guloader | b48a5ebf4d21ce938606b70952e053ff15581a50d96e1e2cec000a8173edade3

General

Target

Remesas Aceptadas_PDF.exe
Size

353KB
MD5

5eac01eb48b833581db348bc8ab49932
SHA1

76adbcf9ffd7c737a513c61412c74a8acb9832d2
SHA256

b48a5ebf4d21ce938606b70952e053ff15581a50d96e1e2cec000a8173edade3
SHA512

dddf71de0f660ef623811091c95f7779ffb14e1974b7fe83c37be570cd5c731470be3d6d2cf67ff2745e7c756acb6cd208c552428a9ddd86e66ff9487d636b2d
SSDEEP

6144:kQ606xiZ8/J8UwuB58YjMo3LNkW0IqWNhPyXgeXyy4WUviQX2EMKedJje:fZ8/Sg8doLOWJd7DdevK

Score

10^/10

guloader downloader

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.clinicademiguel.com
Port:
587
Username:
[email protected]
Password:
consta*46737

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Remesas Aceptadas_PDF.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 2 IoCs

pid	Process
2300	Remesas Aceptadas_PDF.exe
2300	Remesas Aceptadas_PDF.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
11	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1708	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2300	Remesas Aceptadas_PDF.exe
1708	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 1708	2300	Remesas Aceptadas_PDF.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1708	caspol.exe
1708	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2300	Remesas Aceptadas_PDF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	caspol.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1708	2300	Remesas Aceptadas_PDF.exe	28
PID 2300 wrote to memory of 1708	2300	Remesas Aceptadas_PDF.exe	28
PID 2300 wrote to memory of 1708	2300	Remesas Aceptadas_PDF.exe	28
PID 2300 wrote to memory of 1708	2300	Remesas Aceptadas_PDF.exe	28
PID 2300 wrote to memory of 1708	2300	Remesas Aceptadas_PDF.exe	28
PID 2300 wrote to memory of 1708	2300	Remesas Aceptadas_PDF.exe	28

C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso8077.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
\Users\Admin\AppData\Local\Temp\nso8077.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
\Users\Admin\AppData\Local\Temp\nso8077.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
memory/1708-96-0x0000000072DB0000-0x0000000073E12000-memory.dmp

Filesize
16.4MB

Download
memory/1708-97-0x0000000000E00000-0x00000000022C0000-memory.dmp

Filesize
20.8MB

Download
memory/1708-104-0x0000000031590000-0x00000000315D0000-memory.dmp

Filesize
256KB

Download
memory/1708-102-0x00000000726C0000-0x0000000072DAE000-memory.dmp

Filesize
6.9MB

Download
memory/1708-101-0x0000000031590000-0x00000000315D0000-memory.dmp

Filesize
256KB

Download
memory/1708-73-0x0000000000E00000-0x00000000022C0000-memory.dmp

Filesize
20.8MB

Download
memory/1708-74-0x0000000077830000-0x00000000779D9000-memory.dmp

Filesize
1.7MB

Download
memory/1708-75-0x0000000072DB0000-0x0000000073E12000-memory.dmp

Filesize
16.4MB

Download
memory/1708-76-0x0000000000E00000-0x00000000022C0000-memory.dmp

Filesize
20.8MB

Download
memory/1708-100-0x0000000072DB0000-0x0000000072DF4000-memory.dmp

Filesize
272KB

Download
memory/1708-98-0x00000000726C0000-0x0000000072DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2300-69-0x00000000028B0000-0x0000000003D70000-memory.dmp

Filesize
20.8MB

Download
memory/2300-68-0x00000000028B0000-0x0000000003D70000-memory.dmp

Filesize
20.8MB

Download
memory/2300-72-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2300-71-0x0000000077A20000-0x0000000077AF6000-memory.dmp

Filesize
856KB

Download
memory/2300-70-0x0000000077830000-0x00000000779D9000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing