guloader | 7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4

General

Target

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Size

363KB
MD5

1d9a6b8676548e658246b54ae5562d26
SHA1

8c09d48d106d8ef77ece8a902a9ee08d7b602c9b
SHA256

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4
SHA512

882ab2ed58cd17e9351b71b2829b93dd390f25994b970c19c5cfc2b1e547b2afcbca6af9b794e78cd08ab6f1ee5b250de15049287d10a40df010593500ff7e60

Score

10^/10

guloader collection downloader spyware stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Loads dropped DLL 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

pid process

1228 7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

pid	process
2000	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
2000	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

pid	process
1228	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
2000	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	pid	process	target process
PID 1228 set thread context of 2000	1228	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

pid process

1228 7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	pid	process	target process
PID 1228 wrote to memory of 2000	1228	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
PID 1228 wrote to memory of 2000	1228	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
PID 1228 wrote to memory of 2000	1228	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
PID 1228 wrote to memory of 2000	1228	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
PID 1228 wrote to memory of 2000	1228	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

outlook_office_path 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

outlook_win_path 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

C:\Users\Admin\AppData\Local\Temp\7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
"C:\Users\Admin\AppData\Local\Temp\7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
"C:\Users\Admin\AppData\Local\Temp\7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe"
2⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- outlook_office_path
- outlook_win_path
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst7042.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/1228-63-0x0000000076F70000-0x00000000770F0000-memory.dmp

Filesize
1.5MB

Download
memory/1228-56-0x0000000002540000-0x000000000318A000-memory.dmp

Filesize
12.3MB

Download
memory/1228-57-0x0000000002540000-0x000000000318A000-memory.dmp

Filesize
12.3MB

Download
memory/1228-62-0x0000000076D90000-0x0000000076F39000-memory.dmp

Filesize
1.7MB

Download
memory/1228-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1228-71-0x0000000076F70000-0x00000000770F0000-memory.dmp

Filesize
1.5MB

Download
memory/2000-60-0x000000000040352D-mapping.dmp

Download
memory/2000-61-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2000-64-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/2000-65-0x0000000076D90000-0x0000000076F39000-memory.dmp

Filesize
1.7MB

Download
memory/2000-68-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/2000-69-0x0000000076F70000-0x00000000770F0000-memory.dmp

Filesize
1.5MB

Download
memory/2000-70-0x0000000076F70000-0x00000000770F0000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads