guloader | 2df46544a8861e37d41d4141bf6e01627d2b6146d3ee9d14bb7fa1aeb196d039

General

Target

Hjertesukkene.exe
Size

748KB
MD5

3c7ef96f2186919b90f142e105648961
SHA1

8ebcf7eb6705ab3132d39ee0dfa086502251a4e8
SHA256

2df46544a8861e37d41d4141bf6e01627d2b6146d3ee9d14bb7fa1aeb196d039
SHA512

dbae3f0aa744511c1a467be36fbe6363090071dd77c0c10e2dcef94ef0b72cddb5202b80530ebcf05b60aa79499f5c65ae8afb4e21b9f1df45564188f7c0677c
SSDEEP

12288:YF9NQk3J7EcrKNJlrUupNK3y38SeD83S1sAnCPB7SqxnE8UML789zUO9vVOI0emY:Q17FKrlrdjR3lRsxnSB7SqxnlGUOdb0G

Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 2 IoCs

pid	Process
868	Hjertesukkene.exe
868	Hjertesukkene.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	checkip.dyndns.org
16	reallyfreegeoip.org
17	reallyfreegeoip.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2228	Hjertesukkene.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
868	Hjertesukkene.exe
2228	Hjertesukkene.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\infarkt.pla	Hjertesukkene.exe
File opened for modification	C:\Program Files (x86)\Unelaborated.non	Hjertesukkene.exe
File opened for modification	C:\Program Files (x86)\Common Files\bedvelsens\Reaccelerates.ske	Hjertesukkene.exe
File opened for modification	C:\Program Files (x86)\Common Files\rhesusbarnet\teenfully.bra	Hjertesukkene.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\rothesay\Fallenternes.con	Hjertesukkene.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjertesukkene.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjertesukkene.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2228	Hjertesukkene.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
868	Hjertesukkene.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	Hjertesukkene.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2228	868	Hjertesukkene.exe	31
PID 868 wrote to memory of 2228	868	Hjertesukkene.exe	31
PID 868 wrote to memory of 2228	868	Hjertesukkene.exe	31
PID 868 wrote to memory of 2228	868	Hjertesukkene.exe	31
PID 868 wrote to memory of 2228	868	Hjertesukkene.exe	31

C:\Users\Admin\AppData\Local\Temp\Hjertesukkene.exe
"C:\Users\Admin\AppData\Local\Temp\Hjertesukkene.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\Hjertesukkene.exe
  "C:\Users\Admin\AppData\Local\Temp\Hjertesukkene.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Pictures\fedtlderstvles.lnk

Filesize
872B

MD5
4f8894d88213ee2ecba7f7be54fe1d4f

SHA1
bac77a3a7c19738b631b6ebd9a257f2dda122c47

SHA256
d86d4c26f610d32fda0d703c7f9a7d59a4d4ae3b831842f69a8d142cfd0e7abf

SHA512
d06735246282032724b0956003b429963ea08cd3553c6d074794bb59f823732e012f7c97a0cfdc124b293d886eb8d9516907ff6617cfa4780e2347bf101c070e

Download Submit
\Users\Admin\AppData\Local\Temp\nstE12C.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
memory/868-309-0x0000000002C20000-0x0000000004CD7000-memory.dmp

Filesize
32.7MB

Download
memory/868-311-0x0000000077690000-0x0000000077839000-memory.dmp

Filesize
1.7MB

Download
memory/868-310-0x0000000077691000-0x0000000077792000-memory.dmp

Filesize
1.0MB

Download
memory/868-312-0x0000000002C20000-0x0000000004CD7000-memory.dmp

Filesize
32.7MB

Download
memory/2228-313-0x00000000014D0000-0x0000000003587000-memory.dmp

Filesize
32.7MB

Download
memory/2228-314-0x0000000077690000-0x0000000077839000-memory.dmp

Filesize
1.7MB

Download
memory/2228-335-0x0000000077690000-0x0000000077839000-memory.dmp

Filesize
1.7MB

Download
memory/2228-334-0x0000000000460000-0x00000000014C2000-memory.dmp

Filesize
16.4MB

Download
memory/2228-336-0x0000000000460000-0x00000000014C2000-memory.dmp

Filesize
16.4MB

Download
memory/2228-338-0x0000000000460000-0x00000000004AA000-memory.dmp

Filesize
296KB

Download
memory/2228-337-0x00000000014D0000-0x0000000003587000-memory.dmp

Filesize
32.7MB

Download

Analysis

Sharing