guloader | cff95e5e1d6c497b0262c0f9cfc62cdddde0ae225e485bb866d105d5529bb1b9

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDINE_0.exe
Size

518KB
MD5

aa301dc0c7fdbb92f975d9eb7e8bdd99
SHA1

d328bf1f349b89a881c14e1a7d6e5263801f2263
SHA256

6c06c5e878ce129c3260c2fa7869410c5aa9cdcd0e929933c221e4e847df4376
SHA512

83fb6139762b3e1930e185d5e59da5c9781768f6c3ff8f8725631a779ba8a075c098c78e7155855aa5ed1f995606a2d211db0881f47081a334b733dcfb9280a2
SSDEEP

12288:tEu4mI4d8CgrgCQvQyflYebLk0oLydotPuqB:pJ6veJflYeHkQdIuqB

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ORDINE_0.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ORDINE_0.exe

Loads dropped DLL 1 IoCs

pid	Process
2612	ORDINE_0.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2612	ORDINE_0.exe
1624	ORDINE_0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 1624	2612	ORDINE_0.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2612	ORDINE_0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1624	2612	ORDINE_0.exe	85
PID 2612 wrote to memory of 1624	2612	ORDINE_0.exe	85
PID 2612 wrote to memory of 1624	2612	ORDINE_0.exe	85
PID 2612 wrote to memory of 1624	2612	ORDINE_0.exe	85

C:\Users\Admin\AppData\Local\Temp\ORDINE_0.exe
"C:\Users\Admin\AppData\Local\Temp\ORDINE_0.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\ORDINE_0.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDINE_0.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsw8B7D.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
memory/1624-149-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1624-150-0x0000000001660000-0x0000000003FEB000-memory.dmp

Filesize
41.5MB

Download
memory/1624-151-0x0000000001660000-0x0000000003FEB000-memory.dmp

Filesize
41.5MB

Download
memory/1624-152-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2612-147-0x0000000002DD0000-0x000000000575B000-memory.dmp

Filesize
41.5MB

Download
memory/2612-148-0x0000000002DD0000-0x000000000575B000-memory.dmp

Filesize
41.5MB

Download