guloader | f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3

General

Target

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe
Size

678KB
MD5

71b2e12765ab5b744e42aea118f2845d
SHA1

8882d7c1ef14d140f9de727207a95ef5ffb68fd3
SHA256

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3
SHA512

67050f92dca57dc887d11736f7722c085e29b5a6e2974ff74e9ab2182856d6246ce113123a27ef13728d31ef2fab333cf677bf488f8f8ab400e65fd168262c20
SSDEEP

12288:uMw4EAPcLqU6LfBVbPWxAeWqHpST3yZrn0aHDyq9DSXALFWscaLU2:uMwtAPcLqU6nPKAzR3yBDyq0G62

Score

10^/10

guloader snakekeylogger collection downloader keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.eversafe.pt
Port:
587
Username:
pulqueriamonteiro@eversafe.pt
Password:
Ev3rsaf3_2021
Email To:
vbankz20@gmail.com

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3488-166-0x0000000000400000-0x000000000062B000-memory.dmp	family_snakekeylogger
behavioral2/memory/3488-168-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 2 IoCs

Processes:

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe

pid	process
2980	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe
2980	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

48 checkip.dyndns.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

3488 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.execaspol.exe

pid process

2980 f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe
3488 caspol.exe

flow	ioc
48	checkip.dyndns.org

pid	process
3488	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe

description	pid	process	target process
PID 2980 set thread context of 3488	2980	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe	caspol.exe

Drops file in Windows directory 1 IoCs

Processes:

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\Ledetekstens\smrokkerne\Slowheartedness.ini	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2188 3488 WerFault.exe caspol.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

caspol.exe

pid process

3488 caspol.exe
3488 caspol.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe

pid process

2980 f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

caspol.exe

description pid process

Token: SeDebugPrivilege 3488 caspol.exe

pid	pid_target	process	target process
2188	3488	WerFault.exe	caspol.exe

pid	process
3488	caspol.exe
3488	caspol.exe

description	pid	process
Token: SeDebugPrivilege	3488	caspol.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe

description	pid	process	target process
PID 2980 wrote to memory of 3488	2980	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe	caspol.exe
PID 2980 wrote to memory of 3488	2980	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe	caspol.exe
PID 2980 wrote to memory of 3488	2980	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe	caspol.exe
PID 2980 wrote to memory of 3488	2980	f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe	caspol.exe

outlook_office_path 1 IoCs

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

outlook_win_path 1 IoCs

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

C:\Users\Admin\AppData\Local\Temp\f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe
"C:\Users\Admin\AppData\Local\Temp\f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
"C:\Users\Admin\AppData\Local\Temp\f6ff5a18073b56d3a8d83195fa49486e289524729a081b5e49664f38854fe7e3.exe"
2⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 2288
3⤵
- Program crash
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3488 -ip 3488
1⤵
PID:876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj6D94.tmp\AdvSplash.dll
Filesize
6KB

MD5
1871af84805057b5ebc05ee46b56625d

SHA1
50e1c315ad30f5f3f300c7cd9dd0d5d626fe0167

SHA256
62b3db0446750ca9fd693733eec927acc1f50012a47785343286e63b650b7621

SHA512
c1979ee98dfdb807776c439218528d80b4b244a87e692f1538e40f9c2c82db8b77485eb1429325b6f44419bf1f4cd454e43ff381eff077a8b4f4d9eb0d7e54d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj6D94.tmp\System.dll
Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
memory/2980-150-0x00000000071D0000-0x0000000009CF5000-memory.dmp

Filesize
43.1MB

Download
memory/2980-151-0x00000000071D0000-0x0000000009CF5000-memory.dmp

Filesize
43.1MB

Download
memory/3488-152-0x0000000001000000-0x0000000003B25000-memory.dmp

Filesize
43.1MB

Download
memory/3488-153-0x0000000001000000-0x0000000003B25000-memory.dmp

Filesize
43.1MB

Download
memory/3488-166-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/3488-167-0x0000000001000000-0x0000000003B25000-memory.dmp

Filesize
43.1MB

Download
memory/3488-168-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3488-169-0x0000000037060000-0x0000000037604000-memory.dmp

Filesize
5.6MB

Download
memory/3488-170-0x0000000000D10000-0x0000000000DAC000-memory.dmp

Filesize
624KB

Download
memory/3488-171-0x0000000036B50000-0x0000000036B60000-memory.dmp

Filesize
64KB

Download
memory/3488-173-0x0000000001000000-0x0000000003B25000-memory.dmp

Filesize
43.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads