guloader | 662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00

General

Target

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
Size

247KB
MD5

ec9bab61ebd369e7da67844842659e21
SHA1

e951d295b858224e241bc47446906a49f6ee4717
SHA256

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00
SHA512

d47038cde13d0ce7014f9a1cef0bd43191ca60dfbded8783540bfc558a63f9f60459c34563e3f1cfcc1d3ad279ce319715ba06521568e0868bb8b8cbf64f3cd1
SSDEEP

6144:iT4Dt+KsyVTQuVy808j/EP/BhmHbOA7G2DzSK:iTKtVTQur084/BhM/rCK

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Loads dropped DLL 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

pid process

1228 662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Drops file in System32 directory 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Infanterienhedernes\Chelated\Vy54.lnk	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

pid	process
1228	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
784	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	pid	process	target process
PID 1228 set thread context of 784	1228	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Drops file in Windows directory 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	ioc	process
File opened for modification	C:\Windows\resources\Arius\Sveskeblomme\Mervrdiafgifts84.ini	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

pid process

1228 662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	pid	process	target process
PID 1228 wrote to memory of 784	1228	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
PID 1228 wrote to memory of 784	1228	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
PID 1228 wrote to memory of 784	1228	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
PID 1228 wrote to memory of 784	1228	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
PID 1228 wrote to memory of 784	1228	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

C:\Users\Admin\AppData\Local\Temp\662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
"C:\Users\Admin\AppData\Local\Temp\662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
  "C:\Users\Admin\AppData\Local\Temp\662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso2704.tmp\System.dll

Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
memory/784-64-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/784-70-0x0000000076F90000-0x0000000077110000-memory.dmp

Filesize
1.5MB

Download
memory/784-69-0x00000000001C0000-0x00000000002C0000-memory.dmp

Filesize
1024KB

Download
memory/784-60-0x00000000004034C5-mapping.dmp

Download
memory/784-61-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/784-68-0x0000000076F90000-0x0000000077110000-memory.dmp

Filesize
1.5MB

Download
memory/784-67-0x0000000076DB0000-0x0000000076F59000-memory.dmp

Filesize
1.7MB

Download
memory/1228-57-0x0000000002450000-0x000000000309A000-memory.dmp

Filesize
12.3MB

Download
memory/1228-63-0x0000000076F90000-0x0000000077110000-memory.dmp

Filesize
1.5MB

Download
memory/1228-62-0x0000000076DB0000-0x0000000076F59000-memory.dmp

Filesize
1.7MB

Download
memory/1228-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1228-56-0x0000000002450000-0x000000000309A000-memory.dmp

Filesize
12.3MB

Download
memory/1228-71-0x0000000076F90000-0x0000000077110000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads