guloader | 4bf75ced5431972bf4d34227e7fbf107f16ca9879bee1d0b225321ee100e3a11

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2023, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTATIO.EXE.exe
Size 297KB
Sample230323-p4mvsshf6t
SHA256 4bf75ced5431972bf4d34227e7fbf107f16ca9879bee1d0b225321ee100e3a11
MD5 8d2e9406accfc4e70e8717acd1acac0f
SHA1 879ee79717775fc82af2f34875be6d3953454221
SHA512 c676b10e8275a305bada959c664751c95844cab6c1f959f9ba00157c886c462017a51def3704f081f0798cd0cb0c58db8c75d262c368464deccbc2cfbec92454
SSDEEP 6144:kQLFhHAzxhDJh/xAm2g2bh5jMko872Ed+7RKlOLRkpT4c0hM9egWlgy:xFWVhDT/R21172wDC6p8298gy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	QUOTATIO.EXE.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	QUOTATIO.EXE.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	QUOTATIO.EXE.exe

Loads dropped DLL 1 IoCs

pid	Process
1132	QUOTATIO.EXE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2172	QUOTATIO.EXE.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1132	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1132 set thread context of 2172	1132	QUOTATIO.EXE.exe	98
PID 2172 set thread context of 3180	2172	QUOTATIO.EXE.exe	37
PID 740 set thread context of 3180	740	mstsc.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	3144	WerFault.exe	101

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mstsc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1132	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
2172	QUOTATIO.EXE.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe
740	mstsc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	QUOTATIO.EXE.exe
Token: SeDebugPrivilege	740	mstsc.exe
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2172	1132	QUOTATIO.EXE.exe	98
PID 1132 wrote to memory of 2172	1132	QUOTATIO.EXE.exe	98
PID 1132 wrote to memory of 2172	1132	QUOTATIO.EXE.exe	98
PID 1132 wrote to memory of 2172	1132	QUOTATIO.EXE.exe	98
PID 3180 wrote to memory of 740	3180	Explorer.EXE	100
PID 3180 wrote to memory of 740	3180	Explorer.EXE	100
PID 3180 wrote to memory of 740	3180	Explorer.EXE	100
PID 740 wrote to memory of 3144	740	mstsc.exe	101
PID 740 wrote to memory of 3144	740	mstsc.exe	101
PID 740 wrote to memory of 3144	740	mstsc.exe	101

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Users\Admin\AppData\Local\Temp\QUOTATIO.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATIO.EXE.exe"
  2⤵
  - Checks QEMU agent file
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Users\Admin\AppData\Local\Temp\QUOTATIO.EXE.exe
    "C:\Users\Admin\AppData\Local\Temp\QUOTATIO.EXE.exe"
    3⤵
    - Checks QEMU agent file
    - Checks computer location settings
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3144
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3144 -s 136
      4⤵
      Program crash
      PID:812

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 3144 -ip 3144
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbB117.tmp\System.dll
Size 11KB
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/740-164-0x00000000001D0000-0x000000000030A000-memory.dmp

Download

memory/740-173-0x00000000023A0000-0x000000000242F000-memory.dmp

Download

memory/740-171-0x0000000002570000-0x00000000028BA000-memory.dmp

Download

memory/740-170-0x0000000000630000-0x000000000065D000-memory.dmp

Download

memory/740-169-0x0000000000630000-0x000000000065D000-memory.dmp

Download

memory/740-168-0x00000000001D0000-0x000000000030A000-memory.dmp

Download

memory/1132-149-0x0000000004960000-0x00000000053CC000-memory.dmp

Download

memory/1132-150-0x0000000004960000-0x00000000053CC000-memory.dmp

Download

memory/2172-153-0x0000000001660000-0x00000000020CC000-memory.dmp

Download

memory/2172-162-0x0000000032150000-0x0000000032160000-memory.dmp

Download

memory/2172-165-0x0000000001660000-0x00000000020CC000-memory.dmp

Download

memory/2172-161-0x0000000032690000-0x00000000329DA000-memory.dmp

Download

memory/2172-166-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/2172-159-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/2172-158-0x0000000001660000-0x00000000020CC000-memory.dmp

Download

memory/2172-157-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/2172-152-0x0000000001660000-0x00000000020CC000-memory.dmp

Download

memory/2172-151-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/3180-163-0x0000000008040000-0x0000000008114000-memory.dmp

Download

memory/3180-174-0x0000000007E60000-0x0000000007EF2000-memory.dmp

Download

memory/3180-176-0x0000000007E60000-0x0000000007EF2000-memory.dmp

Download