guloader | 6744f6083b8e8c5fca03f50101223d6125db7a1aebeb9de0e87c9e67441e8a53

General

Target

http___linkso.duckdns.org_11d_solex.exe
Size

84KB
MD5

dcf7ee4f070a1a4af0be8366cb2d0826
SHA1

29161484a64a56d3f4a38a7c76959336d117bf86
SHA256

6744f6083b8e8c5fca03f50101223d6125db7a1aebeb9de0e87c9e67441e8a53
SHA512

d8aa2283dda1f15b53643171bb601de3963a487445a02af3959f44226935c743af93a11af90d873c9868cfad16b9280057bd5b2eff29baf22ee3eb744192553b

Score

10^/10

guloader remcos remotehost downloader rat

Malware Config

Extracted

Family

remcos

Version

3.1.5 Pro

Botnet

RemoteHost

C2

wavesvc64.duckdns.org:1111

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-46XD7E
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

http___linkso.duckdns.org_11d_solex.exeieinstal.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	http___linkso.duckdns.org_11d_solex.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ieinstal.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

http___linkso.duckdns.org_11d_solex.exeieinstal.exe

pid process

768 http___linkso.duckdns.org_11d_solex.exe
1364 ieinstal.exe
1364 ieinstal.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

http___linkso.duckdns.org_11d_solex.exe

description pid process target process

PID 768 set thread context of 1364 768 http___linkso.duckdns.org_11d_solex.exe ieinstal.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

http___linkso.duckdns.org_11d_solex.exe

pid process

768 http___linkso.duckdns.org_11d_solex.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

http___linkso.duckdns.org_11d_solex.exe

pid process

768 http___linkso.duckdns.org_11d_solex.exe

pid	process
768	http___linkso.duckdns.org_11d_solex.exe
1364	ieinstal.exe
1364	ieinstal.exe

description	pid	process	target process
PID 768 set thread context of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe

pid	process
768	http___linkso.duckdns.org_11d_solex.exe

pid	process
768	http___linkso.duckdns.org_11d_solex.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

http___linkso.duckdns.org_11d_solex.exe

description	pid	process	target process
PID 768 wrote to memory of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe
PID 768 wrote to memory of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe
PID 768 wrote to memory of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe
PID 768 wrote to memory of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe
PID 768 wrote to memory of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe
PID 768 wrote to memory of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe
PID 768 wrote to memory of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe
PID 768 wrote to memory of 1364	768	http___linkso.duckdns.org_11d_solex.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\http___linkso.duckdns.org_11d_solex.exe
"C:\Users\Admin\AppData\Local\Temp\http___linkso.duckdns.org_11d_solex.exe"
1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Users\Admin\AppData\Local\Temp\http___linkso.duckdns.org_11d_solex.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-62-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/768-64-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/768-68-0x0000000077AE0000-0x0000000077C60000-memory.dmp

Filesize
1.5MB

Download
memory/768-69-0x0000000077AF0000-0x0000000077BC6000-memory.dmp

Filesize
856KB

Download
memory/768-67-0x0000000077900000-0x0000000077AA9000-memory.dmp

Filesize
1.7MB

Download
memory/1364-65-0x0000000000130000-0x0000000000230000-memory.dmp

Filesize
1024KB

Download
memory/1364-66-0x0000000000130000-mapping.dmp

Download
memory/1364-72-0x0000000077900000-0x0000000077AA9000-memory.dmp

Filesize
1.7MB

Download
memory/1364-73-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing