guloader | 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d

General

Target

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
Size

474KB
MD5

25ba729a1538d68ad33fe36ca0548181
SHA1

1f87157d8d29b9d40b0e1ad6eb4617ba684c8f1a
SHA256

75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d
SHA512

86816fb6b3157e397a43828fcdc8dd7c0488ad7e634c49ecd13c12e28c0a88872f40c50287a4a01200638906a6781c6a38f6349374dc91b3c3c6f1ba5dfefbf9
SSDEEP

12288:6a7r+1Jt7W+FFqQ5xrW2nPD4EdaMAboDO:Fr+1T7W+7q+CCP8DqO

Score

10^/10

guloader remcos 2024 downloader persistence rat

Malware Config

Extracted

Family

remcos

Botnet

2024

C2

72.11.158.94:1604

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
vexplorers.exe
copy_folder
vexplorers
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-800RNZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 1 IoCs

Processes:

vexplorers.exe

pid process

1512 vexplorers.exe

pid	process
1512	vexplorers.exe

Loads dropped DLL 5 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exeORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exevexplorers.exe

pid	process
2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
2740	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
1512	vexplorers.exe
1512	vexplorers.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Korrektivers = "C:\\Users\\Admin\\AppData\\Roaming\\Besjlendes\\Insistere.exe"	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-800RNZ = "\"C:\\ProgramData\\vexplorers\\vexplorers.exe\""	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-800RNZ = "\"C:\\ProgramData\\vexplorers\\vexplorers.exe\""	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid process

2740 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exeORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid process

2440 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
2740 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid	process
2740	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

description	pid	process	target process
PID 2440 set thread context of 2740	2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Drops file in Windows directory 4 IoCs

Processes:

vexplorers.exeORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

description	ioc	process
File opened for modification	C:\Windows\udskamningen.com	vexplorers.exe
File opened for modification	C:\Windows\payout\opsigt.nic	vexplorers.exe
File opened for modification	C:\Windows\udskamningen.com	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
File opened for modification	C:\Windows\payout\opsigt.nic	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid process

2440 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exeORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

description	pid	process	target process
PID 2440 wrote to memory of 2740	2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 2440 wrote to memory of 2740	2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 2440 wrote to memory of 2740	2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 2440 wrote to memory of 2740	2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 2440 wrote to memory of 2740	2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 2440 wrote to memory of 2740	2440	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 2740 wrote to memory of 1512	2740	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	vexplorers.exe
PID 2740 wrote to memory of 1512	2740	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	vexplorers.exe
PID 2740 wrote to memory of 1512	2740	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	vexplorers.exe
PID 2740 wrote to memory of 1512	2740	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	vexplorers.exe

C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\ProgramData\vexplorers\vexplorers.exe
    "C:\ProgramData\vexplorers\vexplorers.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vexplorers\vexplorers.exe

Filesize
165KB

MD5
b9caf6802fc3a98b95871dc7f15749fd

SHA1
f68cbfbdb56f7ba4af18286a2751e4030202eae6

SHA256
f8dc4f8c876be015b37565d99917285dd6869a440147402ff485efdf9e9baa65

SHA512
30505dfab2440cfab09aa8ad22ffcfc2b81f784ca5be816947da6aef0932c438754b9a41a206846b9f6dbf52164f3ad874f6d36dbad343d27db6a7051d29d337

Download Submit
C:\ProgramData\vexplorers\vexplorers.exe

Filesize
474KB

MD5
25ba729a1538d68ad33fe36ca0548181

SHA1
1f87157d8d29b9d40b0e1ad6eb4617ba684c8f1a

SHA256
75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d

SHA512
86816fb6b3157e397a43828fcdc8dd7c0488ad7e634c49ecd13c12e28c0a88872f40c50287a4a01200638906a6781c6a38f6349374dc91b3c3c6f1ba5dfefbf9

Download Submit
\ProgramData\vexplorers\vexplorers.exe

Filesize
112KB

MD5
75b99baaeed3be6157b14a11c9f74231

SHA1
7c9d6de010bf6a336668e8be9bcd8bbfc7a9c197

SHA256
f4f55ec6a79f9b6b451667832d6273ed6f30dd2b0c37ec37f9131d4ce77480ad

SHA512
0a2644ccc586dfc22f7d8abfabf84f3498c0ec6baa78780d2228070814c871e1ad6ff97b092d420f1f6c607c7f26dd327f425f41ca03d6891b7ed6f9a5a74023

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1343.tmp\System.dll

Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
memory/1512-51-0x0000000002C20000-0x0000000005D22000-memory.dmp

Filesize
49.0MB

Download
memory/2440-16-0x0000000002DB0000-0x0000000005EB2000-memory.dmp

Filesize
49.0MB

Download
memory/2440-17-0x0000000077750000-0x00000000778F9000-memory.dmp

Filesize
1.7MB

Download
memory/2440-18-0x0000000077940000-0x0000000077A16000-memory.dmp

Filesize
856KB

Download
memory/2440-19-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2440-21-0x0000000002DB0000-0x0000000005EB2000-memory.dmp

Filesize
49.0MB

Download
memory/2740-26-0x00000000004A0000-0x0000000001502000-memory.dmp

Filesize
16.4MB

Download
memory/2740-27-0x0000000001510000-0x0000000004612000-memory.dmp

Filesize
49.0MB

Download
memory/2740-28-0x00000000004A0000-0x0000000001502000-memory.dmp

Filesize
16.4MB

Download
memory/2740-24-0x0000000077940000-0x0000000077A16000-memory.dmp

Filesize
856KB

Download
memory/2740-23-0x0000000077976000-0x0000000077977000-memory.dmp

Filesize
4KB

Download
memory/2740-32-0x0000000077940000-0x0000000077A16000-memory.dmp

Filesize
856KB

Download
memory/2740-50-0x0000000077750000-0x00000000778F9000-memory.dmp

Filesize
1.7MB

Download
memory/2740-22-0x0000000077750000-0x00000000778F9000-memory.dmp

Filesize
1.7MB

Download
memory/2740-20-0x0000000001510000-0x0000000004612000-memory.dmp

Filesize
49.0MB

Download
memory/2740-52-0x0000000001510000-0x0000000004612000-memory.dmp

Filesize
49.0MB

Download
memory/2740-39-0x00000000004A0000-0x0000000001502000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads