guloader | 662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00

General

Target

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
Size

247KB
MD5

ec9bab61ebd369e7da67844842659e21
SHA1

e951d295b858224e241bc47446906a49f6ee4717
SHA256

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00
SHA512

d47038cde13d0ce7014f9a1cef0bd43191ca60dfbded8783540bfc558a63f9f60459c34563e3f1cfcc1d3ad279ce319715ba06521568e0868bb8b8cbf64f3cd1
SSDEEP

6144:iT4Dt+KsyVTQuVy808j/EP/BhmHbOA7G2DzSK:iTKtVTQur084/BhM/rCK

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Loads dropped DLL 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

pid process

1456 662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Drops file in System32 directory 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Infanterienhedernes\Chelated\Vy54.lnk	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

pid	process
1456	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
4828	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	pid	process	target process
PID 1456 set thread context of 4828	1456	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Drops file in Windows directory 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	ioc	process
File opened for modification	C:\Windows\resources\Arius\Sveskeblomme\Mervrdiafgifts84.ini	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

pid process

1456 662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

description	pid	process	target process
PID 1456 wrote to memory of 4828	1456	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
PID 1456 wrote to memory of 4828	1456	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
PID 1456 wrote to memory of 4828	1456	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
PID 1456 wrote to memory of 4828	1456	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe	662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe

C:\Users\Admin\AppData\Local\Temp\662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
"C:\Users\Admin\AppData\Local\Temp\662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1456

C:\Users\Admin\AppData\Local\Temp\662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe
"C:\Users\Admin\AppData\Local\Temp\662a8d56ec465a96b1251f29c94bee20f3e30bd5a3a632fa3904c42a6840ef00.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss9B1E.tmp\System.dll
Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
memory/1456-145-0x00000000040E0000-0x0000000004200000-memory.dmp

Filesize
1.1MB

Download
memory/1456-133-0x00000000040E0000-0x0000000004200000-memory.dmp

Filesize
1.1MB

Download
memory/1456-134-0x00000000040E0000-0x0000000004200000-memory.dmp

Filesize
1.1MB

Download
memory/1456-135-0x00007FFBB0C70000-0x00007FFBB0E65000-memory.dmp

Filesize
2.0MB

Download
memory/1456-136-0x0000000077360000-0x0000000077503000-memory.dmp

Filesize
1.6MB

Download
memory/1456-137-0x0000000077360000-0x0000000077503000-memory.dmp

Filesize
1.6MB

Download
memory/4828-138-0x0000000000000000-mapping.dmp

Download
memory/4828-140-0x0000000001660000-0x0000000001760000-memory.dmp

Filesize
1024KB

Download
memory/4828-141-0x0000000001660000-0x0000000001760000-memory.dmp

Filesize
1024KB

Download
memory/4828-142-0x00007FFBB0C70000-0x00007FFBB0E65000-memory.dmp

Filesize
2.0MB

Download
memory/4828-143-0x0000000077360000-0x0000000077503000-memory.dmp

Filesize
1.6MB

Download
memory/4828-144-0x00007FFBB0C70000-0x00007FFBB0E65000-memory.dmp

Filesize
2.0MB

Download
memory/4828-139-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads