guloader | 5f81ffcd48ea3463ba341a9baf50e7264bea3a58152746d133ee02b64d5c751c

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2023, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe
Size

843KB
MD5

2504b14fedd9f5f647b5652cc29ade29
SHA1

8329092bc1bb42271b03ce39ebace67aad7251bb
SHA256

0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db
SHA512

fbb4580d1b7214d8de82e41e539c7f943be2b2346d26fb43ac5c6f82c227d3718a5bc1887087d8fbd7e5e16ef4164ae5e0b15181bdc46a9d78620a47f5395d7b
SSDEEP

12288:grRquUHNB4qtoqpYouIrsoPlxxsUzZbhuOWzM6QnVpFqjzieeQ:z/HcRqqoLxx3zZ9uFzTEneD

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe

Loads dropped DLL 1 IoCs

pid	Process
1420	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1420	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe
1464	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 1464	1420	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1420	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1464	1420	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe	83
PID 1420 wrote to memory of 1464	1420	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe	83
PID 1420 wrote to memory of 1464	1420	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe	83
PID 1420 wrote to memory of 1464	1420	0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe	83

C:\Users\Admin\AppData\Local\Temp\0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe
"C:\Users\Admin\AppData\Local\Temp\0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe
  "C:\Users\Admin\AppData\Local\Temp\0e1e4acc6d6361c0e7673e468afac317adb986424ef51f74eba25b77d4b257db.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsw7268.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
memory/1420-143-0x0000000004190000-0x00000000064E5000-memory.dmp

Filesize
35.3MB

Download
memory/1420-144-0x0000000004190000-0x00000000064E5000-memory.dmp

Filesize
35.3MB

Download
memory/1464-145-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1464-146-0x0000000001660000-0x00000000039B5000-memory.dmp

Filesize
35.3MB

Download
memory/1464-147-0x0000000001660000-0x00000000039B5000-memory.dmp

Filesize
35.3MB

Download
memory/1464-148-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download