guloader | 8f576935bb94657e73e9b2d2aa9d1de9913f69c1a5b1251a526d5258dfe498fa

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jequirity.exe
Size 260KB
Sample230419-nvkhmsca7v
SHA256 8f576935bb94657e73e9b2d2aa9d1de9913f69c1a5b1251a526d5258dfe498fa
MD5 5278be901a6f39e09195434504e935ee
SHA1 d0eb77c9b197301c0b2a961634cdab2e6aece270
SHA512 17f0994ec41123d84b9a696aaa13b2a94aea78376c6df9afe8e9d8d05dcd4e96bb678161ef67daf4fac088993e16aae640c0bf2a1d6d304182a14ecfb21340e0
SSDEEP 6144:3kyacCTf75W3SLYkRiah9WMWaKP86a8fAaE0gYe8AW/:3kNTTMSRbh9PH6a89je8Ay
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Jequirity.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Jequirity.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Control Panel\International\Geo\Nation	Jequirity.exe

Loads dropped DLL 2 IoCs

pid	Process
1644	Jequirity.exe
1056	wininit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1040	Jequirity.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1644	Jequirity.exe
1040	Jequirity.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 1040	1644	Jequirity.exe	28
PID 1040 set thread context of 1644	1040	Jequirity.exe	27
PID 1056 set thread context of 1208	1056	wininit.exe	14

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2647223082-2067913677-935928954-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wininit.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1040	Jequirity.exe
1040	Jequirity.exe
1040	Jequirity.exe
1040	Jequirity.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1208	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1644	Jequirity.exe
1040	Jequirity.exe
1040	Jequirity.exe
1040	Jequirity.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe
1056	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	Jequirity.exe
Token: SeDebugPrivilege	1056	wininit.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1040	1644	Jequirity.exe	28
PID 1644 wrote to memory of 1040	1644	Jequirity.exe	28
PID 1644 wrote to memory of 1040	1644	Jequirity.exe	28
PID 1644 wrote to memory of 1040	1644	Jequirity.exe	28
PID 1644 wrote to memory of 1040	1644	Jequirity.exe	28
PID 1644 wrote to memory of 1056	1644	Jequirity.exe	31
PID 1644 wrote to memory of 1056	1644	Jequirity.exe	31
PID 1644 wrote to memory of 1056	1644	Jequirity.exe	31
PID 1644 wrote to memory of 1056	1644	Jequirity.exe	31
PID 1056 wrote to memory of 1116	1056	wininit.exe	33
PID 1056 wrote to memory of 1116	1056	wininit.exe	33
PID 1056 wrote to memory of 1116	1056	wininit.exe	33
PID 1056 wrote to memory of 1116	1056	wininit.exe	33
PID 1056 wrote to memory of 1116	1056	wininit.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1208
- C:\Users\Admin\AppData\Local\Temp\Jequirity.exe
  "C:\Users\Admin\AppData\Local\Temp\Jequirity.exe"
  2⤵
  - Checks QEMU agent file
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Jequirity.exe
    "C:\Users\Admin\AppData\Local\Temp\Jequirity.exe"
    3⤵
    - Checks QEMU agent file
    - Checks computer location settings
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\SysWOW64\wininit.exe
    "C:\Windows\SysWOW64\wininit.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Program Files\Mozilla Firefox\Firefox.exe
      "C:\Program Files\Mozilla Firefox\Firefox.exe"
      4⤵
      PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sdfpi4.zip

Path C:\Users\Admin\AppData\Local\Temp\sdfpi4.zip
Size 435KB
SHA256 e6fc736d8850729ee5d9d65076e0f4a869530b2c5df7239bda47051fa3c04be7
MD5 0d1613320b79de7e8c7627c07d19f4a7
SHA1 f85b78ed8568a648b9134beb654e384c622c73bd
SHA512 13c00d2a48a42c3da05c6f475ab9b0581c951dd62ca0b435c44dbcefdfc02f14597b2b33aa28d3c4c8526adb198b24f1a83d92b12612209ca4aed06b80c7cbfa
SSDEEP 12288:qqKn7azHyK26Fre95sdYzb+tDYlK3uUNBsO3bhvh+eB9Ez:Q+zHc6FreBzsDYUJYCn+eB9Ez
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsdE16.tmp\System.dll
Size 11KB
SHA256 7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
MD5 fc90dfb694d0e17b013d6f818bce41b0
SHA1 3243969886d640af3bfa442728b9f0dff9d5f5b0
SHA512 324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
SSDEEP 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 831KB
SHA256 002459f4d4758011b4d7f36935f1fe323494b847f8c173a551076a3d30475ebc
MD5 05ace2f6d9bef6fd9bbd05ee5262a1f2
SHA1 5cce2228e0d9c6cc913cf551e0bf7c76ed74ff59
SHA512 1e717a66a72eb626727144fa7458f472ada54fd1be37072c9e740945e34ba94025737aef44e54752c50c5b79a583c6a91a0d8043bf1bf7c3e7cab8537207f9fc
SSDEEP 24576:epcuaweNcfQL25VuB+wiPVoQClfhIC2/X4:epyweNcf9iB+/oQClZV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1040-92-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/1040-67-0x0000000001470000-0x0000000004665000-memory.dmp

Download

memory/1040-69-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/1040-99-0x0000000001470000-0x0000000004665000-memory.dmp

Download

memory/1040-93-0x0000000001470000-0x0000000004665000-memory.dmp

Download

memory/1040-94-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/1040-96-0x0000000001470000-0x0000000004665000-memory.dmp

Download

memory/1040-97-0x0000000034B50000-0x0000000034E53000-memory.dmp

Download

memory/1040-102-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/1040-66-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/1056-100-0x0000000000430000-0x000000000044A000-memory.dmp

Download

memory/1056-101-0x0000000000430000-0x000000000044A000-memory.dmp

Download

memory/1056-104-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1056-105-0x0000000001EA0000-0x00000000021A3000-memory.dmp

Download

memory/1056-108-0x0000000001CA0000-0x0000000001D2F000-memory.dmp

Download

memory/1056-155-0x0000000061E00000-0x0000000061EBD000-memory.dmp

Download

memory/1208-106-0x00000000048D0000-0x000000000498A000-memory.dmp

Download

memory/1208-110-0x00000000048D0000-0x000000000498A000-memory.dmp

Download

memory/1644-98-0x0000000006B40000-0x0000000006C34000-memory.dmp

Download

memory/1644-68-0x00000000037E0000-0x00000000069D5000-memory.dmp

Download

memory/1644-65-0x00000000037E0000-0x00000000069D5000-memory.dmp

Download