guloader | 675a931e9819ae1e9e781bce3a9d5c348ac3695db7b31bd71c99ab8a0452ceb8

General

Target

justificante.exe
Size

1.2MB
MD5

1a4ed0a8fcb78acc5ada116e41d321e8
SHA1

4c4dff7b48b147c161a7cc0c9376647d69af30f7
SHA256

903d7920fc4c1dcb1523012750db17bc87a36f80801c299b9230c309bb7e0150
SHA512

f91a0488fde6d4b47eb595b1a89d5f8f1661d0bedc315eb98e2f88259a7f84f69f2737a5764665069f4a838cb5701d883a7854032767ed938e5c2399c924a372
SSDEEP

24576:AP885sNkJaSjGMdsRyBoaWrzAk2LIP4ylsjM3NVzyYTjMS:v9kYoGfmof4k2o4RjMXDTjMS

Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7985048972:AAETw71DlbcHqzvtl1F1nkzl_0aMbnCis_c/sendMessage?chat_id=7794818739

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 2 IoCs

pid	Process
1664	justificante.exe
1664	justificante.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1072	justificante.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1664	justificante.exe
1072	justificante.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\resources\Woodbined189\gorgously.lnk	justificante.exe
File opened for modification	C:\Windows\Fonts\Femlings.ini	justificante.exe
File opened for modification	C:\Windows\resources\Disrespective\mouseweb.sup	justificante.exe
File opened for modification	C:\Windows\resources\dmmer.Cer176	justificante.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	justificante.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	justificante.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1072	justificante.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1664	justificante.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	justificante.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1072	1664	justificante.exe	31
PID 1664 wrote to memory of 1072	1664	justificante.exe	31
PID 1664 wrote to memory of 1072	1664	justificante.exe	31
PID 1664 wrote to memory of 1072	1664	justificante.exe	31
PID 1664 wrote to memory of 1072	1664	justificante.exe	31

C:\Users\Admin\AppData\Local\Temp\justificante.exe
"C:\Users\Admin\AppData\Local\Temp\justificante.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\justificante.exe
  "C:\Users\Admin\AppData\Local\Temp\justificante.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjC009.tmp

Filesize
6B

MD5
50484c19f1afdaf3841a0d821ed393d2

SHA1
c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b

SHA256
6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c

SHA512
d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjC009.tmp

Filesize
7B

MD5
67cfa7364c4cf265b047d87ff2e673ae

SHA1
56e27889277981a9b63fcf5b218744a125bbc2fa

SHA256
639b68bd180b47d542dd001d03557ee2d5b3065c3c783143bc9fb548f3fd7713

SHA512
17f28a136b20b89e9c3a418b08fd8e6fcaac960872dc33b2481af2d872efc44228f420759c57724f5d953c7ba98f2283e2acc7dfe5a58cbf719c6480ec7a648b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjC009.tmp

Filesize
8B

MD5
c3cb69218b85c3260387fb582cb518dd

SHA1
961c892ded09a4cbb5392097bb845ccba65902ad

SHA256
1c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101

SHA512
2402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjC009.tmp

Filesize
10B

MD5
9a53fc1d7126c5e7c81bb5c15b15537b

SHA1
e2d13e0fa37de4c98f30c728210d6afafbb2b000

SHA256
a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92

SHA512
b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjC009.tmp

Filesize
12B

MD5
558ec0e73952eb4a395e7f17eb69221e

SHA1
d1cb97bfc8d9fad9eab7d19e685029b5f7084709

SHA256
4d8a1cb0f83d824cec9e15e4d45605ed2cc92ae959602d0cc8873b0125d4cd74

SHA512
698fb90fadb2b22ce78f874dac04c2f0bf72340d39f135e7736afdb9a9b28c9c55a8c6c9f871676134e6d057a90afc2944d1f1e8a117cc0f7a90c8d9b60c5dbe

Download Submit
C:\Users\Admin\AppData\Local\Wizzens.ini

Filesize
36B

MD5
74483b60253f907579f0ebaa81262424

SHA1
9bb553dee3ab92bf0b861fbaed514451dea0f902

SHA256
4347e411413d2c4e39f1cab402f88379d4e9babb2a9072a773260c9072a2c0f6

SHA512
e3c81e22d5b5c5f26c1a2dd20a883fe76cfd4919ee7def0c16f09ec08e02e5ff9ff1f74b5860305cf69b466037244dcec4702160d148e36b9bb0dbc1b13c1013

Download Submit
\Users\Admin\AppData\Local\Temp\nsdBE12.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
memory/1072-595-0x0000000077480000-0x0000000077629000-memory.dmp

Filesize
1.7MB

Download
memory/1072-593-0x00000000014C0000-0x000000000376D000-memory.dmp

Filesize
34.7MB

Download
memory/1072-596-0x0000000000450000-0x00000000014B2000-memory.dmp

Filesize
16.4MB

Download
memory/1072-617-0x0000000000450000-0x00000000014B2000-memory.dmp

Filesize
16.4MB

Download
memory/1072-618-0x00000000014C0000-0x000000000376D000-memory.dmp

Filesize
34.7MB

Download
memory/1072-619-0x0000000000450000-0x0000000000492000-memory.dmp

Filesize
264KB

Download
memory/1072-620-0x0000000000450000-0x00000000014B2000-memory.dmp

Filesize
16.4MB

Download
memory/1664-591-0x0000000077481000-0x0000000077582000-memory.dmp

Filesize
1.0MB

Download
memory/1664-592-0x0000000077480000-0x0000000077629000-memory.dmp

Filesize
1.7MB

Download
memory/1664-594-0x0000000004190000-0x000000000643D000-memory.dmp

Filesize
34.7MB

Download
memory/1664-590-0x0000000004190000-0x000000000643D000-memory.dmp

Filesize
34.7MB

Download

Analysis

Sharing