guloader | 79e1fc85396ae65e8431f8ceb92fefb5ec396381840d830c415ea2d81cb78a49

General

Target

807364412 - detailedManifest·pdf.exe
Size

349KB
MD5

a1a804ad177c7ed334b5be2da145ff2f
SHA1

91f6e4a0be90c39dd42d68de1e33d24bf28b47db
SHA256

79e1fc85396ae65e8431f8ceb92fefb5ec396381840d830c415ea2d81cb78a49
SHA512

35ea2a0c66dbfce26f6a15971db14ba761cc5f9b956dcfb1c60062c1518c20faec17197bc7b1e09779fdd2147398f9dbe45fa1601e1c6f45d4b85ddac2db7c49
SSDEEP

6144:R/c/43AbmhXUQirdrt9ENYoTvGfKPGneuF+CPla9LvgQws18HOGCy853bSWeB/T:RR37XUTrdp9SYYOfKeneuFp6Lvgds18/

Score

10^/10

guloader nanocore discovery downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

master042.duckdns.org:2535

Mutex

b5c6edd2-71c9-4e5f-8e64-7d4e8ff2379f

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
buffer_size
65535
build_time
2022-06-19T20:17:08.219933736Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2535
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
b5c6edd2-71c9-4e5f-8e64-7d4e8ff2379f
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
master042.duckdns.org
primary_dns_server
press042.hopto.org
request_elevation
true
restart_delay
5000
run_delay
15
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

807364412 - detailedManifest·pdf.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	807364412 - detailedManifest·pdf.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 2 IoCs

Processes:

807364412 - detailedManifest·pdf.exe

pid process

1116 807364412 - detailedManifest·pdf.exe
1116 807364412 - detailedManifest·pdf.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
1116	807364412 - detailedManifest·pdf.exe
1116	807364412 - detailedManifest·pdf.exe

Drops file in System32 directory 2 IoCs

Processes:

807364412 - detailedManifest·pdf.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Antiantienzyme.Cur	807364412 - detailedManifest·pdf.exe
File opened for modification	C:\Windows\SysWOW64\Rosanilin\Forsigtighedsprincip\atropia\Guders.Trn	807364412 - detailedManifest·pdf.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

964 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

807364412 - detailedManifest·pdf.execaspol.exe

pid process

1116 807364412 - detailedManifest·pdf.exe
964 caspol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

807364412 - detailedManifest·pdf.exe

description pid process target process

PID 1116 set thread context of 964 1116 807364412 - detailedManifest·pdf.exe caspol.exe

pid	process
964	caspol.exe

pid	process
1116	807364412 - detailedManifest·pdf.exe
964	caspol.exe

description	pid	process	target process
PID 1116 set thread context of 964	1116	807364412 - detailedManifest·pdf.exe	caspol.exe

Drops file in Windows directory 1 IoCs

Processes:

807364412 - detailedManifest·pdf.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\Resistensproblemet\Crossleted\Ansgtes\Ridderlfterne232.Tet	807364412 - detailedManifest·pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1968 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

caspol.exe

pid process

964 caspol.exe
964 caspol.exe
964 caspol.exe
964 caspol.exe
964 caspol.exe
964 caspol.exe
964 caspol.exe
964 caspol.exe
964 caspol.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

caspol.exe

pid process

964 caspol.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

807364412 - detailedManifest·pdf.exe

pid process

1116 807364412 - detailedManifest·pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

caspol.exe

description pid process

Token: SeDebugPrivilege 964 caspol.exe

pid	process
1968	schtasks.exe

pid	process
964	caspol.exe
964	caspol.exe
964	caspol.exe
964	caspol.exe
964	caspol.exe
964	caspol.exe
964	caspol.exe
964	caspol.exe
964	caspol.exe

pid	process
964	caspol.exe

pid	process
1116	807364412 - detailedManifest·pdf.exe

description	pid	process
Token: SeDebugPrivilege	964	caspol.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

807364412 - detailedManifest·pdf.execaspol.exe

description	pid	process	target process
PID 1116 wrote to memory of 964	1116	807364412 - detailedManifest·pdf.exe	caspol.exe
PID 1116 wrote to memory of 964	1116	807364412 - detailedManifest·pdf.exe	caspol.exe
PID 1116 wrote to memory of 964	1116	807364412 - detailedManifest·pdf.exe	caspol.exe
PID 1116 wrote to memory of 964	1116	807364412 - detailedManifest·pdf.exe	caspol.exe
PID 1116 wrote to memory of 964	1116	807364412 - detailedManifest·pdf.exe	caspol.exe
PID 964 wrote to memory of 1968	964	caspol.exe	schtasks.exe
PID 964 wrote to memory of 1968	964	caspol.exe	schtasks.exe
PID 964 wrote to memory of 1968	964	caspol.exe	schtasks.exe
PID 964 wrote to memory of 1968	964	caspol.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\807364412 - detailedManifest·pdf.exe
"C:\Users\Admin\AppData\Local\Temp\807364412 - detailedManifest·pdf.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
"C:\Users\Admin\AppData\Local\Temp\807364412 - detailedManifest·pdf.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "SCSI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8C1C.tmp"
3⤵
- Creates scheduled task(s)
PID:1968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8C1C.tmp
Filesize
1KB

MD5
497f298fc157762f192a7c42854c6fb6

SHA1
04bec630f5cc64ea17c0e3e780b3ccf15a35c6e0

SHA256
3462cbe62fbb64fc53a0fcf97e43baafe9dd9929204f586a86afe4b89d8048a6

SHA512
c7c6fd3097f4d1ccd313160fedf7cb031644e0836b8c3e25481095e5f4b003759bc84fc6ea9421e3a090e66dc2ff875fec2f394a386691ab178cb164733411b2

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEE19.tmp\Math.dll
Filesize
171KB

MD5
499788d1d4b70ea3499b6411ef5aca0c

SHA1
db7274f0c3beea8a2ed7df7fe3006b1ec965d13c

SHA256
6b6c63505ac093672cdc062ea23ea8fbb263204c9591c936dda896cba2c56504

SHA512
c566e94acf0d0de820fb2e7661b721a6fd23c6c5fe7b551b48e80b3c24b0d8de379fa2c53a653858e69dd0a8f6b98bf68a6d7425342f1ade1602ddaa2310c549

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEE19.tmp\System.dll
Filesize
12KB

MD5
6c38da8922cc37b4bbb77de4a63ad843

SHA1
4e0533fd11df8bddbd543ed58df7b6060d9f4631

SHA256
1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1

SHA512
ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430

Download Submit
memory/964-83-0x000000001D456000-0x000000001D467000-memory.dmp

Filesize
68KB

Download
memory/964-82-0x0000000072FC0000-0x000000007356B000-memory.dmp

Filesize
5.7MB

Download
memory/964-61-0x0000000001228A9E-mapping.dmp

Download
memory/964-81-0x000000001D456000-0x000000001D467000-memory.dmp

Filesize
68KB

Download
memory/964-78-0x0000000072FC0000-0x000000007356B000-memory.dmp

Filesize
5.7MB

Download
memory/964-64-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/964-73-0x0000000000401000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/964-66-0x0000000076F80000-0x0000000077129000-memory.dmp

Filesize
1.7MB

Download
memory/964-69-0x0000000077160000-0x00000000772E0000-memory.dmp

Filesize
1.5MB

Download
memory/964-75-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/964-71-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/964-72-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1116-62-0x0000000077160000-0x00000000772E0000-memory.dmp

Filesize
1.5MB

Download
memory/1116-70-0x0000000077160000-0x00000000772E0000-memory.dmp

Filesize
1.5MB

Download
memory/1116-65-0x0000000003A70000-0x0000000003BAB000-memory.dmp

Filesize
1.2MB

Download
memory/1116-63-0x0000000077160000-0x00000000772E0000-memory.dmp

Filesize
1.5MB

Download
memory/1116-79-0x0000000003A70000-0x0000000003BAB000-memory.dmp

Filesize
1.2MB

Download
memory/1116-80-0x0000000077160000-0x00000000772E0000-memory.dmp

Filesize
1.5MB

Download
memory/1116-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1116-58-0x0000000076F80000-0x0000000077129000-memory.dmp

Filesize
1.7MB

Download
memory/1116-57-0x0000000003A70000-0x0000000003BAB000-memory.dmp

Filesize
1.2MB

Download
memory/1968-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads