guloader | 1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd

General

Target

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
Size

334KB
MD5

52a33249329dd340956315ef94750c8f
SHA1

6cfe8024a16d20549d5801f46697e9ab5e176d31
SHA256

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd
SHA512

45a0ea78d5cb5c0fb3dc5fc20a197dfef25b2213b57759ccc24c1c555e02e2d750023a4dfb7f9c55cde07b6c8682d9074e82dcb9ca56b159a761aed09e219621
SSDEEP

6144:Aa4TbMMMMMDpMMMM3lMMMM31lrRliq2pd318OtyFPpmNFJ6LSO/jiW6UAPwuPShH:p4XMMMMMdMMMMVMMMMlgqCcyyFhmuPLT

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Loads dropped DLL 2 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

pid	process
1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\lutidine.ini	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

pid	process
1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
1840	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

description	pid	process	target process
PID 1428 set thread context of 1840	1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Drops file in Windows directory 1 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

description	ioc	process
File opened for modification	C:\Windows\Deriet71\Rigsombudenes\Afsprrede.cer	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

pid process

1428 1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

description	pid	process	target process
PID 1428 wrote to memory of 1840	1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
PID 1428 wrote to memory of 1840	1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
PID 1428 wrote to memory of 1840	1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
PID 1428 wrote to memory of 1840	1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
PID 1428 wrote to memory of 1840	1428	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe	1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe

C:\Users\Admin\AppData\Local\Temp\1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
"C:\Users\Admin\AppData\Local\Temp\1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe
"C:\Users\Admin\AppData\Local\Temp\1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso8D9.tmp\Math.dll

Filesize
66KB

MD5
c913926b30cf22f7aed8846f419f7858

SHA1
f894d45828ef8f51c096436ff332c2f53e5e3f1d

SHA256
8f1ce72072b1a90ebf7b10ef3f7f314adaf9033691be558fcd064be60065dca7

SHA512
dee20eae6918f556e1f3b52ab69d616e2479b2fe16181d18b21655bc79e3569b07e82191abc45978d02718955792ab06fad453afd18838d729a8a39434116232

Download Submit
\Users\Admin\AppData\Local\Temp\nso8D9.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
memory/1428-70-0x0000000076FE0000-0x0000000077160000-memory.dmp

Filesize
1.5MB

Download
memory/1428-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1428-73-0x0000000076FE0000-0x0000000077160000-memory.dmp

Filesize
1.5MB

Download
memory/1428-57-0x0000000002790000-0x00000000033DA000-memory.dmp

Filesize
12.3MB

Download
memory/1428-62-0x0000000076E00000-0x0000000076FA9000-memory.dmp

Filesize
1.7MB

Download
memory/1428-63-0x0000000076FE0000-0x0000000077160000-memory.dmp

Filesize
1.5MB

Download
memory/1428-64-0x0000000076FE0000-0x0000000077160000-memory.dmp

Filesize
1.5MB

Download
memory/1840-65-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/1840-68-0x0000000076E00000-0x0000000076FA9000-memory.dmp

Filesize
1.7MB

Download
memory/1840-69-0x0000000076FE0000-0x0000000077160000-memory.dmp

Filesize
1.5MB

Download
memory/1840-61-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1840-71-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/1840-72-0x0000000076FE0000-0x0000000077160000-memory.dmp

Filesize
1.5MB

Download
memory/1840-60-0x00000000004031E9-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads