guloader | 4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158

General

Target

4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe
Size

104KB
MD5

76bdd809f1bf5dbe375dc15749932959
SHA1

e31ec86484cb2bf3b560e2f611e04fa8e4e702dd
SHA256

4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158
SHA512

3bd57143ff5dda15db19ec33aec123d9df8852c7f804bf499c7d59b100d545c106badf34040a634dbd9bfd62f8c94500b46d6dbff8366afb2dc956796e9e81c2
SSDEEP

1536:cb4/EQxklOmCBboyKAqJk3uNdzh1Syj4OPio8b4/EQx:8Iboy+6Kayj4ON

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

C2

http://mtspsmjeli.sch.id/cl/Maly%20nanocre%202021_ECMFFfzt176.bin

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 3 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1856-56-0x0000000000240000-0x000000000024B000-memory.dmp	family_guloader
behavioral1/memory/1940-62-0x000000000039B7DE-mapping.dmp	family_guloader
behavioral1/memory/1940-64-0x00000000000D0000-0x00000000001D0000-memory.dmp	family_guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exeRegAsm.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	RegAsm.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exeRegAsm.exe

pid process

1856 4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe
1940 RegAsm.exe

pid	process
1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe
1940	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe

description	pid	process	target process
PID 1856 set thread context of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe

pid process

1856 4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe

pid process

1856 4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe

pid	process
1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe

pid	process
1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe

description	pid	process	target process
PID 1856 wrote to memory of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe
PID 1856 wrote to memory of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe
PID 1856 wrote to memory of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe
PID 1856 wrote to memory of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe
PID 1856 wrote to memory of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe
PID 1856 wrote to memory of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe
PID 1856 wrote to memory of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe
PID 1856 wrote to memory of 1940	1856	4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe
"C:\Users\Admin\AppData\Local\Temp\4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe"
1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\4ef3b9bb1838d76bda8e4e09b033c1948ed6d96c4df1962d7e8b3006ac121158.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-69-0x0000000077C70000-0x0000000077DF0000-memory.dmp

Filesize
1.5MB

Download
memory/1856-57-0x0000000077A90000-0x0000000077C39000-memory.dmp

Filesize
1.7MB

Download
memory/1856-59-0x0000000077C70000-0x0000000077DF0000-memory.dmp

Filesize
1.5MB

Download
memory/1856-60-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1856-68-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/1856-56-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/1856-70-0x0000000077C70000-0x0000000077DF0000-memory.dmp

Filesize
1.5MB

Download
memory/1940-62-0x000000000039B7DE-mapping.dmp

Download
memory/1940-64-0x00000000000D0000-0x00000000001D0000-memory.dmp

Filesize
1024KB

Download
memory/1940-65-0x0000000077A90000-0x0000000077C39000-memory.dmp

Filesize
1.7MB

Download
memory/1940-67-0x0000000077C70000-0x0000000077DF0000-memory.dmp

Filesize
1.5MB

Download
memory/1940-71-0x00000000000D0000-0x00000000001D0000-memory.dmp

Filesize
1024KB

Download
memory/1940-72-0x0000000077A90000-0x0000000077C39000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads