guloader | 30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3

General

Target

30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe
Size

136KB
MD5

82c4a21d4ca4a085260dd4b6dc07b258
SHA1

d115a2668ec1acec9e652387e9ee04ce39e1ff73
SHA256

30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3
SHA512

4f23d20c5ccaadc998bceeee3c8e86d2cba427ed7d3b6e9278c3ba3790d3b7530ab9be2ac1db4e5a8e401ea0f13500b08ce47cbea2c01fd66d0c526d6e1a8f0f
SSDEEP

1536:7uQk9P70nl81EqOrI0goTQJ6ww7koXXyqqGphcZvnw2T:i9D+81EDmAQVwIoYnhnHT

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4392	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe
2992	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4392 set thread context of 2992	4392	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4392	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4392	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2992	4392	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe	86
PID 4392 wrote to memory of 2992	4392	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe	86
PID 4392 wrote to memory of 2992	4392	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe	86
PID 4392 wrote to memory of 2992	4392	30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe	86

C:\Users\Admin\AppData\Local\Temp\30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe
"C:\Users\Admin\AppData\Local\Temp\30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe"
1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe
  "C:\Users\Admin\AppData\Local\Temp\30b79d2f93f26a0be391c6fced148424a242303fae3de117cf8b8d2121ff5bc3.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\39154BC098F8D099CA8351CC7D4C5A31

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\39154BC098F8D099CA8351CC7D4C5A31

Filesize
420B

MD5
44dbaf7daeb942bd7666c91f608541e3

SHA1
4e382298657d97071ffaef2c657875fcd4bd7294

SHA256
fd1d4ea109fc7463c50ae227ed3ec991a92f42055aea5e343a7e9a2e017a843f

SHA512
cc259bd96da1e37aed15a14ee210a71bc68fda0425664f2e9855a3916ff9fa3e42a9092f4476f0861360a3cefcf2cd221302dcb8009de75cb01c0dd99c17743f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\39154BC098F8D099CA8351CC7D4C5A31

Filesize
420B

MD5
b5e0f335046f2f20decfcb99ab91cef4

SHA1
5d3cec5b5b7667302ff113a05b2dd9ce39df9a57

SHA256
4f4541836aca8da064833369dc2dd7110e619010fe3bdecb39edb5bbf9444873

SHA512
48a20385c236dd049e6ada491adb68f7a2914904682bd791c99f51ae5209f292e2cff8a0c08dcfac54a549886acf060b6da21d86da59d6a7084c6bc9c2945616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\39154BC098F8D099CA8351CC7D4C5A31

Filesize
420B

MD5
48d35ddfbee66b22d2887860a8118583

SHA1
8cc60a3789526dd8699975c8039804133ebd7fe7

SHA256
250d4abfeb4c2a781935b4d079dd19a30106527f889926cbc0a379c1d4719206

SHA512
420f4599a0182ef9d4c91f6ae0eca2f03e8cd8748404215bcc0e2c6c8e100bf55ea5a86984be0851b54f35caaf713202a8a9f7a83204f278eeb6e17c8f129d79

Download Submit
memory/2992-11-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/2992-5-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/2992-9-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/2992-10-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/4392-7-0x0000000076EF1000-0x0000000077011000-memory.dmp

Filesize
1.1MB

Download
memory/4392-8-0x0000000002210000-0x0000000002226000-memory.dmp

Filesize
88KB

Download
memory/4392-2-0x0000000002210000-0x0000000002226000-memory.dmp

Filesize
88KB

Download
memory/4392-4-0x0000000002210000-0x0000000002226000-memory.dmp

Filesize
88KB

Download
memory/4392-3-0x0000000076EF1000-0x0000000077011000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing