guloader | e540958829005866e4ecd6e7f1cdf3b5c2f063717a746d4485ff0ed62ccf9e71

General

Target

SirtakiQuote No 104-346.exe
Size

1.7MB
MD5

119764b23b4ba1669e5e3a2f001d9974
SHA1

d951b8ef60e3c11e0c90761fa0057aa3534df42c
SHA256

e540958829005866e4ecd6e7f1cdf3b5c2f063717a746d4485ff0ed62ccf9e71
SHA512

8c5bea8cbd88766da83d7c95bcaf3cc05b09c82def494bab1f779ffd9958d2459cd23d9ca98711386c8a4fef2ecbf4081dac62adced9a7ebda33643d1c10f175
SSDEEP

49152:d8mdIHHlnWrxywK5/AXx1RPIf44B81jKn/VS5pXw6Qc:d8mdIHHlnWQJKyl+Fl5Qc

Score

10^/10

guloader remcos crypted downloader persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Crypted

C2

ourt2949aslumes9.duckdns.org:2401

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
paqlgkfs.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
ourvbpld-RBN2WW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Loads dropped DLL 2 IoCs

Processes:

SirtakiQuote No 104-346.exe

pid process

456 SirtakiQuote No 104-346.exe
456 SirtakiQuote No 104-346.exe

pid	process
456	SirtakiQuote No 104-346.exe
456	SirtakiQuote No 104-346.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wab.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mahzor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Footles\\monnie.exe"	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

2304 wab.exe
2304 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

SirtakiQuote No 104-346.exewab.exe

pid process

456 SirtakiQuote No 104-346.exe
2304 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

SirtakiQuote No 104-346.exe

description pid process target process

PID 456 set thread context of 2304 456 SirtakiQuote No 104-346.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

SirtakiQuote No 104-346.exe

pid process

456 SirtakiQuote No 104-346.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

2304 wab.exe

pid	process
2304	wab.exe
2304	wab.exe

pid	process
456	SirtakiQuote No 104-346.exe
2304	wab.exe

description	pid	process	target process
PID 456 set thread context of 2304	456	SirtakiQuote No 104-346.exe	wab.exe

pid	process
456	SirtakiQuote No 104-346.exe

pid	process
2304	wab.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

SirtakiQuote No 104-346.exe

description	pid	process	target process
PID 456 wrote to memory of 2304	456	SirtakiQuote No 104-346.exe	wab.exe
PID 456 wrote to memory of 2304	456	SirtakiQuote No 104-346.exe	wab.exe
PID 456 wrote to memory of 2304	456	SirtakiQuote No 104-346.exe	wab.exe
PID 456 wrote to memory of 2304	456	SirtakiQuote No 104-346.exe	wab.exe
PID 456 wrote to memory of 2304	456	SirtakiQuote No 104-346.exe	wab.exe

C:\Users\Admin\AppData\Local\Temp\SirtakiQuote No 104-346.exe
"C:\Users\Admin\AppData\Local\Temp\SirtakiQuote No 104-346.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:456

C:\Program Files (x86)\windows mail\wab.exe
"C:\Users\Admin\AppData\Local\Temp\SirtakiQuote No 104-346.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nscD51F.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscD51F.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscD51F.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
memory/456-35-0x0000000002DE0000-0x000000000479D000-memory.dmp

Filesize
25.7MB

Download
memory/456-36-0x0000000002DE0000-0x000000000479D000-memory.dmp

Filesize
25.7MB

Download
memory/456-37-0x0000000077431000-0x0000000077551000-memory.dmp

Filesize
1.1MB

Download
memory/456-38-0x00000000741B0000-0x00000000741B6000-memory.dmp

Filesize
24KB

Download
memory/2304-46-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-50-0x0000000000E70000-0x000000000282D000-memory.dmp

Filesize
25.7MB

Download
memory/2304-41-0x00000000774B8000-0x00000000774B9000-memory.dmp

Filesize
4KB

Download
memory/2304-42-0x0000000077431000-0x0000000077551000-memory.dmp

Filesize
1.1MB

Download
memory/2304-44-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-39-0x0000000000E70000-0x000000000282D000-memory.dmp

Filesize
25.7MB

Download
memory/2304-47-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-49-0x0000000000E70000-0x000000000282D000-memory.dmp

Filesize
25.7MB

Download
memory/2304-51-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-40-0x0000000000E70000-0x000000000282D000-memory.dmp

Filesize
25.7MB

Download
memory/2304-52-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-53-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-54-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-55-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-56-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-57-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-58-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-59-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download
memory/2304-60-0x0000000072F50000-0x00000000741A4000-memory.dmp

Filesize
18.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads