guloader | 7ca204f398d0ca98eb3d2d76c2f05b382341fe416e761cf7e4ebb4c9db5593b5

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hermaean.exe
Size

1.0MB
MD5

a5350eaa7864ac06277c445e0f52f9d9
SHA1

9a589f6dcbb0ee908a1665501b3e249a00c05db8
SHA256

eab16fb9a96dba4a00c074dec9d6be01b5d93b680d69d230c21497fce96f9de5
SHA512

19cbd739728359dff2932ee72bf923598fe523ed2c08fc3d42f4e535e94e8cd7b0c4165eb1f3e4b54ef96b403396571b9ce9d3042ceacb996237d78b3347e2d1
SSDEEP

24576:NtLjOxH2phdL18qdTJhxEvGuw48Qw1J+FOZVKgyhz:NtLiwhd3dzxYfw4krkOZxy9

Score

10^/10

guloader discovery downloader spyware stealer

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
2848	Hermaean.exe
2848	Hermaean.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	reallyfreegeoip.org
17	reallyfreegeoip.org
14	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1072	Hermaean.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2848	Hermaean.exe
1072	Hermaean.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hermaean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hermaean.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2848	Hermaean.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	Hermaean.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1072	2848	Hermaean.exe	32
PID 2848 wrote to memory of 1072	2848	Hermaean.exe	32
PID 2848 wrote to memory of 1072	2848	Hermaean.exe	32
PID 2848 wrote to memory of 1072	2848	Hermaean.exe	32
PID 2848 wrote to memory of 1072	2848	Hermaean.exe	32

C:\Users\Admin\AppData\Local\Temp\Hermaean.exe
"C:\Users\Admin\AppData\Local\Temp\Hermaean.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\Hermaean.exe
  "C:\Users\Admin\AppData\Local\Temp\Hermaean.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nseF232.tmp

Filesize
56B

MD5
dafe25135ede7103cb267d1578e0c689

SHA1
ef87a386d2c6b7494cf58f0c98c43af600632c42

SHA256
0b8e7d7bf2483682129eda497da8a2119992e4aea40a6f9528afec01e1953653

SHA512
f79caea14ae158bfebada8328cf2657fb028193d76597dafd228e982e00b6f59ff6631ea354a3d69bf83a8d0e99791f613e1c13a6cf2837a035e9c257d47ca48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF172.tmp

Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF1C2.tmp

Filesize
29B

MD5
f302a24fc452fd85d13ad30a272d6f35

SHA1
3b9153f575b70084ae04fd55d5c86169eaa60916

SHA256
2edbbfdef57bac60adc902d6bd15abb9c3e044c0f660c9a63135d37ac0f6c63a

SHA512
477c3efa5d2bf5ef6ac57a0dc190014f98ff0bd1181106edff7b0db01d58b7f0d8c6eb77266202249f035cc056a726bfd7abdc2e0d672aadc9a45ed29d4b1bd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF1C2.tmp

Filesize
33B

MD5
d0c16d35895f4a76cb4fa85fc11c6842

SHA1
61d36c5b3fd3f0772608359b7ed9890b0474aee0

SHA256
d6063a46a92e1a2600bb31588a58cf906711aaaa1813e593c191da5881b46a59

SHA512
3595c1578f0c1a2d47d75f2c5260bd7b85551501c94a0abf609752e04e2e9f1f9d7a19f654d803a0c65d40d4b74dfb32d31bd88a9b8813e7466b914d2b800951

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF1C2.tmp

Filesize
52B

MD5
5d04a35d3950677049c7a0cf17e37125

SHA1
cafdd49a953864f83d387774b39b2657a253470f

SHA256
a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266

SHA512
c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF211.tmp

Filesize
60B

MD5
86b1517dcafc4a4339179034c736b13a

SHA1
dcaf657f694a70a5f41b45f9bd56b5adbfb9146c

SHA256
a181b7d3e37b70dfa7393c75e56579969260257921b04a16798398b62298f355

SHA512
14eff2d0277911af3956d652d26673e2f9d842f72b584ce0ff6f70dca311c18511b431febbce92ba2b88a4e78d54198db0c14371046ec2b9eb1ffc2971a5daf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF2AF.tmp

Filesize
30B

MD5
f15bfdebb2df02d02c8491bde1b4e9bd

SHA1
93bd46f57c3316c27cad2605ddf81d6c0bde9301

SHA256
c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043

SHA512
1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1

Download Submit
C:\Users\Public\Desktop\Varda.ini

Filesize
33B

MD5
340ad700cf73b73ea2313c044d40ea9a

SHA1
9b90cc3147d140fa936e308c2c320bdc385da93a

SHA256
55a2b8f5ef1d17023fd8245e69830cc961c0ce629eddc7ac1043c288cb3915b5

SHA512
4b31d10b80ae71197ac367c868569949224a4cd542bf0e9c188b816348ec8958f952525f939c827bddc8610f268dd12e310d6d2fc99071c741b3a38e062542b4

Download Submit
\Users\Admin\AppData\Local\Temp\nseF193.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
memory/1072-601-0x00000000014F0000-0x00000000046EA000-memory.dmp

Filesize
50.0MB

Download
memory/1072-602-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/1072-625-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/1072-626-0x00000000014F0000-0x00000000046EA000-memory.dmp

Filesize
50.0MB

Download
memory/1072-627-0x0000000000480000-0x000000000049E000-memory.dmp

Filesize
120KB

Download
memory/2848-597-0x00000000043E0000-0x00000000075DA000-memory.dmp

Filesize
50.0MB

Download
memory/2848-598-0x00000000043E0000-0x00000000075DA000-memory.dmp

Filesize
50.0MB

Download
memory/2848-600-0x0000000077B50000-0x0000000077CF9000-memory.dmp

Filesize
1.7MB

Download
memory/2848-599-0x0000000077B51000-0x0000000077C52000-memory.dmp

Filesize
1.0MB

Download