guloader | 0749beb8fd852d4d82f7e2917f861ac4d8ec36b1363b6df47b202e3120aebd12

General

Target

ESCO-PO-Q10056286.exe
Size

793KB
MD5

ea6118b2fe55e3acc84115be3edaa2f5
SHA1

c712674a10c04c03271635c51db9fd38f62dac0e
SHA256

0749beb8fd852d4d82f7e2917f861ac4d8ec36b1363b6df47b202e3120aebd12
SHA512

a5a2337045e7f95dd7dd00d06f7f08da9202b528c1f4532d48a7b5f994daa953355631dd643334e86a4bbd6517df239dcbc3d189e555df05fb4986ff5fa6b618
SSDEEP

24576:r92LKyG5+emhIIiE3ZPbXJ/hMe25Whpw8P:gFG/lQJDVhk5WHfP

Score

10^/10

guloader warzonerat discovery downloader infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

jabsgu.kozow.com:6186

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 9 IoCs

rat

resource	yara_rule
behavioral1/memory/1484-80-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat
behavioral1/memory/1484-84-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat
behavioral1/memory/1484-86-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat
behavioral1/memory/1484-93-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat
behavioral1/memory/1484-94-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat
behavioral1/memory/1484-95-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat
behavioral1/memory/1484-96-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat
behavioral1/memory/1484-97-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat
behavioral1/memory/1484-98-0x0000000000400000-0x0000000001462000-memory.dmp	warzonerat

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ESCO-PO-Q10056286.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ESCO-PO-Q10056286.exe

Loads dropped DLL 1 IoCs

pid	Process
1324	ESCO-PO-Q10056286.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1484	ESCO-PO-Q10056286.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1324	ESCO-PO-Q10056286.exe
1484	ESCO-PO-Q10056286.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 1484	1324	ESCO-PO-Q10056286.exe	27

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Ploce50\Underkjolers\Cetes.lnk	ESCO-PO-Q10056286.exe
File opened for modification	C:\Program Files (x86)\Common Files\Udyderne\Nonterminable\Dithionate.ini	ESCO-PO-Q10056286.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1324	ESCO-PO-Q10056286.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1276	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1276	AUDIODG.EXE
Token: 33	1276	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1276	AUDIODG.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1484	1324	ESCO-PO-Q10056286.exe	27
PID 1324 wrote to memory of 1484	1324	ESCO-PO-Q10056286.exe	27
PID 1324 wrote to memory of 1484	1324	ESCO-PO-Q10056286.exe	27
PID 1324 wrote to memory of 1484	1324	ESCO-PO-Q10056286.exe	27
PID 1324 wrote to memory of 1484	1324	ESCO-PO-Q10056286.exe	27

C:\Users\Admin\AppData\Local\Temp\ESCO-PO-Q10056286.exe
"C:\Users\Admin\AppData\Local\Temp\ESCO-PO-Q10056286.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\ESCO-PO-Q10056286.exe
  "C:\Users\Admin\AppData\Local\Temp\ESCO-PO-Q10056286.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy20DB.tmp\System.dll

Filesize
11KB

MD5
be2621a78a13a56cf09e00dd98488360

SHA1
75f0539dc6af200a07cdb056cddddec595c6cfd2

SHA256
852047023ba0cae91c7a43365878613cfb4e64e36ff98c460e113d5088d68ef5

SHA512
b80cf1f678e6885276b9a1bfd9227374b2eb9e38bb20446d52ebe2c3dba89764aa50cb4d49df51a974478f3364b5dbcbc5b4a16dc8f1123b40c89c01725be3d1

Download Submit
memory/1324-71-0x00000000030E0000-0x00000000060DA000-memory.dmp

Filesize
48.0MB

Download
memory/1324-72-0x00000000030E0000-0x00000000060DA000-memory.dmp

Filesize
48.0MB

Download
memory/1484-73-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-74-0x0000000001470000-0x000000000446A000-memory.dmp

Filesize
48.0MB

Download
memory/1484-75-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-76-0x0000000001470000-0x000000000446A000-memory.dmp

Filesize
48.0MB

Download
memory/1484-78-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-80-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-83-0x0000000001470000-0x000000000446A000-memory.dmp

Filesize
48.0MB

Download
memory/1484-84-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-86-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-93-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-94-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-95-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-96-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-97-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1484-98-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing