guloader | 7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4

General

Target

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Size

363KB
MD5

1d9a6b8676548e658246b54ae5562d26
SHA1

8c09d48d106d8ef77ece8a902a9ee08d7b602c9b
SHA256

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4
SHA512

882ab2ed58cd17e9351b71b2829b93dd390f25994b970c19c5cfc2b1e547b2afcbca6af9b794e78cd08ab6f1ee5b250de15049287d10a40df010593500ff7e60

Score

10^/10

guloader lokibot collection downloader spyware stealer trojan

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Loads dropped DLL 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

pid process

4460 7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

pid	process
4480	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
4480	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

pid	process
4460	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
4480	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	pid	process	target process
PID 4460 set thread context of 4480	4460	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

pid process

4460 7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description pid process

Token: SeDebugPrivilege 4480 7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	pid	process
Token: SeDebugPrivilege	4480	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	pid	process	target process
PID 4460 wrote to memory of 4480	4460	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
PID 4460 wrote to memory of 4480	4460	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
PID 4460 wrote to memory of 4480	4460	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
PID 4460 wrote to memory of 4480	4460	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

outlook_office_path 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

outlook_win_path 1 IoCs

Processes:

7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe

C:\Users\Admin\AppData\Local\Temp\7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
"C:\Users\Admin\AppData\Local\Temp\7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4460

C:\Users\Admin\AppData\Local\Temp\7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe
"C:\Users\Admin\AppData\Local\Temp\7924fd5ac13d88e65edfb67576796cfcf171ea51ef6369360ecb58d690a9dde4.exe"
2⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nshC6FF.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/4460-138-0x00007FFBF29F0000-0x00007FFBF2BE5000-memory.dmp

Filesize
2.0MB

Download
memory/4460-131-0x00000000041C0000-0x00000000042E0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-132-0x00000000041C0000-0x00000000042E0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-133-0x00007FFBF29F0000-0x00007FFBF2BE5000-memory.dmp

Filesize
2.0MB

Download
memory/4460-142-0x00000000041C0000-0x00000000042E0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-135-0x0000000077C90000-0x0000000077E33000-memory.dmp

Filesize
1.6MB

Download
memory/4480-136-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4480-137-0x0000000001660000-0x0000000001760000-memory.dmp

Filesize
1024KB

Download
memory/4480-139-0x0000000001660000-0x0000000001760000-memory.dmp

Filesize
1024KB

Download
memory/4480-140-0x00007FFBF29F0000-0x00007FFBF2BE5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-141-0x0000000077C90000-0x0000000077E33000-memory.dmp

Filesize
1.6MB

Download
memory/4480-134-0x0000000000000000-mapping.dmp

Download
memory/4480-143-0x00007FFBF29F0000-0x00007FFBF2BE5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-144-0x0000000077C90000-0x0000000077E33000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads