EXCEL.EXE
1036	EXCEL.EXE
1036	EXCEL.EXE
1036	EXCEL.EXE
1036	EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1036 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

1036 EXCEL.EXE
1036 EXCEL.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

EXCEL.EXEZJQBUZ.exe

pid process

1036 EXCEL.EXE
1036 EXCEL.EXE
1036 EXCEL.EXE
1036 EXCEL.EXE
1036 EXCEL.EXE
892 ZJQBUZ.exe

pid	process
1036	EXCEL.EXE

pid	process
1036	EXCEL.EXE
1036	EXCEL.EXE

pid	process
1036	EXCEL.EXE
1036	EXCEL.EXE
1036	EXCEL.EXE
1036	EXCEL.EXE
1036	EXCEL.EXE
892	ZJQBUZ.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 1036 wrote to memory of 892	1036	EXCEL.EXE	ZJQBUZ.exe
PID 1036 wrote to memory of 892	1036	EXCEL.EXE	ZJQBUZ.exe
PID 1036 wrote to memory of 892	1036	EXCEL.EXE	ZJQBUZ.exe
PID 1036 wrote to memory of 892	1036	EXCEL.EXE	ZJQBUZ.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.VBA.Heur.Ursnif.2.F934D3F1.Gen.21585.20914.xls
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZJQBUZ.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZJQBUZ.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZJQBUZ.exe
MD5
8c61dfe284002de5457d39b2b6104802

SHA1
a401b77c5794c671b640845f91d44f48605155eb

SHA256
c49cbd71b9503275f8cccc832408dc6fc5072b5a509cc6a5e18a973ec26eabe6

SHA512
3d3219a143d7ea90c2450e4ed5636e22c85b8f6d87aae0ed89282f963a8ed074f665f4dce54faee6cfd887bf073d94d6a49964aaa631216369af7b122a1a52a1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZJQBUZ.exe
MD5
8c61dfe284002de5457d39b2b6104802

SHA1
a401b77c5794c671b640845f91d44f48605155eb

SHA256
c49cbd71b9503275f8cccc832408dc6fc5072b5a509cc6a5e18a973ec26eabe6

SHA512
3d3219a143d7ea90c2450e4ed5636e22c85b8f6d87aae0ed89282f963a8ed074f665f4dce54faee6cfd887bf073d94d6a49964aaa631216369af7b122a1a52a1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZJQBUZ.exe
MD5
8c61dfe284002de5457d39b2b6104802

SHA1
a401b77c5794c671b640845f91d44f48605155eb

SHA256
c49cbd71b9503275f8cccc832408dc6fc5072b5a509cc6a5e18a973ec26eabe6

SHA512
3d3219a143d7ea90c2450e4ed5636e22c85b8f6d87aae0ed89282f963a8ed074f665f4dce54faee6cfd887bf073d94d6a49964aaa631216369af7b122a1a52a1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZJQBUZ.exe
MD5
8c61dfe284002de5457d39b2b6104802

SHA1
a401b77c5794c671b640845f91d44f48605155eb

SHA256
c49cbd71b9503275f8cccc832408dc6fc5072b5a509cc6a5e18a973ec26eabe6

SHA512
3d3219a143d7ea90c2450e4ed5636e22c85b8f6d87aae0ed89282f963a8ed074f665f4dce54faee6cfd887bf073d94d6a49964aaa631216369af7b122a1a52a1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZJQBUZ.exe
MD5
8c61dfe284002de5457d39b2b6104802

SHA1
a401b77c5794c671b640845f91d44f48605155eb

SHA256
c49cbd71b9503275f8cccc832408dc6fc5072b5a509cc6a5e18a973ec26eabe6

SHA512
3d3219a143d7ea90c2450e4ed5636e22c85b8f6d87aae0ed89282f963a8ed074f665f4dce54faee6cfd887bf073d94d6a49964aaa631216369af7b122a1a52a1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZJQBUZ.exe
MD5
8c61dfe284002de5457d39b2b6104802

SHA1
a401b77c5794c671b640845f91d44f48605155eb

SHA256
c49cbd71b9503275f8cccc832408dc6fc5072b5a509cc6a5e18a973ec26eabe6

SHA512
3d3219a143d7ea90c2450e4ed5636e22c85b8f6d87aae0ed89282f963a8ed074f665f4dce54faee6cfd887bf073d94d6a49964aaa631216369af7b122a1a52a1

Download Submit
memory/892-67-0x0000000000000000-mapping.dmp

Download
memory/892-71-0x0000000000240000-0x0000000000269000-memory.dmp

Filesize
164KB

Download
memory/1036-59-0x000000002FB31000-0x000000002FB34000-memory.dmp

Filesize
12KB

Download
memory/1036-60-0x00000000711A1000-0x00000000711A3000-memory.dmp

Filesize
8KB

Download
memory/1036-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing