guloader | dde1528c732c07d5f7153dc871342bd4657836a7ccfe185e15af90c87dbf95a7

Analysis

max time kernel
66s
max time network
66s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.FileRepMalware.23885.29286.exe
Size

1019KB
MD5

48b03eaf0daf01e7e607c9ef2d4605e6
SHA1

197c883e8f662c4f432f9b433cab6fbae45cb7cc
SHA256

dde1528c732c07d5f7153dc871342bd4657836a7ccfe185e15af90c87dbf95a7
SHA512

db4900abfad46fae0518ac34d38a16eb74033d4262a0f46da05106ab46811a9a9b23078cc32278b3dad4d521dc68d6e29b0ad8a577968f47b6fc1393c39caf0f
SSDEEP

24576:NtLj+hI8nM8/LitBKEvjqVdYpD0rDpCKOIRNFlBsaKo:NtLihpnV/LSqVdI0rNbNF7sxo

Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.muriana.com
Port:
587
Username:
[email protected]
Password:
Provisional123***
Email To:
[email protected]

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 2 IoCs

pid	Process
1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe
1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	checkip.dyndns.org
16	reallyfreegeoip.org
17	reallyfreegeoip.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1048	SecuriteInfo.com.FileRepMalware.23885.29286.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe
1048	SecuriteInfo.com.FileRepMalware.23885.29286.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.FileRepMalware.23885.29286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.FileRepMalware.23885.29286.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1048	SecuriteInfo.com.FileRepMalware.23885.29286.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	SecuriteInfo.com.FileRepMalware.23885.29286.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1048	1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe	31
PID 1628 wrote to memory of 1048	1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe	31
PID 1628 wrote to memory of 1048	1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe	31
PID 1628 wrote to memory of 1048	1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe	31
PID 1628 wrote to memory of 1048	1628	SecuriteInfo.com.FileRepMalware.23885.29286.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Alpha.ini

Filesize
47B

MD5
b895d576d6637a778b387b2fca0f56ec

SHA1
e78d2be4d94673d612c16d29c330bb0c78778429

SHA256
bfec1e97ed5d34825521d60b98986d1564cd159b4d1f9569eae4c3464d2f5c47

SHA512
b4a771d1b517a2776ba440f79f168306c244df1a6de1966313157154d8d52bead8131b95f846c2f55c15382e04284fffc6cf6abf3f6fcfcb259df2ea58d769e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCA34.tmp

Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCA85.tmp

Filesize
16B

MD5
6cc8ad9db8f0ba7f81660ccd69b64a98

SHA1
91dc056ad77f912e803c37ffea075118f19e7634

SHA256
cc88cad1427b013d4e18f53bbcf978b7d06baae78929230ef5c7ff06d2b8f03d

SHA512
94272e4a4b39622a108f0d11fffc37825719aa911720c9a39482198e8360cbd11fdcd5535fa765f3c8677375da930f5dfd8408c3135bddd7a5a954397c85866a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCA85.tmp

Filesize
38B

MD5
c01bcaece4cb4d82a3baaa18dba424e5

SHA1
89fedb510f98643964708e4aae2e2e6aa97914ec

SHA256
bea5795f8e992753616d86af3515d036c1737d48c98a68341d3014870e12197a

SHA512
b99a5076c3ef3909ea5c62dc8b2ce6885899861974e5327ab32b433608f6fbac783f345d25fb1a891545a83c48bc3796ae6314df0d0118d75c8cd572248868ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCA85.tmp

Filesize
40B

MD5
5f057db7c951594de8980eb6e146c839

SHA1
d8b07a5f98edb1ef37c879c4aa857a965dcf7bbe

SHA256
7c8cdea854ddb4a6a7fd11bf8693122b6d58728000f95748730076f32069a998

SHA512
a2eb57ecfe0d29d6669661e675505031d134f76c8b050e0ce14a61b850c5db7dbf2de3ce40c3c483485d83153112c254224d97c66b40a1e9a495eb2cf7de7a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCA85.tmp

Filesize
45B

MD5
9a0179a064d019a6528570027a777517

SHA1
c8597363a8cee2594928ab5a418927504e2cc9f0

SHA256
2f7aeebe47824a53e93e25f8f967ae20c835790dd023d21583c46537d064c9f5

SHA512
3c1186e4191def5d5dc3784e7ac087e5656a49bd703dc5f2a0d3dc838d4d241637964aa8041f1b327af42be565637d21d4310ce4bd915bf96e7fea4fc92b7d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCA85.tmp

Filesize
60B

MD5
9329796376ced0ea599f21e2a7daefbf

SHA1
562de8a0825baf273adbf239338bafeb21109120

SHA256
f516f4188b5490fb2f3c57f4dd5d6c90a65bed6ac7aac7f701bfc553c06f872d

SHA512
d1116c7db0363ea7969366aecdb9c4d4b5ccacb6314775d9fc8baf8eb1de9d4fed3630db9952e6bafe796dec035a68ea92471b6fe3dd6680240ec11750a0682f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCAD4.tmp

Filesize
56B

MD5
d4de0eab933eaea20fcc7a0fbc8f259a

SHA1
776f886cf63358662064f49513924aa1f8d32596

SHA256
58a06909bc19369daa6be9cfb1ceeb7d39547f7dde6d51fa53295c9cb59d13e0

SHA512
f33f19ae60203255638b5699737737ca342d48b62da9b462b086e284773bf9cb4ba475b8a625edc0d519761f15866a424caccedd6632e2fbc08a1855b8d1a7f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjCAF4.tmp

Filesize
30B

MD5
f15bfdebb2df02d02c8491bde1b4e9bd

SHA1
93bd46f57c3316c27cad2605ddf81d6c0bde9301

SHA256
c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043

SHA512
1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoCA74.tmp

Filesize
52B

MD5
5d04a35d3950677049c7a0cf17e37125

SHA1
cafdd49a953864f83d387774b39b2657a253470f

SHA256
a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266

SHA512
c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b

Download Submit
C:\Users\Public\Desktop\Varda.ini

Filesize
33B

MD5
340ad700cf73b73ea2313c044d40ea9a

SHA1
9b90cc3147d140fa936e308c2c320bdc385da93a

SHA256
55a2b8f5ef1d17023fd8245e69830cc961c0ce629eddc7ac1043c288cb3915b5

SHA512
4b31d10b80ae71197ac367c868569949224a4cd542bf0e9c188b816348ec8958f952525f939c827bddc8610f268dd12e310d6d2fc99071c741b3a38e062542b4

Download Submit
\Users\Admin\AppData\Local\Temp\nsjCA54.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
memory/1048-600-0x00000000014F0000-0x0000000003E06000-memory.dmp

Filesize
41.1MB

Download
memory/1048-603-0x0000000076F60000-0x0000000077109000-memory.dmp

Filesize
1.7MB

Download
memory/1048-610-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/1048-626-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/1048-627-0x00000000014F0000-0x0000000003E06000-memory.dmp

Filesize
41.1MB

Download
memory/1048-628-0x0000000000480000-0x00000000004C8000-memory.dmp

Filesize
288KB

Download
memory/1628-598-0x0000000076F61000-0x0000000077062000-memory.dmp

Filesize
1.0MB

Download
memory/1628-599-0x0000000076F60000-0x0000000077109000-memory.dmp

Filesize
1.7MB

Download
memory/1628-601-0x0000000004240000-0x0000000006B56000-memory.dmp

Filesize
41.1MB

Download
memory/1628-602-0x0000000077150000-0x0000000077226000-memory.dmp

Filesize
856KB

Download
memory/1628-597-0x0000000004240000-0x0000000006B56000-memory.dmp

Filesize
41.1MB

Download