guloader | 4bf75ced5431972bf4d34227e7fbf107f16ca9879bee1d0b225321ee100e3a11

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/03/2023, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTATIO.EXE.exe
Size 297KB
Sample230323-p4mvsshf6t
SHA256 4bf75ced5431972bf4d34227e7fbf107f16ca9879bee1d0b225321ee100e3a11
MD5 8d2e9406accfc4e70e8717acd1acac0f
SHA1 879ee79717775fc82af2f34875be6d3953454221
SHA512 c676b10e8275a305bada959c664751c95844cab6c1f959f9ba00157c886c462017a51def3704f081f0798cd0cb0c58db8c75d262c368464deccbc2cfbec92454
SSDEEP 6144:kQLFhHAzxhDJh/xAm2g2bh5jMko872Ed+7RKlOLRkpT4c0hM9egWlgy:xFWVhDT/R21172wDC6p8298gy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	QUOTATIO.EXE.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	QUOTATIO.EXE.exe

Loads dropped DLL 1 IoCs

pid	Process
1556	QUOTATIO.EXE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1556	QUOTATIO.EXE.exe
1688	QUOTATIO.EXE.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 1688	1556	QUOTATIO.EXE.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1556	QUOTATIO.EXE.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1688	1556	QUOTATIO.EXE.exe	28
PID 1556 wrote to memory of 1688	1556	QUOTATIO.EXE.exe	28
PID 1556 wrote to memory of 1688	1556	QUOTATIO.EXE.exe	28
PID 1556 wrote to memory of 1688	1556	QUOTATIO.EXE.exe	28
PID 1556 wrote to memory of 1688	1556	QUOTATIO.EXE.exe	28

C:\Users\Admin\AppData\Local\Temp\QUOTATIO.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATIO.EXE.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\QUOTATIO.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATIO.EXE.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path \Users\Admin\AppData\Local\Temp\nso4270.tmp\System.dll
Size 11KB
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1556-71-0x00000000038F0000-0x000000000435C000-memory.dmp

Download

memory/1556-72-0x00000000038F0000-0x000000000435C000-memory.dmp

Download

memory/1688-73-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/1688-74-0x0000000001470000-0x0000000001EDC000-memory.dmp

Download

memory/1688-75-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/1688-76-0x0000000001470000-0x0000000001EDC000-memory.dmp

Download

memory/1688-77-0x0000000000400000-0x0000000001462000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads