guloader | 5ac5d66f604f656b5b7de2506f6e8ad911b81a3bccd1317f315e3cc3ad68851c

General

Target

3456754365_PDF.exe
Size

743KB
MD5

32e141183a50053d9c465ae8394ac718
SHA1

e9264e0fa77433ce8f1209372a5cbff50d4e3113
SHA256

5ac5d66f604f656b5b7de2506f6e8ad911b81a3bccd1317f315e3cc3ad68851c
SHA512

b83ea417187ec70d13465ea0f36f436e6c51fb6abc79032b42332aa5507541d21eb63dc85b6c53c897287a855b46dfef3e81293ef1876af7b23a28c17a3ee1e2
SSDEEP

12288:Sgn0B2gAPgy1IpO/Cfp3krcah1Ybwb2ub1ayFB+E/1F0bN0FhU0XLJk+Xe/XK41O:oB1STIpO/+p3kIah1YMphayFB+O0bN0h

Score

10^/10

guloader vipkeylogger collection discovery downloader keylogger spyware stealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7925601648:AAFJQr-qYufJQhg5VRCefCc8bUKVvQ_OCT4/sendMessage?chat_id=1940565380

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 10 IoCs

pid	Process
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe
1276	3456754365_PDF.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3456754365_PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3456754365_PDF.exe
Key opened	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3456754365_PDF.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
26	drive.google.com
27	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	reallyfreegeoip.org
42	reallyfreegeoip.org
39	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1732	3456754365_PDF.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1276	3456754365_PDF.exe
1732	3456754365_PDF.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Assads.sub	3456754365_PDF.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Challa18\undergrnse.abi	3456754365_PDF.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3456754365_PDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3456754365_PDF.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	3456754365_PDF.exe
1732	3456754365_PDF.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1276	3456754365_PDF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	3456754365_PDF.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1732	1276	3456754365_PDF.exe	92
PID 1276 wrote to memory of 1732	1276	3456754365_PDF.exe	92
PID 1276 wrote to memory of 1732	1276	3456754365_PDF.exe	92
PID 1276 wrote to memory of 1732	1276	3456754365_PDF.exe	92

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3456754365_PDF.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	3456754365_PDF.exe

C:\Users\Admin\AppData\Local\Temp\3456754365_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\3456754365_PDF.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\3456754365_PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\3456754365_PDF.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Templates\Botanophilist.ini

Filesize
47B

MD5
e78c2cc57d9e73a1253586ded51aca17

SHA1
bc6d6f3cd90f0ec5a5b4530ac8c6e28cd5982ae0

SHA256
fea03febfe042ebce2e33a0dcba4ac09061430376544dff8eb5b2eb7bc977ec6

SHA512
450f708670a9de5cb1ae224caddde8f9451a64e4144147d3b55eb38fc8968628c1d2e855286c409cac180263462f1d60eb8be25bc6bd8d32559672326d8ae8af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjAA0D.tmp\LangDLL.dll

Filesize
5KB

MD5
174708997758321cf926b69318c6c3f5

SHA1
645488089bf320f6864e0d0bc284c85216e56fbd

SHA256
f577b66492e97c7b8bf515398d8deb745abafd74f56fc03e67fce248ebbeb873

SHA512
214433597e04ca1ff9b4fe092d5d2997707a7c56f0f82c85d586088a200e4455028f3b9427d87b4f06f9252557d5be4b7a9138ea6a8d045df6209421fd8ca054

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjAA0D.tmp\System.dll

Filesize
11KB

MD5
0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1
10c51496d37cecd0e8a503a5a9bb2329d9b38116

SHA256
982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

SHA512
cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

Download Submit
memory/1276-336-0x0000000005220000-0x0000000007372000-memory.dmp

Filesize
33.3MB

Download
memory/1276-337-0x0000000076EB1000-0x0000000076FD1000-memory.dmp

Filesize
1.1MB

Download
memory/1276-339-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download
memory/1276-338-0x0000000005220000-0x0000000007372000-memory.dmp

Filesize
33.3MB

Download
memory/1276-341-0x0000000005220000-0x0000000007372000-memory.dmp

Filesize
33.3MB

Download
memory/1732-356-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/1732-355-0x0000000000480000-0x00000000016D4000-memory.dmp

Filesize
18.3MB

Download
memory/1732-342-0x00000000016E0000-0x0000000003832000-memory.dmp

Filesize
33.3MB

Download
memory/1732-357-0x00000000016E0000-0x0000000003832000-memory.dmp

Filesize
33.3MB

Download
memory/1732-358-0x00000000016E0000-0x0000000003832000-memory.dmp

Filesize
33.3MB

Download
memory/1732-359-0x0000000000480000-0x00000000004C8000-memory.dmp

Filesize
288KB

Download
memory/1732-360-0x0000000036620000-0x0000000036BC4000-memory.dmp

Filesize
5.6MB

Download
memory/1732-361-0x0000000036BD0000-0x0000000036C6C000-memory.dmp

Filesize
624KB

Download
memory/1732-363-0x00000000371A0000-0x0000000037362000-memory.dmp

Filesize
1.8MB

Download
memory/1732-364-0x0000000037380000-0x00000000373D0000-memory.dmp

Filesize
320KB

Download
memory/1732-365-0x0000000037460000-0x000000003798C000-memory.dmp

Filesize
5.2MB

Download
memory/1732-368-0x0000000034000000-0x0000000034092000-memory.dmp

Filesize
584KB

Download
memory/1732-369-0x00000000340C0000-0x00000000340CA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing