guloader | 7c54b7d54c409f3eee45a1ed7e7eee5da5c0577c2fcf974defa989d75a9ef9aa

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VAN DE WERT - po240975_jpg.exe
Size

445KB
MD5

e5fdfc2e819712600c1cf79d4f274022
SHA1

bc947ca0dc25f1ba54ccbe5a14d84f53f22feb9d
SHA256

7c54b7d54c409f3eee45a1ed7e7eee5da5c0577c2fcf974defa989d75a9ef9aa
SHA512

aec8f7481909206169cc7f51b6fb7747e214f237db71ba7ec523a495256179412a17eab91346e9d04b6c622743a4b7693b5bc64a6c3e0ece9f9b4b63c47ddf21
SSDEEP

12288:SzgOyj6Yd/6W48bLL+NVkOb/wZKpYgIgfC:jOyvd/zLLAVkObosW

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

VAN DE WERT - po240975_jpg.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	VAN DE WERT - po240975_jpg.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 1 IoCs

Processes:

VAN DE WERT - po240975_jpg.exe

pid process

4824 VAN DE WERT - po240975_jpg.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

VAN DE WERT - po240975_jpg.execaspol.exe

pid process

4824 VAN DE WERT - po240975_jpg.exe
1148 caspol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

VAN DE WERT - po240975_jpg.exe

description pid process target process

PID 4824 set thread context of 1148 4824 VAN DE WERT - po240975_jpg.exe caspol.exe
Drops file in Program Files directory 1 IoCs

Processes:

VAN DE WERT - po240975_jpg.exe

description ioc process

File opened for modification C:\Program Files (x86)\Common Files\Bidtes\Euphemise.Tvi VAN DE WERT - po240975_jpg.exe
Drops file in Windows directory 1 IoCs

Processes:

VAN DE WERT - po240975_jpg.exe

description ioc process

File opened for modification C:\Windows\Albueskaden76.Cha VAN DE WERT - po240975_jpg.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

VAN DE WERT - po240975_jpg.exe

pid process

4824 VAN DE WERT - po240975_jpg.exe
4824 VAN DE WERT - po240975_jpg.exe

pid	process
4824	VAN DE WERT - po240975_jpg.exe

pid	process
4824	VAN DE WERT - po240975_jpg.exe
1148	caspol.exe

description	pid	process	target process
PID 4824 set thread context of 1148	4824	VAN DE WERT - po240975_jpg.exe	caspol.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Bidtes\Euphemise.Tvi	VAN DE WERT - po240975_jpg.exe

description	ioc	process
File opened for modification	C:\Windows\Albueskaden76.Cha	VAN DE WERT - po240975_jpg.exe

pid	process
4824	VAN DE WERT - po240975_jpg.exe
4824	VAN DE WERT - po240975_jpg.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

VAN DE WERT - po240975_jpg.exe

description	pid	process	target process
PID 4824 wrote to memory of 1440	4824	VAN DE WERT - po240975_jpg.exe	caspol.exe
PID 4824 wrote to memory of 1440	4824	VAN DE WERT - po240975_jpg.exe	caspol.exe
PID 4824 wrote to memory of 1440	4824	VAN DE WERT - po240975_jpg.exe	caspol.exe
PID 4824 wrote to memory of 1148	4824	VAN DE WERT - po240975_jpg.exe	caspol.exe
PID 4824 wrote to memory of 1148	4824	VAN DE WERT - po240975_jpg.exe	caspol.exe
PID 4824 wrote to memory of 1148	4824	VAN DE WERT - po240975_jpg.exe	caspol.exe
PID 4824 wrote to memory of 1148	4824	VAN DE WERT - po240975_jpg.exe	caspol.exe

C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe
"C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
"C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
2⤵
PID:1440

C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
"C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsm66B0.tmp\System.dll
Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
memory/1148-140-0x0000000001120000-0x0000000001220000-memory.dmp

Filesize
1024KB

Download
memory/1148-144-0x00000000772D0000-0x0000000077473000-memory.dmp

Filesize
1.6MB

Download
memory/1148-143-0x00007FF98F9D0000-0x00007FF98FBC5000-memory.dmp

Filesize
2.0MB

Download
memory/1148-142-0x00000000772D0000-0x0000000077473000-memory.dmp

Filesize
1.6MB

Download
memory/1148-137-0x0000000000000000-mapping.dmp

Download
memory/1148-141-0x00007FF98F9D0000-0x00007FF98FBC5000-memory.dmp

Filesize
2.0MB

Download
memory/1148-139-0x0000000001120000-0x0000000001220000-memory.dmp

Filesize
1024KB

Download
memory/4824-135-0x00007FF98F9D0000-0x00007FF98FBC5000-memory.dmp

Filesize
2.0MB

Download
memory/4824-138-0x00000000772D0000-0x0000000077473000-memory.dmp

Filesize
1.6MB

Download
memory/4824-136-0x00000000772D0000-0x0000000077473000-memory.dmp

Filesize
1.6MB

Download
memory/4824-134-0x0000000003340000-0x0000000003441000-memory.dmp

Filesize
1.0MB

Download
memory/4824-133-0x0000000003340000-0x0000000003441000-memory.dmp

Filesize
1.0MB

Download
memory/4824-145-0x0000000003340000-0x0000000003441000-memory.dmp

Filesize
1.0MB

Download