guloader | a246e12a4ba2de87f50d1aeedacf5e474412d243c18c8f7bf1d69338733adcad

General

Target

Telescribe.exe
Size

1.3MB
MD5

ee518fda96d7cb89bad8783aeab7e6fa
SHA1

5dced89b75ece47f8e8c0b19082ed97448f83964
SHA256

cd25f94f8e22e1ca4f4bb2f65a4d904aaa01b57445284b1cf5ea9572873d2b4a
SHA512

b92c661cc02640f4cbc1641b78005d84d176305af07caa92cb26441b0fcb831c31c79db7b5af69d2e331bf5ea1d28f9aa790fc7127cb58fae2224b111275f13b
SSDEEP

24576:d9Q0lIVTRJLpdCW9zTIvwS60x6Hcy/U77VaaG8uosbrDqa1VHWTcSdmWDxbLn/oY:rQ0lsRdpdBTIYS6VDM77YoOrDX1l2xbv

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Loads dropped DLL 1 IoCs

Processes:

Telescribe.exe

pid process

1232 Telescribe.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 drive.google.com
5 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Telescribe.exe

pid process

1648 Telescribe.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Telescribe.exeTelescribe.exe

pid process

1232 Telescribe.exe
1648 Telescribe.exe

pid	process
1232	Telescribe.exe

flow	ioc
3	drive.google.com
5	drive.google.com

pid	process
1232	Telescribe.exe
1648	Telescribe.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Telescribe.exeTelescribe.exewrite.exe

description	pid	process	target process
PID 1232 set thread context of 1648	1232	Telescribe.exe	Telescribe.exe
PID 1648 set thread context of 1200	1648	Telescribe.exe	Explorer.EXE
PID 1648 set thread context of 328	1648	Telescribe.exe	write.exe
PID 328 set thread context of 1200	328	write.exe	Explorer.EXE

Drops file in Program Files directory 1 IoCs

Processes:

Telescribe.exe

description ioc process

File opened for modification C:\Program Files (x86)\konvoluterer\Forsikringsinspektrer.ini Telescribe.exe
Drops file in Windows directory 1 IoCs

Processes:

Telescribe.exe

description ioc process

File opened for modification C:\Windows\mycelian\sempitern.ini Telescribe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Program Files (x86)\konvoluterer\Forsikringsinspektrer.ini	Telescribe.exe

description	ioc	process
File opened for modification	C:\Windows\mycelian\sempitern.ini	Telescribe.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

Telescribe.exewrite.exe

pid	process
1648	Telescribe.exe
1648	Telescribe.exe
1648	Telescribe.exe
1648	Telescribe.exe
1648	Telescribe.exe
1648	Telescribe.exe
1648	Telescribe.exe
1648	Telescribe.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe
328	write.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Telescribe.exeTelescribe.exewrite.exe

pid process

1232 Telescribe.exe
1648 Telescribe.exe
1648 Telescribe.exe
328 write.exe
328 write.exe

pid	process
1232	Telescribe.exe
1648	Telescribe.exe
1648	Telescribe.exe
328	write.exe
328	write.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Telescribe.exeTelescribe.exe

description	pid	process	target process
PID 1232 wrote to memory of 1648	1232	Telescribe.exe	Telescribe.exe
PID 1232 wrote to memory of 1648	1232	Telescribe.exe	Telescribe.exe
PID 1232 wrote to memory of 1648	1232	Telescribe.exe	Telescribe.exe
PID 1232 wrote to memory of 1648	1232	Telescribe.exe	Telescribe.exe
PID 1232 wrote to memory of 1648	1232	Telescribe.exe	Telescribe.exe
PID 1232 wrote to memory of 1648	1232	Telescribe.exe	Telescribe.exe
PID 1648 wrote to memory of 328	1648	Telescribe.exe	write.exe
PID 1648 wrote to memory of 328	1648	Telescribe.exe	write.exe
PID 1648 wrote to memory of 328	1648	Telescribe.exe	write.exe
PID 1648 wrote to memory of 328	1648	Telescribe.exe	write.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200

C:\Users\Admin\AppData\Local\Temp\Telescribe.exe
"C:\Users\Admin\AppData\Local\Temp\Telescribe.exe"
2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\Telescribe.exe
"C:\Users\Admin\AppData\Local\Temp\Telescribe.exe"
3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\write.exe
"C:\Windows\SysWOW64\write.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi1B7E.tmp\System.dll

Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
memory/328-74-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/328-71-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1232-62-0x0000000003820000-0x0000000005841000-memory.dmp

Filesize
32.1MB

Download
memory/1232-33-0x0000000003820000-0x0000000005841000-memory.dmp

Filesize
32.1MB

Download
memory/1232-34-0x0000000077861000-0x0000000077962000-memory.dmp

Filesize
1.0MB

Download
memory/1232-35-0x0000000077860000-0x0000000077A09000-memory.dmp

Filesize
1.7MB

Download
memory/1232-37-0x0000000003820000-0x0000000005841000-memory.dmp

Filesize
32.1MB

Download
memory/1648-38-0x0000000077860000-0x0000000077A09000-memory.dmp

Filesize
1.7MB

Download
memory/1648-61-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1648-63-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1648-69-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1648-39-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1648-72-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1648-36-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads