guloader | 4366a0e113d168f2809a4a1983c2198ec874b89af0bdfe465e753d409c85c51c

General

Target

46984f492d6314442d1a502d7ab460c4$.exe
Size

186KB
MD5

46984f492d6314442d1a502d7ab460c4
SHA1

3515b9159efe0abc0df68d352c4e1bed4391c2fe
SHA256

4366a0e113d168f2809a4a1983c2198ec874b89af0bdfe465e753d409c85c51c
SHA512

e87563c2ac5464e9bd1786288dadadfa75ab843d2c02801ad6fb7e05194483fffc79580dc046a8bc313bd78d008758722f590ed6762b3b5f3603268a6b73d02c

Score

10^/10

guloader lokibot collection downloader spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.250.34.171/tickets.php?id=277

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 1 IoCs

Processes:

Form_Sporogeni.exe

pid process

620 Form_Sporogeni.exe

pid	process
620	Form_Sporogeni.exe

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Form_Sporogeni.exeForm_Sporogeni.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Form_Sporogeni.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Form_Sporogeni.exe

Loads dropped DLL 4 IoCs

Processes:

46984f492d6314442d1a502d7ab460c4$.exeForm_Sporogeni.exeForm_Sporogeni.exe

pid process

976 46984f492d6314442d1a502d7ab460c4$.exe
976 46984f492d6314442d1a502d7ab460c4$.exe
620 Form_Sporogeni.exe
824 Form_Sporogeni.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
976	46984f492d6314442d1a502d7ab460c4$.exe
976	46984f492d6314442d1a502d7ab460c4$.exe
620	Form_Sporogeni.exe
824	Form_Sporogeni.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Form_Sporogeni.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Form_Sporogeni.exe
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Form_Sporogeni.exe
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Form_Sporogeni.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

Form_Sporogeni.exe

pid process

824 Form_Sporogeni.exe
824 Form_Sporogeni.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Form_Sporogeni.exeForm_Sporogeni.exe

pid process

620 Form_Sporogeni.exe
824 Form_Sporogeni.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Form_Sporogeni.exe

description pid process target process

PID 620 set thread context of 824 620 Form_Sporogeni.exe Form_Sporogeni.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Form_Sporogeni.exe

pid process

620 Form_Sporogeni.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Form_Sporogeni.exe

description pid process

Token: SeDebugPrivilege 824 Form_Sporogeni.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Form_Sporogeni.exe

pid process

620 Form_Sporogeni.exe

pid	process
824	Form_Sporogeni.exe
824	Form_Sporogeni.exe

pid	process
620	Form_Sporogeni.exe
824	Form_Sporogeni.exe

description	pid	process	target process
PID 620 set thread context of 824	620	Form_Sporogeni.exe	Form_Sporogeni.exe

pid	process
620	Form_Sporogeni.exe

description	pid	process
Token: SeDebugPrivilege	824	Form_Sporogeni.exe

pid	process
620	Form_Sporogeni.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

46984f492d6314442d1a502d7ab460c4$.exeForm_Sporogeni.exe

description	pid	process	target process
PID 976 wrote to memory of 620	976	46984f492d6314442d1a502d7ab460c4$.exe	Form_Sporogeni.exe
PID 976 wrote to memory of 620	976	46984f492d6314442d1a502d7ab460c4$.exe	Form_Sporogeni.exe
PID 976 wrote to memory of 620	976	46984f492d6314442d1a502d7ab460c4$.exe	Form_Sporogeni.exe
PID 976 wrote to memory of 620	976	46984f492d6314442d1a502d7ab460c4$.exe	Form_Sporogeni.exe
PID 620 wrote to memory of 824	620	Form_Sporogeni.exe	Form_Sporogeni.exe
PID 620 wrote to memory of 824	620	Form_Sporogeni.exe	Form_Sporogeni.exe
PID 620 wrote to memory of 824	620	Form_Sporogeni.exe	Form_Sporogeni.exe
PID 620 wrote to memory of 824	620	Form_Sporogeni.exe	Form_Sporogeni.exe
PID 620 wrote to memory of 824	620	Form_Sporogeni.exe	Form_Sporogeni.exe

outlook_office_path 1 IoCs

Processes:

Form_Sporogeni.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Form_Sporogeni.exe

outlook_win_path 1 IoCs

Processes:

Form_Sporogeni.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Form_Sporogeni.exe

C:\Users\Admin\AppData\Local\Temp\46984f492d6314442d1a502d7ab460c4$.exe
"C:\Users\Admin\AppData\Local\Temp\46984f492d6314442d1a502d7ab460c4$.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
C:\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
2⤵
- Executes dropped EXE
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620

C:\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
C:\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
3⤵
- Checks QEMU agent file
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
MD5
3c6fb2d5cb7a8ccf575c378c5883eac2

SHA1
8896c5d3dcfb5f1bf938e22b8852b9b9ca40bb34

SHA256
6e7322135275a9578cfce25d31a5e50064176ad75c96986f11b68c5199756b32

SHA512
1062caf868d56e2a5406df0e8112bbb1328e120ce2f98f270012fa692d5ae57fa6994de62de5b12d9138e5d97aed3ff4fc803932fbae43720521714b4520cfb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
MD5
3c6fb2d5cb7a8ccf575c378c5883eac2

SHA1
8896c5d3dcfb5f1bf938e22b8852b9b9ca40bb34

SHA256
6e7322135275a9578cfce25d31a5e50064176ad75c96986f11b68c5199756b32

SHA512
1062caf868d56e2a5406df0e8112bbb1328e120ce2f98f270012fa692d5ae57fa6994de62de5b12d9138e5d97aed3ff4fc803932fbae43720521714b4520cfb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
MD5
3c6fb2d5cb7a8ccf575c378c5883eac2

SHA1
8896c5d3dcfb5f1bf938e22b8852b9b9ca40bb34

SHA256
6e7322135275a9578cfce25d31a5e50064176ad75c96986f11b68c5199756b32

SHA512
1062caf868d56e2a5406df0e8112bbb1328e120ce2f98f270012fa692d5ae57fa6994de62de5b12d9138e5d97aed3ff4fc803932fbae43720521714b4520cfb8

Download Submit
\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
MD5
3c6fb2d5cb7a8ccf575c378c5883eac2

SHA1
8896c5d3dcfb5f1bf938e22b8852b9b9ca40bb34

SHA256
6e7322135275a9578cfce25d31a5e50064176ad75c96986f11b68c5199756b32

SHA512
1062caf868d56e2a5406df0e8112bbb1328e120ce2f98f270012fa692d5ae57fa6994de62de5b12d9138e5d97aed3ff4fc803932fbae43720521714b4520cfb8

Download Submit
\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
MD5
3c6fb2d5cb7a8ccf575c378c5883eac2

SHA1
8896c5d3dcfb5f1bf938e22b8852b9b9ca40bb34

SHA256
6e7322135275a9578cfce25d31a5e50064176ad75c96986f11b68c5199756b32

SHA512
1062caf868d56e2a5406df0e8112bbb1328e120ce2f98f270012fa692d5ae57fa6994de62de5b12d9138e5d97aed3ff4fc803932fbae43720521714b4520cfb8

Download Submit
\Users\Admin\AppData\Local\Temp\Form_Sporogeni.exe
MD5
3c6fb2d5cb7a8ccf575c378c5883eac2

SHA1
8896c5d3dcfb5f1bf938e22b8852b9b9ca40bb34

SHA256
6e7322135275a9578cfce25d31a5e50064176ad75c96986f11b68c5199756b32

SHA512
1062caf868d56e2a5406df0e8112bbb1328e120ce2f98f270012fa692d5ae57fa6994de62de5b12d9138e5d97aed3ff4fc803932fbae43720521714b4520cfb8

Download Submit
memory/620-60-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/620-62-0x00000000003C0000-0x00000000003D5000-memory.dmp

Filesize
84KB

Download
memory/620-64-0x0000000077730000-0x00000000778D9000-memory.dmp

Filesize
1.7MB

Download
memory/620-66-0x0000000077910000-0x0000000077A90000-memory.dmp

Filesize
1.5MB

Download
memory/620-61-0x0000000000380000-0x000000000038A000-memory.dmp

Filesize
40KB

Download
memory/620-58-0x0000000000000000-mapping.dmp

Download
memory/620-70-0x0000000077910000-0x0000000077A90000-memory.dmp

Filesize
1.5MB

Download
memory/824-73-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/824-71-0x0000000000401314-mapping.dmp

Download
memory/824-75-0x00000000001B0000-0x00000000002B0000-memory.dmp

Filesize
1024KB

Download
memory/824-78-0x0000000077730000-0x00000000778D9000-memory.dmp

Filesize
1.7MB

Download
memory/824-79-0x0000000077910000-0x0000000077A90000-memory.dmp

Filesize
1.5MB

Download
memory/824-80-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/976-55-0x0000000076341000-0x0000000076343000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads