guloader | 86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66

General

Target

86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe
Size

757KB
MD5

af1883e14cdc91fdd97eec7cfb364570
SHA1

3c6efba498492113cb3616a73bbcb4699ca9e19e
SHA256

86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66
SHA512

1cbc4c0915488efa210ae67713de6f4d12777c1048f132a8bf0d70b3e6de6ac75a5b44411232378fa2e0b9d36a82bc5504833b50f10027c8caeaa900867ef4fe
SSDEEP

12288:9PKcWfPW1nUOMaJid6G7kItgiwxmRiuU6wJT6FKZ0B:FWonUZaEd6GdtgiwxalU6wJJ0B

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe

Loads dropped DLL 1 IoCs

pid	Process
2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1168	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe
1168	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 1168	2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe	29

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Counterargues\Sydkoreaners\Overprecision.ini	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1168	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1168	2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe	29
PID 2000 wrote to memory of 1168	2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe	29
PID 2000 wrote to memory of 1168	2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe	29
PID 2000 wrote to memory of 1168	2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe	29
PID 2000 wrote to memory of 1168	2000	86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe	29

C:\Users\Admin\AppData\Local\Temp\86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe
"C:\Users\Admin\AppData\Local\Temp\86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe
  "C:\Users\Admin\AppData\Local\Temp\86a558475c11037f063e487cf1f4d8a711915d1a9a07e760c49d2092e627ea66.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Cream.ini

Filesize
47B

MD5
d433d70ff7e5bd12df3fe030ae10cd13

SHA1
2f3366764cabb08288b71a0430c953a566100be1

SHA256
9a4c87e19523123883e40363a84d37412c7563b92781677a51ab870318565403

SHA512
7024cb6b81c70838cdd740642a64115db5fb4fe76a7a8d428f12a6de89f374f1706e06483e2b0935c91f3b140fd648a4b3ca8f5ba32b507add29e4cb33c1d560

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1DD0.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
memory/1168-71-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1168-72-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1168-73-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1168-96-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1168-97-0x0000000001470000-0x0000000006E78000-memory.dmp

Filesize
90.0MB

Download
memory/1168-98-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1168-101-0x0000000037430000-0x0000000037733000-memory.dmp

Filesize
3.0MB

Download
memory/1168-100-0x0000000001470000-0x0000000006E78000-memory.dmp

Filesize
90.0MB

Download

Analysis

Sharing