guloader | 489e9114de29cf7594427a3472f0d0ab5f0d7434242f139417af119f3a5d8b79

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2025, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

315176345_2025-04-13-5522441.exe
Size

645KB
MD5

619e2fa8cf181dcce7df16e5fee4065a
SHA1

7c72e48804fbd2bd8b4f28e69f916d910afd5cc7
SHA256

8e6c5f4651741758b6b141da89e4c27fa244eccce3d9beaf4b1ae0e48f13d5a0
SHA512

9840537924bf3858b21771945798f49b2e907b8efee4fe4e7ae5a0762c5ff451543b95d9750e31d0203ec485da45535c03d8cfbeba88ca70533ddb19ac4ad303
SSDEEP

12288:u+q6+b0201LM+OryHE3WrRMnSUO8nmCeud3f2KHTlt1A:u+qlA20WyGEyltnmCe8fJ31A

Score

10^/10

guloader vipkeylogger collection discovery downloader keylogger spyware stealer

Malware Config

Extracted

Family

vipkeylogger

https://api.telegram.org/bot7940557245:AAGEVNBuuGDhlbTi3PPq7irUInwmQ9JgMqQ/sendMessage?chat_id=7590946867

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 2 IoCs

pid	Process
780	315176345_2025-04-13-5522441.exe
780	315176345_2025-04-13-5522441.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	315176345_2025-04-13-5522441.exe
Key opened	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	315176345_2025-04-13-5522441.exe
Key opened	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	315176345_2025-04-13-5522441.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	drive.google.com
18	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	checkip.dyndns.org
30	reallyfreegeoip.org
31	reallyfreegeoip.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1564	315176345_2025-04-13-5522441.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
780	315176345_2025-04-13-5522441.exe
1564	315176345_2025-04-13-5522441.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	315176345_2025-04-13-5522441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	315176345_2025-04-13-5522441.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1564	315176345_2025-04-13-5522441.exe
1564	315176345_2025-04-13-5522441.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
780	315176345_2025-04-13-5522441.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	315176345_2025-04-13-5522441.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1564	780	315176345_2025-04-13-5522441.exe	90
PID 780 wrote to memory of 1564	780	315176345_2025-04-13-5522441.exe	90
PID 780 wrote to memory of 1564	780	315176345_2025-04-13-5522441.exe	90
PID 780 wrote to memory of 1564	780	315176345_2025-04-13-5522441.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	315176345_2025-04-13-5522441.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	315176345_2025-04-13-5522441.exe

C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe
"C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe
  "C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdA868.tmp

Filesize
35B

MD5
baf2a3b161f59f08e4ac15360a33f91e

SHA1
7720d461221d6947de0c8295c9a350de7793e0e2

SHA256
8c876ae7916572fa02c0c9841d47358f549363bda4f2879944e44c250f29e431

SHA512
b9ff3c4e06b93e7896a44bbcc4f228e6bed9afc14d4996bb5953851157773882d576826df5d1b9b2000356d69c3a43a61186f88027c4c9914e7aca8a93aa357f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdA868.tmp

Filesize
52B

MD5
5d04a35d3950677049c7a0cf17e37125

SHA1
cafdd49a953864f83d387774b39b2657a253470f

SHA256
a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266

SHA512
c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA888.tmp

Filesize
42B

MD5
24ef878c4d8f6e6b14475aebadd5e242

SHA1
77f9b0b1e1e042665af7c23ebe552758dcfd8839

SHA256
fc19bd9ade2c1d69b0af54ccadb03aaed0b0a0405ba32130a89e2b60d2f431a6

SHA512
d7b522cb8011f4abfc0f5fc6dd3d5eda5bc8d478cca34483883435827a50a5437b10268a224cdf1ec33e41bd487be01915cf3dab6cb15a4e4ecc7c8714c6f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA888.tmp

Filesize
60B

MD5
6003c892b3f3e6857b44804bb171e32b

SHA1
e5388e8d8163b149dcc9c496a3bf2a4a23a0ad77

SHA256
6aca13da7c0fef80812c437ed6ebfc24e9ab6dc53f36b8f42c6b7071f84e3ca8

SHA512
e935627de21df33244c6aed2fdd8e2d8750bdff40574c1063c02334e2059649b7338e1ff2732efb8b0b0110e53e0a67c25390ee8de314b601aa13e37095cf4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA808.tmp

Filesize
20B

MD5
9111ba1d1ceb4b7f775d74730aac363e

SHA1
c0af4968c775735be12419b60b257ed4359cb9b2

SHA256
0883f5bab7d5dafd9efec59b917070f5d051f50b047951d1ea87dab27fef7b91

SHA512
836c5d3941109691f2589e317e10d661978d9fc4af435bde3467159913ff9192d6eab1efe3e50e2048d06ce0c85963efe1ac056e1fd6ff1d33ac05f25beabbbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA808.tmp

Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA808.tmp

Filesize
25B

MD5
d584d82e5221c4884dc3062781421038

SHA1
d8a56398883028032d6fc1c8630b8a8479127277

SHA256
f8d9811bb3d103f15ec0af4c4dea41769bcfb128bb961445461efa233772902a

SHA512
071d0f71114e7a0bb94ec3886fe1b9823ab2740b1509c755c8a08f40e4aeb5f04186722ae8a39ae8b66fc35ce4fc5cdee998bd6b85215cb02ef041366645f076

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA808.tmp

Filesize
42B

MD5
b6a6fc39000a885d47bb4a68599189d2

SHA1
2e6af0f8af28d0ccf111437ebdef42fc9b87d976

SHA256
d0e907cfed7dd830efd34ab698cfbc7726f29b52b71479f6ee9cc34087925d26

SHA512
79f428030deceb2504105b031f605836640f70e070c23dfc3d8f815c3b08b7377cb53455e8a8333dd7b2fca5507da24682b809eb586d8ce3a223e532a93d9263

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA808.tmp

Filesize
52B

MD5
ea70cc86528476e4f1225362996952a6

SHA1
93851680188ae3f06e0b419fa5afe38de41b84eb

SHA256
86ecd210e4942095595b70f160ce629c222229b154e64cf97295beb83ade9f63

SHA512
86c4fe02a63c61776b1cda0bca20e87f97a0103d0e9e914e913a5047d2660a804f18a754029f4d1877010d9027968c20107862da56e0033529f9d58a26cde836

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA8C8.tmp

Filesize
56B

MD5
29a28ce2b1e65d140f33352d68603e6f

SHA1
6c018cc95d5c6145b253dc0ecf7788ba60a186e8

SHA256
703e34699df3afe05877ed93aa2f8d37e2868411d55397a921fb45a0509816a2

SHA512
4285dd432573efdabf9e11d787a75db6eea018c7c427237012e3e0b89a589c1f79c5fb2f437f5d8f5d4af404f8dd72f7d14cc6012b877550f3291f325a0fe1d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA9B3.tmp

Filesize
30B

MD5
f15bfdebb2df02d02c8491bde1b4e9bd

SHA1
93bd46f57c3316c27cad2605ddf81d6c0bde9301

SHA256
c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043

SHA512
1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyA848.tmp\System.dll

Filesize
12KB

MD5
9b38a1b07a0ebc5c7e59e63346ecc2db

SHA1
97332a2ffcf12a3e3f27e7c05213b5d7faa13735

SHA256
8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c

SHA512
26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c

Download Submit
memory/780-566-0x0000000077DC1000-0x0000000077EE1000-memory.dmp

Filesize
1.1MB

Download
memory/780-568-0x0000000074C25000-0x0000000074C26000-memory.dmp

Filesize
4KB

Download
memory/780-567-0x0000000077DC1000-0x0000000077EE1000-memory.dmp

Filesize
1.1MB

Download
memory/1564-570-0x0000000077E48000-0x0000000077E49000-memory.dmp

Filesize
4KB

Download
memory/1564-583-0x00000000386E0000-0x0000000038C84000-memory.dmp

Filesize
5.6MB

Download
memory/1564-571-0x0000000077E65000-0x0000000077E66000-memory.dmp

Filesize
4KB

Download
memory/1564-577-0x0000000000460000-0x00000000016B4000-memory.dmp

Filesize
18.3MB

Download
memory/1564-579-0x0000000077DC1000-0x0000000077EE1000-memory.dmp

Filesize
1.1MB

Download
memory/1564-578-0x0000000000460000-0x00000000016B4000-memory.dmp

Filesize
18.3MB

Download
memory/1564-581-0x0000000072CBE000-0x0000000072CBF000-memory.dmp

Filesize
4KB

Download
memory/1564-582-0x0000000000460000-0x00000000004AA000-memory.dmp

Filesize
296KB

Download
memory/1564-580-0x00000000016C0000-0x0000000005982000-memory.dmp

Filesize
66.8MB

Download
memory/1564-569-0x00000000016C0000-0x0000000005982000-memory.dmp

Filesize
66.8MB

Download
memory/1564-584-0x0000000038C90000-0x0000000038D2C000-memory.dmp

Filesize
624KB

Download
memory/1564-585-0x0000000072CB0000-0x0000000073460000-memory.dmp

Filesize
7.7MB

Download
memory/1564-587-0x0000000072CBE000-0x0000000072CBF000-memory.dmp

Filesize
4KB

Download
memory/1564-588-0x00000000391B0000-0x0000000039372000-memory.dmp

Filesize
1.8MB

Download
memory/1564-589-0x00000000393A0000-0x00000000393F0000-memory.dmp

Filesize
320KB

Download
memory/1564-590-0x0000000072CB0000-0x0000000073460000-memory.dmp

Filesize
7.7MB

Download
memory/1564-591-0x00000000395B0000-0x0000000039ADC000-memory.dmp

Filesize
5.2MB

Download
memory/1564-593-0x0000000039B40000-0x0000000039BD2000-memory.dmp

Filesize
584KB

Download
memory/1564-594-0x0000000039C30000-0x0000000039C3A000-memory.dmp

Filesize
40KB

Download