guloader | 75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d

Analysis

max time kernel
23s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
Size

474KB
MD5

25ba729a1538d68ad33fe36ca0548181
SHA1

1f87157d8d29b9d40b0e1ad6eb4617ba684c8f1a
SHA256

75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d
SHA512

86816fb6b3157e397a43828fcdc8dd7c0488ad7e634c49ecd13c12e28c0a88872f40c50287a4a01200638906a6781c6a38f6349374dc91b3c3c6f1ba5dfefbf9
SSDEEP

12288:6a7r+1Jt7W+FFqQ5xrW2nPD4EdaMAboDO:Fr+1T7W+7q+CCP8DqO

Score

10^/10

guloader remcos 2024 downloader persistence rat

Malware Config

Extracted

Family

remcos

Botnet

2024

72.11.158.94:1604

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
vexplorers.exe
copy_folder
vexplorers
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-800RNZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2456-89-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/2456-86-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/932-81-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/932-97-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/932-81-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2456-89-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/2992-94-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2992-93-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2992-92-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2456-86-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/932-97-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Executes dropped EXE 1 IoCs

Processes:

vexplorers.exe

pid process

2352 vexplorers.exe
Loads dropped DLL 2 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid process

3780 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
3780 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid	process
2352	vexplorers.exe

pid	process
3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Korrektivers = "C:\\Users\\Admin\\AppData\\Roaming\\Besjlendes\\Insistere.exe"	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-800RNZ = "\"C:\\ProgramData\\vexplorers\\vexplorers.exe\""	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-800RNZ = "\"C:\\ProgramData\\vexplorers\\vexplorers.exe\""	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid process

4944 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exeORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid process

3780 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
4944 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid	process
4944	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid	process
3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
4944	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

description	pid	process	target process
PID 3780 set thread context of 4944	3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Drops file in Windows directory 3 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exevexplorers.exe

description	ioc	process
File opened for modification	C:\Windows\udskamningen.com	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
File opened for modification	C:\Windows\payout\opsigt.nic	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
File opened for modification	C:\Windows\udskamningen.com	vexplorers.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4808 1896 WerFault.exe vexplorers.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid process

3780 ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

pid	pid_target	process	target process
4808	1896	WerFault.exe	vexplorers.exe

pid	process
3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exeORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe

description	pid	process	target process
PID 3780 wrote to memory of 4944	3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 3780 wrote to memory of 4944	3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 3780 wrote to memory of 4944	3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 3780 wrote to memory of 4944	3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 3780 wrote to memory of 4944	3780	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
PID 4944 wrote to memory of 2352	4944	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	vexplorers.exe
PID 4944 wrote to memory of 2352	4944	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	vexplorers.exe
PID 4944 wrote to memory of 2352	4944	ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe	vexplorers.exe

C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER#4510093083_PO_NEW_MATERIAL_JAN_2024.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\ProgramData\vexplorers\vexplorers.exe
    "C:\ProgramData\vexplorers\vexplorers.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2352
  - - C:\ProgramData\vexplorers\vexplorers.exe
      "C:\ProgramData\vexplorers\vexplorers.exe"
      4⤵
      PID:1896
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        
        PID:3700
    - - C:\ProgramData\vexplorers\vexplorers.exe
        
        C:\ProgramData\vexplorers\vexplorers.exe /stext "C:\Users\Admin\AppData\Local\Temp\spxbtjsayvcwqgxbio"
        5⤵
        
        PID:932
    - - C:\ProgramData\vexplorers\vexplorers.exe
        
        C:\ProgramData\vexplorers\vexplorers.exe /stext "C:\Users\Admin\AppData\Local\Temp\uskutbdumdubbmtnsznxig"
        5⤵
        
        PID:2456
    - - C:\ProgramData\vexplorers\vexplorers.exe
        
        C:\ProgramData\vexplorers\vexplorers.exe /stext "C:\Users\Admin\AppData\Local\Temp\fmqeuuowalmgdshrjjizttjas"
        5⤵
        
        PID:2992
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 1480
        5⤵
        Program crash
        
        PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1896 -ip 1896
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vexplorers\vexplorers.exe

Filesize
281KB

MD5
844ceedf735a4390e4cf27c6c8606403

SHA1
e86a7c906efd9433dba44bd77baedefc3d29f760

SHA256
8f04515949204864677725980d6da6f7b8cd4351cc6e801c6150e4ec92fe8436

SHA512
c4cca0c97742884994d125da9c5abeaf83b7ebf0c2cb464a555ae3494b537f63cddfa8ce64792b04b62921111b44dde9f1a280d0d8d50ab27a926cfdda369594

Download Submit
C:\ProgramData\vexplorers\vexplorers.exe

Filesize
336KB

MD5
086356d919db01f2a3b5e4dd868f63d3

SHA1
5f9268001de8f6387b3be9ae57a9c220d1622388

SHA256
93b1ca5bb9b846a67335decc90e83505bda15ef2ea5bee999cf9de3404aa6145

SHA512
ce8e6f59437f9555ce959ca7078d7d152c36293b367052837683e99568d55e4c447822dd43c68b19e4e52950bb6a83df191d09560466db13baba0dfffa77f1d6

Download Submit
C:\ProgramData\vexplorers\vexplorers.exe

Filesize
280KB

MD5
0114da381088699d964d4846574f38a5

SHA1
5e1742f84776f3739790aa636e2771979749b36a

SHA256
83c5f37b8886c85680724865519f83734b87fe8faf544b50b1fdf7bf48553bd7

SHA512
a8ffcacec15de8b704550d7e7772eac9292a276660ac74aa0d50cf61c0cc61e4d1597d5da6268f0a5cabdc27a706bc4654592116719f6b7af8a2e65164e11ccf

Download Submit
C:\ProgramData\vexplorers\vexplorers.exe

Filesize
474KB

MD5
25ba729a1538d68ad33fe36ca0548181

SHA1
1f87157d8d29b9d40b0e1ad6eb4617ba684c8f1a

SHA256
75ef5c2c26d3ccc5719073b3a6f2e1a3124843ef91bf5b65f7afdab4a90f9d8d

SHA512
86816fb6b3157e397a43828fcdc8dd7c0488ad7e634c49ecd13c12e28c0a88872f40c50287a4a01200638906a6781c6a38f6349374dc91b3c3c6f1ba5dfefbf9

Download Submit
C:\ProgramData\vexplorers\vexplorers.exe

Filesize
239KB

MD5
a298a1525f63a7ceccbcad00ac8c5dfd

SHA1
81ecf1f24eed116eb6c59912a2fd0246bfbd46ed

SHA256
3d73509a44a89e9b3d774d742901d9e7f5bf1c5c86f1c0c3c5fe783cc64f38a3

SHA512
e3db2ecdab032cd03f4d8f8dfb0f1ed8d17428538d64f90eca20bd61c9e1a572d5434bf87b6030ea3532af78c6fa69580713204256155498bea91f91309cf1e5

Download Submit
C:\ProgramData\vexplorers\vexplorers.exe

Filesize
228KB

MD5
f5962aa08bfec72135ea0b1e00fd3793

SHA1
479094de118af2e390359436bd7be93cb3358f5c

SHA256
39aedd864e279189919595497591aa47344df4f6b77195bfb2570d7aee0223cd

SHA512
0a9b5370d8160ad5baa56a580049ca0467a67f0604df572f1bf22bc56651086ec318e7a6070657073193382d8a82efc2583265d6238faee98f61af7186d4f055

Download Submit
C:\ProgramData\vexplorers\vexplorers.exe

Filesize
207KB

MD5
b97bc2250a27f88d69382d43089531d8

SHA1
92c882c62252919fea33040c1ff43e15d4f7fae5

SHA256
92dc3e775dc0b4b8eb7bc28d3ee527579d6e41cd249c8c96e9857fa9667b5729

SHA512
fcf44bed6c1effa6f17fd9713e5786837edb29a728521cd4947e90b852e52d79e76d565013bfeacccdd725e68ce1f8b71764c292f159766901a7da0ed9a01afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh4B62.tmp\System.dll

Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
C:\Users\Admin\AppData\Local\Temp\spxbtjsayvcwqgxbio

Filesize
4KB

MD5
02fe15a59a3018b7e51ef0169125b443

SHA1
31b425cff08ffd21e9430d26561fbbfa884a63e4

SHA256
aa2115eee916dd6c1f25bcf9ff5741258f1353b1f3357828f699ed80b642ed0b

SHA512
727ea4a9f3115678cf73566dc2180582dd581e9536ce3cb50558392d5c20e6feaf4ce9f0301ff090ff8fc7882c3a26e3daa6aea84b107136dc4a579ba5740d4e

Download Submit
C:\Users\Admin\AppData\Roaming\Besjlendes\Insistere.exe

Filesize
474KB

MD5
30cb39f5f2347ddc65dd0fc13b78474e

SHA1
b0631cd1214aef33f629214f2914c51d6982c64b

SHA256
9912739dc128c88cae2d33d256ca0d0dee577fd1c41ad4ad86e95831e0edafa1

SHA512
85fd98e07da2f5ae60ee0eb0c7d85923a271c706e5772dfb7402afabbc15e3e0a922e646a09ebaeb8ce12a0ee3c878290d121abaf1002373c3974055fe5e651a

Download Submit
C:\Users\Admin\yawlsman\knowhow\Aktiveringens\Dmtes.Slk

Filesize
230KB

MD5
47892ca7d11ae43e15e895ba1e61ba17

SHA1
3ae126e2a8057b1d3c4f8b5f34ba241cdd7c750a

SHA256
ec8e421820c2d1c945d51e28bacdc59405d206e0638d48bb79a5ac76fd5b6fb6

SHA512
191c2d3f4ab0f88291044c076dc23a950a73af8d4b5cdf5a3b9a55437d40fa0d995229e4f2f4360e6233bd3acdb29a0bb792c429b970571de7cd3f5f32123d8c

Download Submit
memory/932-77-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/932-97-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/932-81-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/932-71-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1896-100-0x0000000035460000-0x0000000035479000-memory.dmp

Filesize
100KB

Download
memory/1896-103-0x0000000035460000-0x0000000035479000-memory.dmp

Filesize
100KB

Download
memory/1896-104-0x00000000004A0000-0x00000000016F4000-memory.dmp

Filesize
18.3MB

Download
memory/1896-68-0x0000000001700000-0x0000000004802000-memory.dmp

Filesize
49.0MB

Download
memory/1896-56-0x0000000001700000-0x0000000004802000-memory.dmp

Filesize
49.0MB

Download
memory/2352-53-0x0000000002950000-0x0000000005A52000-memory.dmp

Filesize
49.0MB

Download
memory/2352-54-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2352-57-0x0000000002950000-0x0000000005A52000-memory.dmp

Filesize
49.0MB

Download
memory/2456-78-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2456-73-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2456-86-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2456-89-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2992-91-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2992-80-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2992-94-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2992-93-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2992-92-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3700-65-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3700-69-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3700-67-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3780-18-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/3780-20-0x0000000002A50000-0x0000000005B52000-memory.dmp

Filesize
49.0MB

Download
memory/3780-17-0x0000000077271000-0x0000000077391000-memory.dmp

Filesize
1.1MB

Download
memory/3780-16-0x0000000002A50000-0x0000000005B52000-memory.dmp

Filesize
49.0MB

Download
memory/4944-19-0x0000000001700000-0x0000000004802000-memory.dmp

Filesize
49.0MB

Download
memory/4944-25-0x00000000004A0000-0x00000000016F4000-memory.dmp

Filesize
18.3MB

Download
memory/4944-52-0x0000000001700000-0x0000000004802000-memory.dmp

Filesize
49.0MB

Download
memory/4944-21-0x00000000772F8000-0x00000000772F9000-memory.dmp

Filesize
4KB

Download
memory/4944-30-0x0000000077271000-0x0000000077391000-memory.dmp

Filesize
1.1MB

Download
memory/4944-41-0x00000000004A0000-0x00000000016F4000-memory.dmp

Filesize
18.3MB

Download
memory/4944-22-0x0000000077271000-0x0000000077391000-memory.dmp

Filesize
1.1MB

Download
memory/4944-24-0x00000000004A0000-0x00000000016F4000-memory.dmp

Filesize
18.3MB

Download