guloader | b3e618e03a6a13a384e51f7056adfee8ff2cd040d1fb91b3890ddf494409454b

General

Target

Fra_PS233_R3320-4583_377025.exe
Size

507KB
MD5

145143dc8846d313c2c9b1de1ef2aa35
SHA1

e62adeac996f740de7507fc8f3812974f399b5bc
SHA256

22e815bd29c2eaa9fde1fa988a67d39aaa0402f9a9a4756af56dbc86cb8dba95
SHA512

ff09268bb40304c04799f2df42e55cf0928a03ed83c3a17aec9f2ec0cbf2d71ebbfb17d8cd53c4fb119d5a1b4a35837ffccc680816862b9b40e700e14f87d30c
SSDEEP

12288:7toNXswQNVrXbT6pzkWv4+RUezMpbbH8IO61Y:idYLrf6pzkWv4+Rk8g

Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7807279596:AAEZM1QwkCh738-y0Qmnc3ubaoLMl6bUCVw/sendMessage?chat_id=7267131103

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger
Loads dropped DLL 1 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exe

pid process

1992 Fra_PS233_R3320-4583_377025.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 drive.google.com
5 drive.google.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 checkip.dyndns.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exe

pid process

2800 Fra_PS233_R3320-4583_377025.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exeFra_PS233_R3320-4583_377025.exe

pid process

1992 Fra_PS233_R3320-4583_377025.exe
2800 Fra_PS233_R3320-4583_377025.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exe

description pid process target process

PID 1992 set thread context of 2800 1992 Fra_PS233_R3320-4583_377025.exe Fra_PS233_R3320-4583_377025.exe
Drops file in Windows directory 1 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exe

description ioc process

File opened for modification C:\Windows\Fonts\Sompner\krmmer.thy Fra_PS233_R3320-4583_377025.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1992	Fra_PS233_R3320-4583_377025.exe

flow	ioc
4	drive.google.com
5	drive.google.com

flow	ioc
14	checkip.dyndns.org

pid	process
2800	Fra_PS233_R3320-4583_377025.exe

pid	process
1992	Fra_PS233_R3320-4583_377025.exe
2800	Fra_PS233_R3320-4583_377025.exe

description	pid	process	target process
PID 1992 set thread context of 2800	1992	Fra_PS233_R3320-4583_377025.exe	Fra_PS233_R3320-4583_377025.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\Sompner\krmmer.thy	Fra_PS233_R3320-4583_377025.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Fra_PS233_R3320-4583_377025.exeFra_PS233_R3320-4583_377025.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fra_PS233_R3320-4583_377025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fra_PS233_R3320-4583_377025.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exe

pid process

2800 Fra_PS233_R3320-4583_377025.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exe

pid process

1992 Fra_PS233_R3320-4583_377025.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exe

description pid process

Token: SeDebugPrivilege 2800 Fra_PS233_R3320-4583_377025.exe

pid	process
2800	Fra_PS233_R3320-4583_377025.exe

pid	process
1992	Fra_PS233_R3320-4583_377025.exe

description	pid	process
Token: SeDebugPrivilege	2800	Fra_PS233_R3320-4583_377025.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Fra_PS233_R3320-4583_377025.exe

description	pid	process	target process
PID 1992 wrote to memory of 2800	1992	Fra_PS233_R3320-4583_377025.exe	Fra_PS233_R3320-4583_377025.exe
PID 1992 wrote to memory of 2800	1992	Fra_PS233_R3320-4583_377025.exe	Fra_PS233_R3320-4583_377025.exe
PID 1992 wrote to memory of 2800	1992	Fra_PS233_R3320-4583_377025.exe	Fra_PS233_R3320-4583_377025.exe
PID 1992 wrote to memory of 2800	1992	Fra_PS233_R3320-4583_377025.exe	Fra_PS233_R3320-4583_377025.exe
PID 1992 wrote to memory of 2800	1992	Fra_PS233_R3320-4583_377025.exe	Fra_PS233_R3320-4583_377025.exe
PID 1992 wrote to memory of 2800	1992	Fra_PS233_R3320-4583_377025.exe	Fra_PS233_R3320-4583_377025.exe

C:\Users\Admin\AppData\Local\Temp\Fra_PS233_R3320-4583_377025.exe
"C:\Users\Admin\AppData\Local\Temp\Fra_PS233_R3320-4583_377025.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\Fra_PS233_R3320-4583_377025.exe
  "C:\Users\Admin\AppData\Local\Temp\Fra_PS233_R3320-4583_377025.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsjAC87.tmp\System.dll

Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
memory/1992-10-0x0000000003EE0000-0x0000000006DD2000-memory.dmp

Filesize
46.9MB

Download
memory/1992-12-0x0000000076E50000-0x0000000076FF9000-memory.dmp

Filesize
1.7MB

Download
memory/1992-11-0x0000000076E51000-0x0000000076F52000-memory.dmp

Filesize
1.0MB

Download
memory/1992-14-0x0000000003EE0000-0x0000000006DD2000-memory.dmp

Filesize
46.9MB

Download
memory/1992-13-0x0000000077040000-0x0000000077116000-memory.dmp

Filesize
856KB

Download
memory/2800-15-0x0000000076E50000-0x0000000076FF9000-memory.dmp

Filesize
1.7MB

Download
memory/2800-22-0x0000000000470000-0x00000000014D2000-memory.dmp

Filesize
16.4MB

Download
memory/2800-36-0x0000000000470000-0x00000000014D2000-memory.dmp

Filesize
16.4MB

Download
memory/2800-37-0x0000000000470000-0x00000000004B8000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing