guloader | d11342ce9c7550e129e455126cb6373145ea86ae5ee777a652205541ef4cec2c

General

Target

4aeb49bf7e23aab664de914df204664f.exe
Size

120KB
MD5

4aeb49bf7e23aab664de914df204664f
SHA1

a9a80ec2e9ea803aa8db80aac266826304916dbf
SHA256

d11342ce9c7550e129e455126cb6373145ea86ae5ee777a652205541ef4cec2c
SHA512

494bb1b3b713ca9592568dc58b27696f64b727dbdcd03f646f3a57235ffbe5a6ffde659bcef7fa13b7ebd854fd67ba8dd5fb0e23c1bcbf2d661896ebc23bf57e

Score

10^/10

guloader neshta downloader persistence spyware stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

4aeb49bf7e23aab664de914df204664f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	4aeb49bf7e23aab664de914df204664f.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

pid process

4168 4aeb49bf7e23aab664de914df204664f.exe
Checks QEMU agent file 2 TTPs 1 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry
T1012

System Information Discovery
T1082

Processes:

4aeb49bf7e23aab664de914df204664f.exe

description ioc process

File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 4aeb49bf7e23aab664de914df204664f.exe
Loads dropped DLL 1 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

pid process

4364 4aeb49bf7e23aab664de914df204664f.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

pid process

4168 4aeb49bf7e23aab664de914df204664f.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

description pid process target process

PID 4168 set thread context of 4364 4168 4aeb49bf7e23aab664de914df204664f.exe 4aeb49bf7e23aab664de914df204664f.exe

pid	process
4168	4aeb49bf7e23aab664de914df204664f.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	4aeb49bf7e23aab664de914df204664f.exe

pid	process
4364	4aeb49bf7e23aab664de914df204664f.exe

pid	process
4168	4aeb49bf7e23aab664de914df204664f.exe

description	pid	process	target process
PID 4168 set thread context of 4364	4168	4aeb49bf7e23aab664de914df204664f.exe	4aeb49bf7e23aab664de914df204664f.exe

Drops file in Program Files directory 53 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	4aeb49bf7e23aab664de914df204664f.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	4aeb49bf7e23aab664de914df204664f.exe

Drops file in Windows directory 1 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

description ioc process

File opened for modification C:\Windows\svchost.com 4aeb49bf7e23aab664de914df204664f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	4aeb49bf7e23aab664de914df204664f.exe

Modifies registry class 1 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	4aeb49bf7e23aab664de914df204664f.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

pid process

4168 4aeb49bf7e23aab664de914df204664f.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe

pid process

4168 4aeb49bf7e23aab664de914df204664f.exe

pid	process
4168	4aeb49bf7e23aab664de914df204664f.exe

pid	process
4168	4aeb49bf7e23aab664de914df204664f.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

4aeb49bf7e23aab664de914df204664f.exe4aeb49bf7e23aab664de914df204664f.exe

description	pid	process	target process
PID 3644 wrote to memory of 4168	3644	4aeb49bf7e23aab664de914df204664f.exe	4aeb49bf7e23aab664de914df204664f.exe
PID 3644 wrote to memory of 4168	3644	4aeb49bf7e23aab664de914df204664f.exe	4aeb49bf7e23aab664de914df204664f.exe
PID 3644 wrote to memory of 4168	3644	4aeb49bf7e23aab664de914df204664f.exe	4aeb49bf7e23aab664de914df204664f.exe
PID 4168 wrote to memory of 4364	4168	4aeb49bf7e23aab664de914df204664f.exe	4aeb49bf7e23aab664de914df204664f.exe
PID 4168 wrote to memory of 4364	4168	4aeb49bf7e23aab664de914df204664f.exe	4aeb49bf7e23aab664de914df204664f.exe
PID 4168 wrote to memory of 4364	4168	4aeb49bf7e23aab664de914df204664f.exe	4aeb49bf7e23aab664de914df204664f.exe
PID 4168 wrote to memory of 4364	4168	4aeb49bf7e23aab664de914df204664f.exe	4aeb49bf7e23aab664de914df204664f.exe

C:\Users\Admin\AppData\Local\Temp\4aeb49bf7e23aab664de914df204664f.exe
"C:\Users\Admin\AppData\Local\Temp\4aeb49bf7e23aab664de914df204664f.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3644

C:\Users\Admin\AppData\Local\Temp\3582-490\4aeb49bf7e23aab664de914df204664f.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\4aeb49bf7e23aab664de914df204664f.exe"
2⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168

C:\Users\Admin\AppData\Local\Temp\3582-490\4aeb49bf7e23aab664de914df204664f.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\4aeb49bf7e23aab664de914df204664f.exe"
3⤵
- Loads dropped DLL
PID:4364

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\4aeb49bf7e23aab664de914df204664f.exe
MD5
c666c22685d135c1efe709cbedd0eb6b

SHA1
0da7aed60d8a194da98c44cd5ad76efc57e00dff

SHA256
a393c2aa773ef090f5e907c90c5cf90d67c2b6db2a2ffedac0b75c748f3a7b45

SHA512
6430a0ec3002777df9357463eb3f1c279b5e4b1778bc8ff77140c947d484e8d5d17dd268c3744008d0cb52fcd58232489c2a8335e816462b1d35f11949f8fea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\4aeb49bf7e23aab664de914df204664f.exe
MD5
c666c22685d135c1efe709cbedd0eb6b

SHA1
0da7aed60d8a194da98c44cd5ad76efc57e00dff

SHA256
a393c2aa773ef090f5e907c90c5cf90d67c2b6db2a2ffedac0b75c748f3a7b45

SHA512
6430a0ec3002777df9357463eb3f1c279b5e4b1778bc8ff77140c947d484e8d5d17dd268c3744008d0cb52fcd58232489c2a8335e816462b1d35f11949f8fea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\4aeb49bf7e23aab664de914df204664f.exe
MD5
c666c22685d135c1efe709cbedd0eb6b

SHA1
0da7aed60d8a194da98c44cd5ad76efc57e00dff

SHA256
a393c2aa773ef090f5e907c90c5cf90d67c2b6db2a2ffedac0b75c748f3a7b45

SHA512
6430a0ec3002777df9357463eb3f1c279b5e4b1778bc8ff77140c947d484e8d5d17dd268c3744008d0cb52fcd58232489c2a8335e816462b1d35f11949f8fea8

Download Submit
memory/4168-115-0x0000000000000000-mapping.dmp

Download
memory/4168-120-0x0000000002A00000-0x0000000002A0F000-memory.dmp

Filesize
60KB

Download
memory/4168-125-0x00007FFC161A0000-0x00007FFC1637B000-memory.dmp

Filesize
1.9MB

Download
memory/4168-126-0x00000000772D0000-0x000000007745E000-memory.dmp

Filesize
1.6MB

Download
memory/4168-127-0x00000000772D0000-0x000000007745E000-memory.dmp

Filesize
1.6MB

Download
memory/4364-121-0x000000000040137C-mapping.dmp

Download
memory/4364-123-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/4364-124-0x0000000000401000-0x00000000004FD000-memory.dmp

Filesize
1008KB

Download
memory/4364-128-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads