guloader | 539e74bd0c03ccd3fe00e95ee29c3ada84e5aa46216449c665b3890b81dcf0cc

General

Target

5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe
Size

160KB
MD5

2b3c647a9f8df6a8095d8d151d4bb8cb
SHA1

2304fc250c02fc342ad838aeaf47072039c5cda3
SHA256

539e74bd0c03ccd3fe00e95ee29c3ada84e5aa46216449c665b3890b81dcf0cc
SHA512

675fe8a5b5d1f4f38677c6ccbb5e4e29a1869171ae05684989bc6da3386b0c7ff77e7d389863612234623857cdd1fd4094adadfe748101c11f7554d3d51e296b

Score

10^/10

guloader remcos december downloader persistence rat upx

Malware Config

Extracted

Family

remcos

Version

3.3.2 Pro

Botnet

DECEMBER

C2

tisnew.ddns.net:5107

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
2
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
wifitask
keylog_path
%AppData%
mouse_option
false
mutex
wintsk32-DQHE98
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/792-75-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/792-74-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/792-76-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/792-78-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/792-77-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/792-80-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/792-79-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/792-82-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/792-81-0x0000000000400000-0x0000000000553000-memory.dmp	upx

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exeieinstal.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ieinstal.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ieinstal.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run	ieinstal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Softwarenschirogn1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Normalisereami5\\Finansmin2.exe"	ieinstal.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

ieinstal.exe

pid process

792 ieinstal.exe
792 ieinstal.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exeieinstal.exe

pid process

612 5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe
792 ieinstal.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe

description pid process target process

PID 612 set thread context of 792 612 5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe ieinstal.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe

pid process

612 5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exeieinstal.exe

pid process

612 5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe
792 ieinstal.exe

pid	process
792	ieinstal.exe
792	ieinstal.exe

pid	process
612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe
792	ieinstal.exe

description	pid	process	target process
PID 612 set thread context of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe

pid	process
612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe

pid	process
612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe
792	ieinstal.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe

description	pid	process	target process
PID 612 wrote to memory of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe
PID 612 wrote to memory of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe
PID 612 wrote to memory of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe
PID 612 wrote to memory of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe
PID 612 wrote to memory of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe
PID 612 wrote to memory of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe
PID 612 wrote to memory of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe
PID 612 wrote to memory of 792	612	5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe"
1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Users\Admin\AppData\Local\Temp\5995 MALAYSIA SDN BHD PAYMENT RECEIPTS 071221_PDF.exe"
2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-64-0x00000000777F0000-0x0000000077970000-memory.dmp

Filesize
1.5MB

Download
memory/612-55-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/612-56-0x0000000000290000-0x00000000002A6000-memory.dmp

Filesize
88KB

Download
memory/612-58-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/612-59-0x0000000077610000-0x00000000777B9000-memory.dmp

Filesize
1.7MB

Download
memory/612-60-0x00000000777F0000-0x0000000077970000-memory.dmp

Filesize
1.5MB

Download
memory/612-54-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/792-71-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-74-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-67-0x0000000077610000-0x00000000777B9000-memory.dmp

Filesize
1.7MB

Download
memory/792-69-0x00000000777F0000-0x0000000077970000-memory.dmp

Filesize
1.5MB

Download
memory/792-70-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-62-0x0000000000260000-0x0000000000360000-memory.dmp

Filesize
1024KB

Download
memory/792-72-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-73-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-75-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-63-0x0000000000260000-mapping.dmp

Download
memory/792-76-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-78-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-77-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-80-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-79-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-82-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-81-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/792-83-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads