guloader | 727df276f28733a6ed86cfaeb18de7837563be2861148b9bed59e0103d1f0eb6

General

Target

detalle_transferencia_28-01-2025_4844830.exe
Size

811KB
MD5

71dfa22f384cc9fd4a1dc0cc767208a3
SHA1

3ae8bf9561fa09829d1c7f77ac17ff005cb8f8b6
SHA256

c1713a4d1fea88be492ec6fbdc9b1e793d5d7972f0f538b71a0da0c318ada360
SHA512

85b5f965c3170456e13d3b1bd3418bad6384383fa71ad074cc34f5827ed6954d21f69635133fa277fa3022c0f46138edbaf49348acecd1b7c7be3082682f5682
SSDEEP

12288:CGuLXqLB7gdFrs981KuAwrgzQcHH0pqkwgVvpJBiniH:CGuDqLiFQ99wrggvDXfCiH

Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
webmail.segurcisa.com
Port:
587
Username:
[email protected]
Password:
Segurpas$,12z
Email To:
[email protected]

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 1 IoCs

pid	Process
2860	detalle_transferencia_28-01-2025_4844830.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	checkip.dyndns.org
16	reallyfreegeoip.org
17	reallyfreegeoip.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2648	detalle_transferencia_28-01-2025_4844830.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2860	detalle_transferencia_28-01-2025_4844830.exe
2648	detalle_transferencia_28-01-2025_4844830.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2648	2860	detalle_transferencia_28-01-2025_4844830.exe	30

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\workshops\carlotta.pan	detalle_transferencia_28-01-2025_4844830.exe
File opened for modification	C:\Windows\Fonts\skrivepapirets\teksteditor.Uns71	detalle_transferencia_28-01-2025_4844830.exe
File opened for modification	C:\Windows\resources\acupunctuate.Ner	detalle_transferencia_28-01-2025_4844830.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	detalle_transferencia_28-01-2025_4844830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	detalle_transferencia_28-01-2025_4844830.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2648	detalle_transferencia_28-01-2025_4844830.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2860	detalle_transferencia_28-01-2025_4844830.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	detalle_transferencia_28-01-2025_4844830.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2648	2860	detalle_transferencia_28-01-2025_4844830.exe	30
PID 2860 wrote to memory of 2648	2860	detalle_transferencia_28-01-2025_4844830.exe	30
PID 2860 wrote to memory of 2648	2860	detalle_transferencia_28-01-2025_4844830.exe	30
PID 2860 wrote to memory of 2648	2860	detalle_transferencia_28-01-2025_4844830.exe	30
PID 2860 wrote to memory of 2648	2860	detalle_transferencia_28-01-2025_4844830.exe	30
PID 2860 wrote to memory of 2648	2860	detalle_transferencia_28-01-2025_4844830.exe	30

C:\Users\Admin\AppData\Local\Temp\detalle_transferencia_28-01-2025_4844830.exe
"C:\Users\Admin\AppData\Local\Temp\detalle_transferencia_28-01-2025_4844830.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\detalle_transferencia_28-01-2025_4844830.exe
  "C:\Users\Admin\AppData\Local\Temp\detalle_transferencia_28-01-2025_4844830.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\pentaiodide\Unmeliorated\Desultorily94\realskolers.ini

Filesize
4KB

MD5
b5140476e3ce1e99ba63684ee8928c17

SHA1
0c8a10afe35ecfade9cd27ce42d00a9bd769ec9b

SHA256
b5720f621a448e3b7d2bbbbd81ef2af51c7caf2f87136a1d5130ff0290696340

SHA512
6c082ea6df22e5a0552b03381ee23306d3d49246a56c192698a300bb789bb4e37fed0b48ef5d398264cb4cff7ce8490f2fc0d4b0bf1e87f14d9e437f236fb810

Download Submit
\Users\Admin\AppData\Local\Temp\nse3007.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
memory/2648-30-0x0000000077BD0000-0x0000000077D79000-memory.dmp

Filesize
1.7MB

Download
memory/2648-53-0x0000000000810000-0x0000000001872000-memory.dmp

Filesize
16.4MB

Download
memory/2648-54-0x0000000000810000-0x0000000001872000-memory.dmp

Filesize
16.4MB

Download
memory/2648-55-0x0000000000810000-0x0000000000858000-memory.dmp

Filesize
288KB

Download
memory/2860-26-0x0000000003810000-0x0000000004392000-memory.dmp

Filesize
11.5MB

Download
memory/2860-27-0x0000000003810000-0x0000000004392000-memory.dmp

Filesize
11.5MB

Download
memory/2860-29-0x0000000077BD0000-0x0000000077D79000-memory.dmp

Filesize
1.7MB

Download
memory/2860-28-0x0000000077BD1000-0x0000000077CD2000-memory.dmp

Filesize
1.0MB

Download
memory/2860-31-0x0000000003810000-0x0000000004392000-memory.dmp

Filesize
11.5MB

Download

Analysis

Sharing