guloader | 6d9c0d9c7b1d0f53b585be342a9aba75ace2cfaa5293983225781d8eea9d9557

General

Target

MOF%20PRODUCTION%20SDN%20BHD%20STATEMENT%20ACC.zip
Size

814KB
MD5

64f299dc2b09c663c95031ec9b0fab53
SHA1

ed22cd1ee11357ea70565c6f020a0c9092a0a136
SHA256

6d9c0d9c7b1d0f53b585be342a9aba75ace2cfaa5293983225781d8eea9d9557
SHA512

bd36c4a0732a8f6fdde56d47fea6549fb11defd38f9b2a757fd8e20f3a406071221b64e486075276fdf3476c7d19b3e329481dfd31954dd16f9dc3618b6d5083
SSDEEP

24576:IJeEG8fuYFxFTzPGJ3tf9+5NngdV1/poKBwnl:IJA8vnFTzPOV+5Ngdrpyl

Score

10^/10

guloader xworm discovery downloader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

odogwu.mysynology.net:7000

Mutex

ivfnkhmgsIavIQ0A

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/5008-41-0x0000000000A40000-0x0000000000A4E000-memory.dmp	family_xworm

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 1 IoCs

pid	Process
4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe

Loads dropped DLL 1 IoCs

pid	Process
4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Forbrugsafgiftens = "C:\\Users\\Admin\\AppData\\Roaming\\Urena\\Slavearbejdet.exe"	msiexec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
27	5008	msiexec.exe
28	5008	msiexec.exe
30	5008	msiexec.exe
46	5008	msiexec.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5008	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe
5008	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 5008	4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MOF PRODUCTION SDN BHD STATEMENT ACC.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000a000000023b9d-4.dat	nsis_installer_1
behavioral1/files/0x000a000000023b9d-4.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3384	7zFM.exe
3384	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3384	7zFM.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3384	7zFM.exe
Token: 35	3384	7zFM.exe
Token: SeSecurityPrivilege	3384	7zFM.exe
Token: SeDebugPrivilege	5008	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3384	7zFM.exe
3384	7zFM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4972	3384	7zFM.exe	85
PID 3384 wrote to memory of 4972	3384	7zFM.exe	85
PID 3384 wrote to memory of 4972	3384	7zFM.exe	85
PID 4972 wrote to memory of 5008	4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe	99
PID 4972 wrote to memory of 5008	4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe	99
PID 4972 wrote to memory of 5008	4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe	99
PID 4972 wrote to memory of 5008	4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe	99
PID 4972 wrote to memory of 5008	4972	MOF PRODUCTION SDN BHD STATEMENT ACC.exe	99

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MOF%20PRODUCTION%20SDN%20BHD%20STATEMENT%20ACC.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\7zO83D97A87\MOF PRODUCTION SDN BHD STATEMENT ACC.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO83D97A87\MOF PRODUCTION SDN BHD STATEMENT ACC.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO83D97A87\MOF PRODUCTION SDN BHD STATEMENT ACC.exe"
    3⤵
    - Adds Run key to start application
    - Blocklisted process makes network request
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\unalleged.ini

Filesize
48B

MD5
6b5f558854b94cc0edce23431ed1140e

SHA1
fef4f7371e5309ed97897b7c14ae365c9e5bd768

SHA256
9f77a0b985b464abfd10a0be5a69e6f42f05599b95067d342a093f683072754d

SHA512
68b05239a732a0e866563a21ee43ea023391699382bbcf8ac47ab1fdeb5949f3d8c9d5679c7cfd076c39b48499976ab920e4227fcde9779cdd0a56d8162ba0c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO83D97A87\MOF PRODUCTION SDN BHD STATEMENT ACC.exe

Filesize
939KB

MD5
6eca03155bba93d02bea72d1cc8cd578

SHA1
cc0d6aa38080a41861a3d3f5a2fe787cc7629701

SHA256
3735239e56e3d074ad4860e526c5893ba68a0a306a1490339c24eb3df3c67235

SHA512
6f97d8fe67c457f197c37d136741b8c37b5d024341a2c365bc8ffbf0e6852ab7c42caa4447f55bcae5a1d50876debcd88651720b2d1f9ed3b11cbdad6f913ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaBAC5.tmp\System.dll

Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
memory/4972-34-0x0000000005B30000-0x0000000006CBF000-memory.dmp

Filesize
17.6MB

Download
memory/4972-33-0x00000000740F4000-0x00000000740F5000-memory.dmp

Filesize
4KB

Download
memory/4972-32-0x0000000005B30000-0x0000000006CBF000-memory.dmp

Filesize
17.6MB

Download
memory/4972-31-0x0000000005B30000-0x0000000006CBF000-memory.dmp

Filesize
17.6MB

Download
memory/5008-39-0x0000000000A40000-0x0000000001C94000-memory.dmp

Filesize
18.3MB

Download
memory/5008-40-0x0000000000A40000-0x0000000001C94000-memory.dmp

Filesize
18.3MB

Download
memory/5008-41-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/5008-42-0x00000000352E0000-0x000000003537C000-memory.dmp

Filesize
624KB

Download
memory/5008-44-0x0000000035470000-0x00000000354D6000-memory.dmp

Filesize
408KB

Download
memory/5008-46-0x00000000359C0000-0x0000000035A52000-memory.dmp

Filesize
584KB

Download
memory/5008-47-0x0000000036010000-0x00000000365B4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads