guloader | 350b880f0d6decd8465dd8ae66631ef343049b3184d8dc1c3dfdac27a2e7f044

General

Target

rRFQ0588904.exe
Size

283KB
MD5

49bf94149036b79f5b8f1350dde4822a
SHA1

682fa9beeead55b00c9b088094f8f7a1c7ab47fb
SHA256

350b880f0d6decd8465dd8ae66631ef343049b3184d8dc1c3dfdac27a2e7f044
SHA512

00ebf61eb63cb5c7aaeb13629079106edf9640d5dfc5074e3bdbd09fcf125bac38b56a98e011ccbd6437a1eb105eadec16b92e7fcc8a722017a105fdf1d059b4
SSDEEP

6144:gT4DtPsamsHBrJw4FkSxwojgO05YKxdLjdaZWAYjjuirZEZb:gTAsamshNJFdbkxdSVquNZb

Score

10^/10

guloader remcos remotehost collection downloader rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

209.127.186.232:4765

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YRLOX5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3728-60-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/3728-65-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4964-57-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4964-72-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/4964-57-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3728-60-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/3728-65-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/3712-68-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3712-69-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4964-72-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Loads dropped DLL 5 IoCs

pid	Process
4228	rRFQ0588904.exe
4228	rRFQ0588904.exe
4228	rRFQ0588904.exe
4228	rRFQ0588904.exe
4228	rRFQ0588904.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rRFQ0588904.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pessimize\pantets\borghalpenny\octals.ini	rRFQ0588904.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1968	rRFQ0588904.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4228	rRFQ0588904.exe
1968	rRFQ0588904.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4228 set thread context of 1968	4228	rRFQ0588904.exe	103
PID 1968 set thread context of 4964	1968	rRFQ0588904.exe	104
PID 1968 set thread context of 3728	1968	rRFQ0588904.exe	105
PID 1968 set thread context of 3712	1968	rRFQ0588904.exe	106

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\kneepan\Feteringerne27\luise\Traceback\overcircumspect\furrowed\lizbets\gastrocnemii\ubeskrivelig.fje	rRFQ0588904.exe
File opened for modification	C:\Windows\Fonts\textures\toggler\unmobbed\eskamoteringernes.Kre216	rRFQ0588904.exe
File opened for modification	C:\Windows\resources\0409\Rygmarvs\baghaves\svndrukkent\eskorternes\racier\Coercivity.ini	rRFQ0588904.exe
File opened for modification	C:\Windows\resources\0409\fineredes\Azured73\skulpens.Fou94	rRFQ0588904.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3096	1968	WerFault.exe	103

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4964	rRFQ0588904.exe
4964	rRFQ0588904.exe
3712	rRFQ0588904.exe
3712	rRFQ0588904.exe
4964	rRFQ0588904.exe
4964	rRFQ0588904.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4228	rRFQ0588904.exe
1968	rRFQ0588904.exe
1968	rRFQ0588904.exe
1968	rRFQ0588904.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	rRFQ0588904.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1968	rRFQ0588904.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1968	4228	rRFQ0588904.exe	103
PID 4228 wrote to memory of 1968	4228	rRFQ0588904.exe	103
PID 4228 wrote to memory of 1968	4228	rRFQ0588904.exe	103
PID 4228 wrote to memory of 1968	4228	rRFQ0588904.exe	103
PID 4228 wrote to memory of 1968	4228	rRFQ0588904.exe	103
PID 1968 wrote to memory of 4964	1968	rRFQ0588904.exe	104
PID 1968 wrote to memory of 4964	1968	rRFQ0588904.exe	104
PID 1968 wrote to memory of 4964	1968	rRFQ0588904.exe	104
PID 1968 wrote to memory of 3728	1968	rRFQ0588904.exe	105
PID 1968 wrote to memory of 3728	1968	rRFQ0588904.exe	105
PID 1968 wrote to memory of 3728	1968	rRFQ0588904.exe	105
PID 1968 wrote to memory of 3712	1968	rRFQ0588904.exe	106
PID 1968 wrote to memory of 3712	1968	rRFQ0588904.exe	106
PID 1968 wrote to memory of 3712	1968	rRFQ0588904.exe	106

C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe
"C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe
  "C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe
    C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe /stext "C:\Users\Admin\AppData\Local\Temp\qxolbunowyxiscntagnpxuvnqcfuumgssr"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe
    C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe /stext "C:\Users\Admin\AppData\Local\Temp\azbvum"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe
    C:\Users\Admin\AppData\Local\Temp\rRFQ0588904.exe /stext "C:\Users\Admin\AppData\Local\Temp\ctgoufiky"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 1832
    3⤵
    - Program crash
    PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1968 -ip 1968
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsh23D0.tmp\LangDLL.dll

Filesize
5KB

MD5
014a3be4a7c1ccb217916dbf4f222bd1

SHA1
9b4c41eb0e84886beb5591d8357155e27f9c68ed

SHA256
09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

SHA512
0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh23D0.tmp\LangDLL.dll

Filesize
5KB

MD5
014a3be4a7c1ccb217916dbf4f222bd1

SHA1
9b4c41eb0e84886beb5591d8357155e27f9c68ed

SHA256
09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

SHA512
0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh23D0.tmp\LangDLL.dll

Filesize
5KB

MD5
014a3be4a7c1ccb217916dbf4f222bd1

SHA1
9b4c41eb0e84886beb5591d8357155e27f9c68ed

SHA256
09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

SHA512
0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh23D0.tmp\LangDLL.dll

Filesize
5KB

MD5
014a3be4a7c1ccb217916dbf4f222bd1

SHA1
9b4c41eb0e84886beb5591d8357155e27f9c68ed

SHA256
09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

SHA512
0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh23D0.tmp\LangDLL.dll

Filesize
5KB

MD5
014a3be4a7c1ccb217916dbf4f222bd1

SHA1
9b4c41eb0e84886beb5591d8357155e27f9c68ed

SHA256
09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8

SHA512
0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh23D0.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Local\Temp\qxolbunowyxiscntagnpxuvnqcfuumgssr

Filesize
4KB

MD5
e4a10383112b65cf1ebe152e69b201e1

SHA1
5bd437d88f7e4b7bca224d14ee4997c8ed523696

SHA256
298b628b00621049409f66f81960f7faaa38f2c68adf7cf50c315c199c7b4ea9

SHA512
bd6e072d08538cf69b35c2157e17b4eae4f6c10ad209dacb5766fc312ef1a5a576e925de8406efac9cb8b6c29d5f5b077371a8fba58b6ff183d0cf8dbb2dae2d

Download Submit
memory/1968-82-0x0000000033D50000-0x0000000033D69000-memory.dmp

Filesize
100KB

Download
memory/1968-47-0x00000000004A0000-0x0000000002B82000-memory.dmp

Filesize
38.9MB

Download
memory/1968-79-0x0000000076F91000-0x00000000770B1000-memory.dmp

Filesize
1.1MB

Download
memory/1968-26-0x00000000004A0000-0x0000000002B82000-memory.dmp

Filesize
38.9MB

Download
memory/1968-27-0x0000000077018000-0x0000000077019000-memory.dmp

Filesize
4KB

Download
memory/1968-28-0x00000000004A0000-0x0000000002B82000-memory.dmp

Filesize
38.9MB

Download
memory/1968-29-0x0000000077035000-0x0000000077036000-memory.dmp

Filesize
4KB

Download
memory/1968-42-0x0000000072A10000-0x0000000073C64000-memory.dmp

Filesize
18.3MB

Download
memory/1968-43-0x0000000072A10000-0x0000000073C64000-memory.dmp

Filesize
18.3MB

Download
memory/1968-80-0x00000000004A0000-0x0000000002B82000-memory.dmp

Filesize
38.9MB

Download
memory/1968-78-0x0000000033D50000-0x0000000033D69000-memory.dmp

Filesize
100KB

Download
memory/1968-81-0x0000000072A10000-0x0000000073C64000-memory.dmp

Filesize
18.3MB

Download
memory/1968-75-0x0000000033D50000-0x0000000033D69000-memory.dmp

Filesize
100KB

Download
memory/3712-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3712-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3728-50-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3728-65-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3728-60-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3728-54-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4228-25-0x0000000073C70000-0x0000000073C77000-memory.dmp

Filesize
28KB

Download
memory/4228-24-0x0000000076F91000-0x00000000770B1000-memory.dmp

Filesize
1.1MB

Download
memory/4228-23-0x0000000004050000-0x0000000006732000-memory.dmp

Filesize
38.9MB

Download
memory/4228-22-0x0000000004050000-0x0000000006732000-memory.dmp

Filesize
38.9MB

Download
memory/4964-57-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-53-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4964-49-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing