guloader | 5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478.exe
Size

112KB
MD5

9349b201422e4379371e654df66f36d9
SHA1

09f1fef440b74e77b0e042382f2ba0eb50a39c0c
SHA256

5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478
SHA512

d0b70d9899f9d8cc5cd39bb56acb8b7b528b49c9112cee747dd03dda285b6883fdd9c1cace533871d38de242db0fba2e8990737531a36b3bc89221f2beffe342
SSDEEP

1536:ivTyyLKKgDDqwLffBVucXY38Vaj8UNN3jUEQ:/yLFczBVFIMyzNNU

Score

10^/10

guloader discovery downloader guloader

Malware Config

Extracted

Family

guloader

https://drive.google.com/uc?export=download&id=1d8617kLZCNQGn2EFatz6wpYYeqeclOOG

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 2 IoCs

guloader

resource	yara_rule
behavioral1/memory/1820-2-0x00000000002D0000-0x00000000002DD000-memory.dmp	family_guloader
behavioral1/memory/1820-5-0x00000000002D0000-0x00000000002DD000-memory.dmp	family_guloader

Checks QEMU agent state file 2 TTPs 1 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1820	5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1820	5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478.exe

C:\Users\Admin\AppData\Local\Temp\5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478.exe
"C:\Users\Admin\AppData\Local\Temp\5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478.exe"
1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-2-0x00000000002D0000-0x00000000002DD000-memory.dmp

Filesize
52KB

Download
memory/1820-3-0x0000000076DF1000-0x0000000076EF2000-memory.dmp

Filesize
1.0MB

Download
memory/1820-4-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/1820-5-0x00000000002D0000-0x00000000002DD000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads