guloader | dfb9d2234149f933add8bb7682094fa32430f41f34061b077776cecaa0a7ce16

General

Target

5646654.exe
Size

575KB
MD5

09f7f6f3e306a2909543d9ac199c7c0a
SHA1

3cbef0b139ee88916c063c2375b9ae4150ff4a4a
SHA256

dfb9d2234149f933add8bb7682094fa32430f41f34061b077776cecaa0a7ce16
SHA512

98d0becf921388a270d62361f772a493f83aaa9c839bfa80584ffd9307969b05147b1d309f4bd51dd86aaedafb1407e7c392ce6f8d3be53e9e5ece7064eac1de
SSDEEP

12288:Gk2YLS3JInQZNEjCxOV4AAm3R3W6TRVZdMN:TLKInQriCxOV4ARR1ZdM

Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7581561605:AAGI-5iG4DeXqVhNDvhaICvGbOejumUD6AE/sendMessage?chat_id=5434550993

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 6 IoCs

pid	Process
2336	5646654.exe
2336	5646654.exe
2336	5646654.exe
2336	5646654.exe
2336	5646654.exe
2336	5646654.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	checkip.dyndns.org
16	reallyfreegeoip.org
17	reallyfreegeoip.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\equity.Mag	5646654.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1800	5646654.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2336	5646654.exe
1800	5646654.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5646654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5646654.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1800	5646654.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2336	5646654.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	5646654.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1800	2336	5646654.exe	31
PID 2336 wrote to memory of 1800	2336	5646654.exe	31
PID 2336 wrote to memory of 1800	2336	5646654.exe	31
PID 2336 wrote to memory of 1800	2336	5646654.exe	31
PID 2336 wrote to memory of 1800	2336	5646654.exe	31

C:\Users\Admin\AppData\Local\Temp\5646654.exe
"C:\Users\Admin\AppData\Local\Temp\5646654.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\5646654.exe
  "C:\Users\Admin\AppData\Local\Temp\5646654.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\secondo\ruddys\Misapply\Postgeminum\birgita.txt

Filesize
4KB

MD5
2e7baf4f3c9f5830af25c66ecbe1dac4

SHA1
275ee3d8faeef514ec71605788561bae14f3a48a

SHA256
37346b6387f7d33a9eab62407f94cd716081eb80d7443db91b788479e6fcaf4c

SHA512
a7900cc0e56998f9cd30b24584c15a8a533139cb01d16bf2046c1b1bf5ffbd67216aac69a83d1968206a99185f692bf21429622cbf53a9abbbf528ff21f7cb45

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE0BF.tmp\LangDLL.dll

Filesize
5KB

MD5
f1e9eed02db3a822a7ddef0c724e5f1f

SHA1
65864992f5b6c79c5efbefb5b1354648a8a86709

SHA256
6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df

SHA512
c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE0BF.tmp\System.dll

Filesize
11KB

MD5
17ed1c86bd67e78ade4712be48a7d2bd

SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0

SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

Download Submit
memory/1800-50-0x00000000014F0000-0x000000000498C000-memory.dmp

Filesize
52.6MB

Download
memory/1800-51-0x00000000779E0000-0x0000000077B89000-memory.dmp

Filesize
1.7MB

Download
memory/1800-71-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/1800-73-0x00000000779E0000-0x0000000077B89000-memory.dmp

Filesize
1.7MB

Download
memory/1800-72-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/1800-75-0x0000000000480000-0x00000000004C8000-memory.dmp

Filesize
288KB

Download
memory/1800-74-0x00000000014F0000-0x000000000498C000-memory.dmp

Filesize
52.6MB

Download
memory/2336-49-0x00000000779E0000-0x0000000077B89000-memory.dmp

Filesize
1.7MB

Download
memory/2336-48-0x00000000779E1000-0x0000000077AE2000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing