guloader | 72b1c85eede5ca8c04c1d472cd2ea3a86e7442c4933105c50fb0484d1f4c5ad0

General

Target

Telescribe.exe
Size

1.3MB
MD5

ee518fda96d7cb89bad8783aeab7e6fa
SHA1

5dced89b75ece47f8e8c0b19082ed97448f83964
SHA256

cd25f94f8e22e1ca4f4bb2f65a4d904aaa01b57445284b1cf5ea9572873d2b4a
SHA512

b92c661cc02640f4cbc1641b78005d84d176305af07caa92cb26441b0fcb831c31c79db7b5af69d2e331bf5ea1d28f9aa790fc7127cb58fae2224b111275f13b
SSDEEP

24576:d9Q0lIVTRJLpdCW9zTIvwS60x6Hcy/U77VaaG8uosbrDqa1VHWTcSdmWDxbLn/oY:rQ0lsRdpdBTIYS6VDM77YoOrDX1l2xbv

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

Telescribe.exe

pid process

400 Telescribe.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

29 drive.google.com
30 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Telescribe.exe

pid process

4616 Telescribe.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Telescribe.exeTelescribe.exe

pid process

400 Telescribe.exe
4616 Telescribe.exe

pid	process
400	Telescribe.exe

flow	ioc
29	drive.google.com
30	drive.google.com

pid	process
400	Telescribe.exe
4616	Telescribe.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

Telescribe.exeTelescribe.exewrite.exe

description	pid	process	target process
PID 400 set thread context of 4616	400	Telescribe.exe	Telescribe.exe
PID 4616 set thread context of 3516	4616	Telescribe.exe	Explorer.EXE
PID 4616 set thread context of 1196	4616	Telescribe.exe	write.exe
PID 1196 set thread context of 3516	1196	write.exe	Explorer.EXE
PID 1196 set thread context of 4740	1196	write.exe	Firefox.exe

Drops file in Program Files directory 1 IoCs

Processes:

Telescribe.exe

description ioc process

File opened for modification C:\Program Files (x86)\konvoluterer\Forsikringsinspektrer.ini Telescribe.exe
Drops file in Windows directory 1 IoCs

Processes:

Telescribe.exe

description ioc process

File opened for modification C:\Windows\mycelian\sempitern.ini Telescribe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Program Files (x86)\konvoluterer\Forsikringsinspektrer.ini	Telescribe.exe

description	ioc	process
File opened for modification	C:\Windows\mycelian\sempitern.ini	Telescribe.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

write.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	write.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

Telescribe.exewrite.exe

pid	process
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Telescribe.exeTelescribe.exewrite.exe

pid process

400 Telescribe.exe
4616 Telescribe.exe
4616 Telescribe.exe
1196 write.exe
1196 write.exe
1196 write.exe
1196 write.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3516 Explorer.EXE

pid	process
400	Telescribe.exe
4616	Telescribe.exe
4616	Telescribe.exe
1196	write.exe
1196	write.exe
1196	write.exe
1196	write.exe

pid	process
3516	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Telescribe.exeTelescribe.exewrite.exe

description	pid	process	target process
PID 400 wrote to memory of 4616	400	Telescribe.exe	Telescribe.exe
PID 400 wrote to memory of 4616	400	Telescribe.exe	Telescribe.exe
PID 400 wrote to memory of 4616	400	Telescribe.exe	Telescribe.exe
PID 400 wrote to memory of 4616	400	Telescribe.exe	Telescribe.exe
PID 400 wrote to memory of 4616	400	Telescribe.exe	Telescribe.exe
PID 4616 wrote to memory of 1196	4616	Telescribe.exe	write.exe
PID 4616 wrote to memory of 1196	4616	Telescribe.exe	write.exe
PID 4616 wrote to memory of 1196	4616	Telescribe.exe	write.exe
PID 1196 wrote to memory of 4740	1196	write.exe	Firefox.exe
PID 1196 wrote to memory of 4740	1196	write.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3516

C:\Users\Admin\AppData\Local\Temp\Telescribe.exe
"C:\Users\Admin\AppData\Local\Temp\Telescribe.exe"
2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:400

C:\Users\Admin\AppData\Local\Temp\Telescribe.exe
"C:\Users\Admin\AppData\Local\Temp\Telescribe.exe"
3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4616

C:\Windows\SysWOW64\write.exe
"C:\Windows\SysWOW64\write.exe"
4⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1196

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
5⤵
PID:4740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsm3F1E.tmp\System.dll
Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
memory/400-37-0x0000000004B10000-0x0000000006B31000-memory.dmp

Filesize
32.1MB

Download
memory/400-32-0x0000000004B10000-0x0000000006B31000-memory.dmp

Filesize
32.1MB

Download
memory/400-33-0x0000000077B51000-0x0000000077C71000-memory.dmp

Filesize
1.1MB

Download
memory/400-34-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/400-51-0x0000000004B10000-0x0000000006B31000-memory.dmp

Filesize
32.1MB

Download
memory/1196-57-0x0000000000860000-0x000000000089F000-memory.dmp

Filesize
252KB

Download
memory/1196-60-0x0000000000860000-0x000000000089F000-memory.dmp

Filesize
252KB

Download
memory/3516-61-0x00000000082F0000-0x000000000840D000-memory.dmp

Filesize
1.1MB

Download
memory/4616-50-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4616-36-0x0000000001660000-0x0000000003681000-memory.dmp

Filesize
32.1MB

Download
memory/4616-52-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4616-53-0x0000000001660000-0x0000000003681000-memory.dmp

Filesize
32.1MB

Download
memory/4616-56-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4616-35-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4616-58-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4616-59-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/4740-68-0x000001FD589C0000-0x000001FD58ADD000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads