guloader | 8f53c4425f6546c0570e1893297ebc337d01017cc188803e303c53d106ebc501

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe
Size

24.6MB
MD5

13d3828002bbe548ed0b85321e15c72c
SHA1

1a57c0a1a828410079e01792ab8d5d5ee27a4640
SHA256

e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16
SHA512

d1502648a5865b434f380b13cf8fd65c9ef2bc36c8a5d00fd98d568d6a1529c29c1553808147570796de23d176906a09f16523166c4c2f05e3af00c198d290b9
SSDEEP

786432:G2ycRL+5PgCSQ9uzzZG0H/L3hKFs8gIxo+cWF:G2y2LUoKQzms8doNm

Score

10^/10

guloader discovery downloader persistence

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ieinstal.exe

Loads dropped DLL 2 IoCs

pid	Process
2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe
2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kundeafdelinger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ggen\\Rotundity.exe"	ieinstal.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe
2984	ieinstal.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieinstal.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe
Token: SeBackupPrivilege	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe
Token: SeBackupPrivilege	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31
PID 2000 wrote to memory of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31
PID 2000 wrote to memory of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31
PID 2000 wrote to memory of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31
PID 2000 wrote to memory of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31
PID 2000 wrote to memory of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31
PID 2000 wrote to memory of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31
PID 2000 wrote to memory of 2984	2000	e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe	31

C:\Users\Admin\AppData\Local\Temp\e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe
"C:\Users\Admin\AppData\Local\Temp\e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Users\Admin\AppData\Local\Temp\e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16.exe"
  2⤵
  - Checks QEMU agent file
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Midterpartiets\icon-cli.icns

Filesize
1KB

MD5
5343c1a8b203c162a3bf3870d9f50fd4

SHA1
04b5b886c20d88b57eea6d8ff882624a4ac1e51d

SHA256
dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

SHA512
e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB695.tmp\Math.dll

Filesize
67KB

MD5
85428cf1f140e5023f4c9d179b704702

SHA1
1b51213ddbaedfffb7e7f098f172f1d4e5c9efba

SHA256
8d9a23dd2004b68c0d2e64e6c6ad330d0c648bffe2b9f619a1e9760ef978207a

SHA512
dfe7f9f3030485caf30ec631424120030c3985df778993342a371bf1724fa84aa885b4e466c6f6b356d99cc24e564b9c702c7bcdd33052172e0794c2fdecce59

Download Submit
\Users\Admin\AppData\Local\Temp\nsjB695.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/2000-161-0x00000000041C0000-0x00000000042C0000-memory.dmp

Filesize
1024KB

Download
memory/2000-162-0x0000000077861000-0x0000000077962000-memory.dmp

Filesize
1.0MB

Download
memory/2000-163-0x0000000077860000-0x0000000077A09000-memory.dmp

Filesize
1.7MB

Download
memory/2000-164-0x00000000041C0000-0x00000000042C0000-memory.dmp

Filesize
1024KB

Download
memory/2000-174-0x00000000041C0000-0x00000000042C0000-memory.dmp

Filesize
1024KB

Download
memory/2984-165-0x0000000000210000-0x0000000000310000-memory.dmp

Filesize
1024KB

Download
memory/2984-166-0x0000000077860000-0x0000000077A09000-memory.dmp

Filesize
1.7MB

Download
memory/2984-168-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads