guloader | 35b7f8f367d09665365f36797864f1d2cc886b1e338bb55773c4d20bd03b0a44

General

Target

Geo Ltd_doc_Invoice_img_021113210211.exe
Size

402KB
MD5

dc29a3a35a1663ab09f9eaa8c206358d
SHA1

46bd5ff1f3bcee5d6eaa9a83934e285e81c67e8a
SHA256

6aed342a5d0971e9b0b9f962f810d5f439b677905292e744abae9d78a9faacfa
SHA512

836121365cc99519435970993744a9723f19c10476b1caac466b82d393544c57c11ea7f14b0508c304283d2d6266e4025f126abc6e8001e24a30c4ecedf6e413
SSDEEP

6144:EspNjlsz0aRDCs8c8ewoeslml+dHRcHck62PHlvwcSlyuaYit4ylMvKGc:EciTR2seeflHETplvbUyuuWCp

Score

10^/10

guloader nanocore discovery downloader keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

jmtjmt.ddns.net:31286

127.0.0.1:31286

Mutex

46c9bda4-e125-4dd5-a6bc-9534e28e6f57

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2023-04-07T22:07:05.637187936Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
31286
default_group
MILLION
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
46c9bda4-e125-4dd5-a6bc-9534e28e6f57
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
jmtjmt.ddns.net
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Geo Ltd_doc_Invoice_img_021113210211.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 2 IoCs

pid	Process
4476	Geo Ltd_doc_Invoice_img_021113210211.exe
4476	Geo Ltd_doc_Invoice_img_021113210211.exe

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	37.235.1.177
Destination IP	37.235.1.174

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	caspol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder1\\Afspadserer.exe"	caspol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAT Manager = "C:\\Program Files (x86)\\NAT Manager\\natmgr.exe"	caspol.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5100	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4476	Geo Ltd_doc_Invoice_img_021113210211.exe
5100	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 5100	4476	Geo Ltd_doc_Invoice_img_021113210211.exe	101

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NAT Manager\natmgr.exe	caspol.exe
File opened for modification	C:\Program Files (x86)\NAT Manager\natmgr.exe	caspol.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Kommetarer.ini	Geo Ltd_doc_Invoice_img_021113210211.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5100	caspol.exe
5100	caspol.exe
5100	caspol.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5100	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4476	Geo Ltd_doc_Invoice_img_021113210211.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	caspol.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 5100	4476	Geo Ltd_doc_Invoice_img_021113210211.exe	101
PID 4476 wrote to memory of 5100	4476	Geo Ltd_doc_Invoice_img_021113210211.exe	101
PID 4476 wrote to memory of 5100	4476	Geo Ltd_doc_Invoice_img_021113210211.exe	101
PID 4476 wrote to memory of 5100	4476	Geo Ltd_doc_Invoice_img_021113210211.exe	101

C:\Users\Admin\AppData\Local\Temp\Geo Ltd_doc_Invoice_img_021113210211.exe
"C:\Users\Admin\AppData\Local\Temp\Geo Ltd_doc_Invoice_img_021113210211.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\Geo Ltd_doc_Invoice_img_021113210211.exe"
  2⤵
  - Checks QEMU agent file
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:5100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsp8718.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp8718.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp8718.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
memory/4476-144-0x0000000006080000-0x0000000007465000-memory.dmp

Filesize
19.9MB

Download
memory/4476-145-0x0000000006080000-0x0000000007465000-memory.dmp

Filesize
19.9MB

Download
memory/5100-148-0x0000000001380000-0x0000000002765000-memory.dmp

Filesize
19.9MB

Download
memory/5100-146-0x0000000001380000-0x0000000002765000-memory.dmp

Filesize
19.9MB

Download
memory/5100-155-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/5100-157-0x0000000001380000-0x0000000002765000-memory.dmp

Filesize
19.9MB

Download
memory/5100-158-0x0000000033660000-0x0000000033670000-memory.dmp

Filesize
64KB

Download
memory/5100-161-0x0000000033660000-0x0000000033670000-memory.dmp

Filesize
64KB

Download
memory/5100-163-0x0000000033660000-0x0000000033670000-memory.dmp

Filesize
64KB

Download
memory/5100-164-0x0000000033660000-0x0000000033670000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing