guloader | d215e131c7f591d62b988fecff9e40142cf34ed3ff68ac6bbb8ee332555734b5

General

Target

0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
Size

316KB
MD5

2a138508a3f7ad82efdeaaf2fc2e44b8
SHA1

af000f491f22fb1903f7ade1dad025ced9fa6a54
SHA256

0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc
SHA512

616a2aed06756f3ecee8c8ce86f2209d566d73806400ba2842a90204505c2b4bb9f3e56f6d6b23ad45bdd4e62014d43506383c6465a22dd53c41b74afe162c43
SSDEEP

6144:h3hqL36MLuSGP5cBl32nKaGstWs8soSoGhMfA07X52iWKmLrCBZ0O:h3l1ofaGxuoaR0LAdJWj0O

Score

10^/10

guloader remcos remotehost collection downloader rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

209.127.186.232:4765

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YRLOX5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/268-70-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral1/memory/268-77-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral1/memory/268-92-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2896-67-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/2896-78-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/2896-83-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral1/memory/2896-67-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/268-70-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral1/memory/3064-73-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/3064-74-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/2896-78-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/268-77-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral1/memory/2896-83-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/268-92-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft

Loads dropped DLL 5 IoCs

pid	Process
2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 2984	2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	30
PID 2984 set thread context of 2896	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	33
PID 2984 set thread context of 268	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	34
PID 2984 set thread context of 3064	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	35

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\afklaringskursus\superannate.fly	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	2984	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2896	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2896	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2984	2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	30
PID 2788 wrote to memory of 2984	2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	30
PID 2788 wrote to memory of 2984	2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	30
PID 2788 wrote to memory of 2984	2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	30
PID 2788 wrote to memory of 2984	2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	30
PID 2788 wrote to memory of 2984	2788	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	30
PID 2984 wrote to memory of 2896	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	33
PID 2984 wrote to memory of 2896	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	33
PID 2984 wrote to memory of 2896	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	33
PID 2984 wrote to memory of 2896	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	33
PID 2984 wrote to memory of 268	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	34
PID 2984 wrote to memory of 268	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	34
PID 2984 wrote to memory of 268	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	34
PID 2984 wrote to memory of 268	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	34
PID 2984 wrote to memory of 3064	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	35
PID 2984 wrote to memory of 3064	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	35
PID 2984 wrote to memory of 3064	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	35
PID 2984 wrote to memory of 3064	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	35
PID 2984 wrote to memory of 1996	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	36
PID 2984 wrote to memory of 1996	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	36
PID 2984 wrote to memory of 1996	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	36
PID 2984 wrote to memory of 1996	2984	0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe	36

C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
"C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
  "C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
    C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe /stext "C:\Users\Admin\AppData\Local\Temp\olcgydwpvundwymslhv"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
    C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe /stext "C:\Users\Admin\AppData\Local\Temp\yfhqzvhijcgigfawurqzcfh"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe
    C:\Users\Admin\AppData\Local\Temp\0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc.exe /stext "C:\Users\Admin\AppData\Local\Temp\bhvjaoakxkyuilwaeccamsulww"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1436
    3⤵
    - Program crash
    PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdA084.tmp\LangDLL.dll

Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\olcgydwpvundwymslhv

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA084.tmp\LangDLL.dll

Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA084.tmp\LangDLL.dll

Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA084.tmp\LangDLL.dll

Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA084.tmp\LangDLL.dll

Filesize
5KB

MD5
08de81a4584f5201086f57a7a93ed83b

SHA1
266a6ecc8fb7dca115e6915cd75e2595816841a8

SHA256
4883cd4231744be2dca4433ef62824b7957a3c16be54f8526270402d9413ebe6

SHA512
b72e7cea5ce1f4dc64e65a1f683a3ef9e3fa2dc45cf421f569eb461f1fdcc0caf4ff62a872e62b400579f567c6ff9fc3c2e6e020cdca89d96015502c803a09b9

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA084.tmp\System.dll

Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
memory/268-66-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/268-70-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/268-77-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/268-63-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/268-92-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2788-31-0x0000000074D50000-0x0000000074D57000-memory.dmp

Filesize
28KB

Download
memory/2788-30-0x0000000077730000-0x0000000077806000-memory.dmp

Filesize
856KB

Download
memory/2788-29-0x0000000077540000-0x00000000776E9000-memory.dmp

Filesize
1.7MB

Download
memory/2788-28-0x0000000003490000-0x000000000586B000-memory.dmp

Filesize
35.9MB

Download
memory/2788-27-0x0000000003490000-0x000000000586B000-memory.dmp

Filesize
35.9MB

Download
memory/2896-83-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2896-78-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2896-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2896-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2896-64-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2984-76-0x00000000007E0000-0x0000000002BBB000-memory.dmp

Filesize
35.9MB

Download
memory/2984-91-0x0000000032730000-0x0000000032749000-memory.dmp

Filesize
100KB

Download
memory/2984-95-0x0000000072AC0000-0x0000000073B22000-memory.dmp

Filesize
16.4MB

Download
memory/2984-94-0x0000000077540000-0x00000000776E9000-memory.dmp

Filesize
1.7MB

Download
memory/2984-32-0x00000000007E0000-0x0000000002BBB000-memory.dmp

Filesize
35.9MB

Download
memory/2984-59-0x00000000007E0000-0x0000000002BBB000-memory.dmp

Filesize
35.9MB

Download
memory/2984-55-0x0000000072AC0000-0x0000000073B22000-memory.dmp

Filesize
16.4MB

Download
memory/2984-33-0x0000000077540000-0x00000000776E9000-memory.dmp

Filesize
1.7MB

Download
memory/2984-86-0x0000000072AC0000-0x0000000073B22000-memory.dmp

Filesize
16.4MB

Download
memory/2984-88-0x0000000032730000-0x0000000032749000-memory.dmp

Filesize
100KB

Download
memory/3064-73-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3064-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3064-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3064-74-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing