guloader | b48a5ebf4d21ce938606b70952e053ff15581a50d96e1e2cec000a8173edade3

General

Target

Remesas Aceptadas_PDF.exe
Size

353KB
MD5

5eac01eb48b833581db348bc8ab49932
SHA1

76adbcf9ffd7c737a513c61412c74a8acb9832d2
SHA256

b48a5ebf4d21ce938606b70952e053ff15581a50d96e1e2cec000a8173edade3
SHA512

dddf71de0f660ef623811091c95f7779ffb14e1974b7fe83c37be570cd5c731470be3d6d2cf67ff2745e7c756acb6cd208c552428a9ddd86e66ff9487d636b2d
SSDEEP

6144:kQ606xiZ8/J8UwuB58YjMo3LNkW0IqWNhPyXgeXyy4WUviQX2EMKedJje:fZ8/Sg8doLOWJd7DdevK

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Remesas Aceptadas_PDF.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 2 IoCs

pid	Process
3804	Remesas Aceptadas_PDF.exe
3804	Remesas Aceptadas_PDF.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	api.ipify.org
38	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4388	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3804	Remesas Aceptadas_PDF.exe
4388	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3804 set thread context of 4388	3804	Remesas Aceptadas_PDF.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	4388	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4388	caspol.exe
4388	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3804	Remesas Aceptadas_PDF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	caspol.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4388	3804	Remesas Aceptadas_PDF.exe	90
PID 3804 wrote to memory of 4388	3804	Remesas Aceptadas_PDF.exe	90
PID 3804 wrote to memory of 4388	3804	Remesas Aceptadas_PDF.exe	90
PID 3804 wrote to memory of 4388	3804	Remesas Aceptadas_PDF.exe	90
PID 3804 wrote to memory of 4388	3804	Remesas Aceptadas_PDF.exe	90

C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas_PDF.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 2540
    3⤵
    - Program crash
    PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4388 -ip 4388
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsx80AA.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx80AA.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx80AA.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
memory/3804-145-0x0000000002860000-0x0000000003D20000-memory.dmp

Filesize
20.8MB

Download
memory/3804-146-0x0000000002860000-0x0000000003D20000-memory.dmp

Filesize
20.8MB

Download
memory/3804-147-0x0000000077D31000-0x0000000077E51000-memory.dmp

Filesize
1.1MB

Download
memory/3804-148-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/4388-152-0x0000000073D10000-0x0000000074F64000-memory.dmp

Filesize
18.3MB

Download
memory/4388-168-0x0000000072650000-0x0000000072E00000-memory.dmp

Filesize
7.7MB

Download
memory/4388-151-0x0000000000B00000-0x0000000001FC0000-memory.dmp

Filesize
20.8MB

Download
memory/4388-149-0x0000000000B00000-0x0000000001FC0000-memory.dmp

Filesize
20.8MB

Download
memory/4388-153-0x0000000077DD5000-0x0000000077DD6000-memory.dmp

Filesize
4KB

Download
memory/4388-166-0x0000000073D10000-0x0000000074F64000-memory.dmp

Filesize
18.3MB

Download
memory/4388-167-0x0000000000B00000-0x0000000001FC0000-memory.dmp

Filesize
20.8MB

Download
memory/4388-150-0x0000000077DB8000-0x0000000077DB9000-memory.dmp

Filesize
4KB

Download
memory/4388-169-0x0000000073D10000-0x0000000073D54000-memory.dmp

Filesize
272KB

Download
memory/4388-170-0x0000000034EC0000-0x0000000035464000-memory.dmp

Filesize
5.6MB

Download
memory/4388-171-0x0000000077D31000-0x0000000077E51000-memory.dmp

Filesize
1.1MB

Download
memory/4388-173-0x0000000034890000-0x00000000348F6000-memory.dmp

Filesize
408KB

Download
memory/4388-174-0x00000000349F0000-0x0000000034A00000-memory.dmp

Filesize
64KB

Download
memory/4388-175-0x0000000000B00000-0x0000000001FC0000-memory.dmp

Filesize
20.8MB

Download
memory/4388-177-0x0000000072650000-0x0000000072E00000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing