guloader | 15c55fd5158febe95f1e54f73a9388e77b1974d6983d6fad4c7dac8961ce71bb

General

Target

Rebuffed.exe
Size

1.2MB
MD5

4f56cd3f66574df8c5d4969a7a731832
SHA1

790d9b9d9dd45ae834139158a993721ab74ac3f4
SHA256

15c55fd5158febe95f1e54f73a9388e77b1974d6983d6fad4c7dac8961ce71bb
SHA512

fce4942401bd50931bc28e51f071764f7107c3094aa8dfe3125bed66f55f7361e2c7b6174fcdb6b68c6fb5ec3d47af4f2f3402619eb7e8768ed150812dd9a070
SSDEEP

24576:2RYkWmWEPOh5Wr++qiOKpTnDeSsp1jQW3GwiAtsp1kt4KdAZJO3FqdPH5oUPhZ:8YoW3WrtsKpTYpyW3GwY6tMqOz3

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Rebuffed.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Rebuffed.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\International\Geo\Nation	Rebuffed.exe

Loads dropped DLL 1 IoCs

pid	Process
2224	Rebuffed.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2092	Rebuffed.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2224	Rebuffed.exe
2092	Rebuffed.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2092	2224	Rebuffed.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe
2092	Rebuffed.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2224	Rebuffed.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	Rebuffed.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2092	2224	Rebuffed.exe	28
PID 2224 wrote to memory of 2092	2224	Rebuffed.exe	28
PID 2224 wrote to memory of 2092	2224	Rebuffed.exe	28
PID 2224 wrote to memory of 2092	2224	Rebuffed.exe	28
PID 2224 wrote to memory of 2092	2224	Rebuffed.exe	28
PID 2224 wrote to memory of 2092	2224	Rebuffed.exe	28

C:\Users\Admin\AppData\Local\Temp\Rebuffed.exe
"C:\Users\Admin\AppData\Local\Temp\Rebuffed.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\Rebuffed.exe
  "C:\Users\Admin\AppData\Local\Temp\Rebuffed.exe"
  2⤵
  - Checks QEMU agent file
  - Checks computer location settings
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsj6AB6.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
memory/2092-28-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2092-27-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download
memory/2092-56-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2092-55-0x00000000323E0000-0x00000000326E3000-memory.dmp

Filesize
3.0MB

Download
memory/2092-54-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2092-22-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2092-23-0x0000000001470000-0x000000000205E000-memory.dmp

Filesize
11.9MB

Download
memory/2092-24-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download
memory/2092-53-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2092-25-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2092-26-0x0000000001470000-0x000000000205E000-memory.dmp

Filesize
11.9MB

Download
memory/2092-52-0x0000000001470000-0x000000000205E000-memory.dmp

Filesize
11.9MB

Download
memory/2092-51-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2224-17-0x0000000003370000-0x0000000003F5E000-memory.dmp

Filesize
11.9MB

Download
memory/2224-18-0x0000000003370000-0x0000000003F5E000-memory.dmp

Filesize
11.9MB

Download
memory/2224-21-0x0000000074580000-0x0000000074586000-memory.dmp

Filesize
24KB

Download
memory/2224-20-0x0000000077220000-0x00000000772F6000-memory.dmp

Filesize
856KB

Download
memory/2224-19-0x0000000077030000-0x00000000771D9000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads