guloader | 2baf2894d28fffff439499fbcd6b92714febd8ea39c0850f60f4575adedef15b

General

Target

REQ-647049pdf.exe
Size

862KB
MD5

7730242b95171f0ccb03e28bf8f5056b
SHA1

a5348671e4b92b3c64086abe6fced83f251e692c
SHA256

2baf2894d28fffff439499fbcd6b92714febd8ea39c0850f60f4575adedef15b
SHA512

74a89a765c1d138b3e9c90a0cbb3768ded91ceb7140d99b97b8aec2392e88e58d3b46a657db6738f8effa59743ae6e4eab19bc264944273adaa7543dfab9626c
SSDEEP

12288:Zt1Y3a5Pi5kV98nWGjFxN1bIyPA2lKZ7SimXcL9WIoXygi+VIfX+SPA4c5Wj6wnM:VY0Pi5kId5F55lc7zmXcLEr9t4UkM

Score

10^/10

guloader vipkeylogger collection discovery downloader keylogger spyware stealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7796105373:AAFzT7_X9ByvT2toqxUJ57ENp35EktbmwkU/sendMessage?chat_id=5340613581

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 2 IoCs

pid	Process
2080	REQ-647049pdf.exe
2080	REQ-647049pdf.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	REQ-647049pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	REQ-647049pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	REQ-647049pdf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	drive.google.com
29	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	checkip.dyndns.org
54	reallyfreegeoip.org
56	reallyfreegeoip.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2616	REQ-647049pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2080	REQ-647049pdf.exe
2616	REQ-647049pdf.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REQ-647049pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REQ-647049pdf.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	REQ-647049pdf.exe
2616	REQ-647049pdf.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2080	REQ-647049pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	REQ-647049pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2616	2080	REQ-647049pdf.exe	90
PID 2080 wrote to memory of 2616	2080	REQ-647049pdf.exe	90
PID 2080 wrote to memory of 2616	2080	REQ-647049pdf.exe	90
PID 2080 wrote to memory of 2616	2080	REQ-647049pdf.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	REQ-647049pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	REQ-647049pdf.exe

C:\Users\Admin\AppData\Local\Temp\REQ-647049pdf.exe
"C:\Users\Admin\AppData\Local\Temp\REQ-647049pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\REQ-647049pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\REQ-647049pdf.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi8270.tmp

Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj82C1.tmp

Filesize
52B

MD5
5d04a35d3950677049c7a0cf17e37125

SHA1
cafdd49a953864f83d387774b39b2657a253470f

SHA256
a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266

SHA512
c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj8311.tmp

Filesize
56B

MD5
ffe600086504d94d0e7e2f8a331f5d85

SHA1
1fb3fa48bfa30f04fc957c05a90c824fdb38f048

SHA256
eb6c41469bc87cbe962db30d4bc3772cc2edfa9d216e51f5e93a06a51fbab86d

SHA512
42d46fc0c26a4adc5eebb4b129378f36ca6a91434d6060b11f22a209f20b840f28681a62c22d751142019f746c131da16578fb8687c52de0706e6bcbe51417d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso82E1.tmp

Filesize
60B

MD5
d4453567a455b741556c4de15c9f6446

SHA1
410fd7474030e724f52d4e30f5f12027ce4869db

SHA256
a1fa0dcdbe660be838cd82f50bea1c422988cdd527009f26b4f3dd314106c46e

SHA512
45247f2ac6631e83bf7bcc8ad56c775689e8a4a1e18c3355b0a02ae9498854ca71033396c9bd6570833342c6cfaf1c4427d064e8515da383bbf04a25e347e0ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst82B0.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu843B.tmp

Filesize
30B

MD5
f15bfdebb2df02d02c8491bde1b4e9bd

SHA1
93bd46f57c3316c27cad2605ddf81d6c0bde9301

SHA256
c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043

SHA512
1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1

Download Submit
C:\Users\Public\Desktop\Varda.ini

Filesize
33B

MD5
340ad700cf73b73ea2313c044d40ea9a

SHA1
9b90cc3147d140fa936e308c2c320bdc385da93a

SHA256
55a2b8f5ef1d17023fd8245e69830cc961c0ce629eddc7ac1043c288cb3915b5

SHA512
4b31d10b80ae71197ac367c868569949224a4cd542bf0e9c188b816348ec8958f952525f939c827bddc8610f268dd12e310d6d2fc99071c741b3a38e062542b4

Download Submit
memory/2080-597-0x0000000077B21000-0x0000000077C41000-memory.dmp

Filesize
1.1MB

Download
memory/2080-598-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/2616-615-0x0000000077B21000-0x0000000077C41000-memory.dmp

Filesize
1.1MB

Download
memory/2616-620-0x000000003A390000-0x000000003A934000-memory.dmp

Filesize
5.6MB

Download
memory/2616-601-0x0000000077BC5000-0x0000000077BC6000-memory.dmp

Filesize
4KB

Download
memory/2616-599-0x00000000016C0000-0x00000000074D5000-memory.dmp

Filesize
94.1MB

Download
memory/2616-614-0x0000000000460000-0x00000000016B4000-memory.dmp

Filesize
18.3MB

Download
memory/2616-616-0x0000000000460000-0x00000000016B4000-memory.dmp

Filesize
18.3MB

Download
memory/2616-618-0x0000000072A1E000-0x0000000072A1F000-memory.dmp

Filesize
4KB

Download
memory/2616-617-0x00000000016C0000-0x00000000074D5000-memory.dmp

Filesize
94.1MB

Download
memory/2616-619-0x0000000000460000-0x00000000004A2000-memory.dmp

Filesize
264KB

Download
memory/2616-600-0x0000000077BA8000-0x0000000077BA9000-memory.dmp

Filesize
4KB

Download
memory/2616-621-0x0000000037FA0000-0x000000003803C000-memory.dmp

Filesize
624KB

Download
memory/2616-622-0x0000000072A10000-0x00000000731C0000-memory.dmp

Filesize
7.7MB

Download
memory/2616-624-0x0000000072A1E000-0x0000000072A1F000-memory.dmp

Filesize
4KB

Download
memory/2616-625-0x0000000072A10000-0x00000000731C0000-memory.dmp

Filesize
7.7MB

Download
memory/2616-626-0x000000003AD80000-0x000000003AF42000-memory.dmp

Filesize
1.8MB

Download
memory/2616-627-0x000000003AF60000-0x000000003AFB0000-memory.dmp

Filesize
320KB

Download
memory/2616-629-0x000000003AFE0000-0x000000003B072000-memory.dmp

Filesize
584KB

Download
memory/2616-630-0x000000003B0C0000-0x000000003B0CA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing