What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

TRU Positives: Weekly investigation summaries and recommendations from eSentire's Threat Response Unit (TRU)

GuLoader VBScript Variant Returns with PowerShell Updates

BY eSentire Threat Response Unit (TRU)

June 7, 2023 | 8 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

GuLoader is a sophisticated malware loader which has heavily abused tax-themed lures in the first half of 2023. In April 2023, TRU reported on ongoing GuLoader activity using tax-themed lures and decoy files. In the latter half of May, TRU identified an updated VBScript GuLoader variant across multiple customers.

This blog will examine Guloader’s latest VBScript/PowerShell execution techniques in more detail.

Similar to the previous activity, GuLoader execution begins with the user clicking on a shortcut file and launching a PowerShell command, which retrieves a decoy tax document and VBS script.

Figure 1 Endpoint view of GuLoader’s execution chain.

Next, PowerShell contacts two shortened links, which lead to two files hosted on softmedal[.]com (a file/image sharing site).

The first file is infos.pdf and appears to be a real US income tax form. The PDF is opened with the default app for PDF files (Adobe Acrobat in the above image) and displayed to the user as a decoy.

Figure 2 US Tax Form 1040, opened and displayed to the user as a decoy. Redactions added.

The second file is Tefor.vbs. Like GuLoader VBScript variants in the past, this is highly obfuscated and contains junk code to impede analysis. The script concatenates hundreds of smaller strings into a single variable which ultimately builds and executes a PowerShell command.

Figure 3 VBScript "Tefor.vbs". Echoing the A1 variable to a dialogue box reveals the next stage.

Summary of GuLoader's Execution Chain

Before stepping through each step in GuLoader’s execution chain in more detail, we can summarize the entire process:

  1. Tefor.vbs VBScript is executed by the user clicking a shortcut file.
  2. First stage PowerShell is executed by the VBScript.
  3. BitsTransfer is used to retrieve a payload package containing the second stage PowerShell and two shellcode buffers.
  4. Second stage PowerShell is carved out of the payload package and executed.
  5. Shellcode A is carved from the package and reflectively loaded.
  6. Shellcode B is decoded by Shellcode A and reflectively loaded.
  7. Shellcode B is used to retrieve and inject Remcos RAT into a legitimate Windows process such as ieinstal.exe.

First Stage PowerShell

The PowerShell command contains various obfuscated strings, as seen in the right side of Figure 3. These strings are passed to a de-obfuscation function (Sawmo9). This function contains a loop that iterates over each character of the input string (excluding the first and last characters).

In essence, it extracts every other character from the string and concatenates into a variable named $Dryde0, which is returned by the function.

Figure 4 First stage PowerShell de-obfuscation routine.

The cleaned-up PowerShell contains less than 30 lines of code and makes up the first stage of GuLoader’s PowerShell execution.

To explain its functionality, we’ve formatted (including renaming some variables for readability) and organized the code into several sections.

Section 1:

Figure 5 First section of GuLoader's first stage PowerShell

Section 2:

Figure 6 Section 2 of GuLoader's first stage PowerShell.

Section 3:

Figure 7 Section 3 of GuLoader's first stage PowerShell.

The final section of the first stage PowerShell is where the code diverges from the variant observed in April. Instead of writing more payloads to registry, a single payload package is retrieved that contains both the two-stage shellcode and additional PowerShell commands.

The last section contains the second stage PowerShell code:

Figure 8 CyberChef recipe to extract the second stage PowerShell from the payload package.

Second Stage PowerShell

The code contains non-human readable hex strings. These strings are passed to a decoding function where they are converted from hex to byte and XOR’d with decimal 18. The resulting byte array is converted to an ASCII string and returned by the function.

To speed up analysis, a write-output cmdlet can be inserted into the function to print the decoded strings to the screen during runtime.

Figure 9 Second stage PowerShell de-obfuscation routine.

Once de-obfuscated, the purpose of the code is to reflectively load GuLoader’s shellcode in memory (the code overlaps heavily with this GitHub repo).

Figure 10 PowerShell code to reflective load shellcode.

As we saw in the previous variant in April, the code defines two buffers containing shellcode:

Figure 11 Shellcode buffers.

Shellcode A

Figure 12 Key derived from Shellcode A.

Shellcode B

How did we find it?

What did we do?

Based on information from the initial investigation, we conducted additional threat hunts across all customers. This information was used to update our detection content for GuLoader across our customers.

What can you learn from this TRU positive?

Recommendations from our Threat Response Unit (TRU) Team:

Indicators of Compromise

Indicator

Note

f39329106b591529cc1d7e82f4cfbfa6

Tefor.vbs

f6489874716c1684221548d18631e3a9

GuLoader Shellcode/PowerShell Combo Payload Package “Remimicra.hhp”

hxxp://194.55.224[.]183/frsh/Remimicra.hhp

GuLoader Shellcode/PowerShell Combo Payload Download

hxxp://194.55.224[.]183/frsh/iFaeETTILhlw208.bin

Hosting encrypted Remcos payload

905129eea82849764137f68e12efb2e7

Stage 1 shellcode

eabf387e4dc5cff8e24030a09ffa7a7c

Stage 2 shellcode, decrypted

1f8721109e05b5283d21a69e25293717

iFaeETTILhlw208.bin, encrypted Remcos payload.

zazuservr[.]com

Remcos C2

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

eSentire Threat Response Unit (TRU)
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire