guloader | b39885404ea994db97059680fd47dda1ad3570fd2dacb7dd0df0630cf1a8006e

General

Target

6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe
Size

269KB
MD5

d5ad455fc4cb6eb845f6ec26dacef302
SHA1

84c38d916ddbd87d7fa5f7e49c4e96798f5adc09
SHA256

6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d
SHA512

27d326988a948e679333a11da041d7b8e7420436810062b1893886c8ed8c53512681befcc228e3fee727210316c325a6e00cc6accf89291f4f5446b80610e77d
SSDEEP

6144:U6dLy5hBL108rM49Avk8/bxqYY7CEUlx0b9B2crhR+/A:k5HL13M49j8/QY1EQxkB/rTj

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe

Loads dropped DLL 1 IoCs

pid	Process
1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe
812	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1704 set thread context of 812	1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe	28

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Upbraiding\Ekstremismer\Dbl.Srr	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe
File opened for modification	C:\Windows\Fralokke\Registerforskrifter\signalren\Programdisketter.ini	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe
File opened for modification	C:\Windows\resources\0409\Keymen.gib	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 812	1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe	28
PID 1704 wrote to memory of 812	1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe	28
PID 1704 wrote to memory of 812	1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe	28
PID 1704 wrote to memory of 812	1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe	28
PID 1704 wrote to memory of 812	1704	6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe	28

C:\Users\Admin\AppData\Local\Temp\6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe
"C:\Users\Admin\AppData\Local\Temp\6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe
  "C:\Users\Admin\AppData\Local\Temp\6b017394a528be196879753f3c7ae1403aeda629a31b3b6993bc28921521808d.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst4FF6.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
memory/812-73-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/812-74-0x0000000001470000-0x00000000037D4000-memory.dmp

Filesize
35.4MB

Download
memory/812-75-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/812-76-0x0000000001470000-0x00000000037D4000-memory.dmp

Filesize
35.4MB

Download
memory/812-77-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1704-71-0x00000000038E0000-0x0000000005C44000-memory.dmp

Filesize
35.4MB

Download
memory/1704-72-0x00000000038E0000-0x0000000005C44000-memory.dmp

Filesize
35.4MB

Download

Analysis

Sharing