guloader | ec89cffb121da537dc5258492100381eba2016afa83360c7eec226a7e1b30e34

Analysis

max time kernel
2s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ARKBCN0000134245 BBL.exe
Size

1.0MB
MD5

195787f942427352db785fea42c93f43
SHA1

11349f0aa5059663c99bddb4b1d4925b0795d4c0
SHA256

4957fb0faa66fa85bd02e198c98d741a6edf5f683538601bbc7099f88aa4ac30
SHA512

b12df24dff447cec94123248d5d3b9619f7a2d4ebbf21ee42b8beedcea471d9d6b92ddd0e580e29e506b472e8670f6f430dfaa4959e479ea82b9e269ff694ae4
SSDEEP

12288:Ec0xoWbGGh7p/pMSC8grbTQJy4Uwjh5orvRNDRDVu4YT9vZTWbay6spuxv:Ec0xoWNh7pnd6Pey4dXor3D+DWK/v

Score

10^/10

guloader remcos crypted downloader rat

Malware Config

Extracted

Family

remcos

Botnet

Crypted

ourt2949aslumes9.duckdns.org:2401

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
paqlgkfs.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
ourvbpld-RBN2WW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ARKBCN0000134245 BBL.exe
"C:\Users\Admin\AppData\Local\Temp\ARKBCN0000134245 BBL.exe"
1⤵
PID:1216

C:\Program Files (x86)\windows mail\wab.exe
"C:\Users\Admin\AppData\Local\Temp\ARKBCN0000134245 BBL.exe"
2⤵
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nskEBF8.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskEBF8.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskEBF8.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
memory/1216-18-0x00000000033D0000-0x0000000004E12000-memory.dmp

Filesize
26.3MB

Download
memory/1216-19-0x00000000033D0000-0x0000000004E12000-memory.dmp

Filesize
26.3MB

Download
memory/1216-20-0x00000000772C1000-0x00000000773E1000-memory.dmp

Filesize
1.1MB

Download
memory/1216-21-0x0000000073FB0000-0x0000000073FB6000-memory.dmp

Filesize
24KB

Download
memory/4796-30-0x0000000001000000-0x0000000002A42000-memory.dmp

Filesize
26.3MB

Download
memory/4796-34-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-24-0x00000000772C1000-0x00000000773E1000-memory.dmp

Filesize
1.1MB

Download
memory/4796-25-0x0000000077348000-0x0000000077349000-memory.dmp

Filesize
4KB

Download
memory/4796-26-0x00000000772C1000-0x00000000773E1000-memory.dmp

Filesize
1.1MB

Download
memory/4796-28-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-29-0x0000000001000000-0x0000000002A42000-memory.dmp

Filesize
26.3MB

Download
memory/4796-22-0x0000000001000000-0x0000000002A42000-memory.dmp

Filesize
26.3MB

Download
memory/4796-31-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-32-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-33-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-23-0x0000000001000000-0x0000000002A42000-memory.dmp

Filesize
26.3MB

Download
memory/4796-35-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-36-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-37-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-38-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-39-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-40-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-41-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-42-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download
memory/4796-43-0x0000000072D50000-0x0000000073FA4000-memory.dmp

Filesize
18.3MB

Download