guloader | 1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea

Analysis

max time kernel
146s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea.exe
Size 520KB
Sample240422-nnad4aah51
SHA256 1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea
MD5 ef53493176b714d7c8c972a756cfd806
SHA1 c7c08850f9dd1706a2a2a5b456f5de2b25eb200c
SHA512 eab8465a629001a43631724aaa9293c229286bebb33c943ce197ce5f17419b9b91c6f9be86c4dec68d4b099871abf3fa05807e99876ffa0ee3497f3a5abac2fa
SSDEEP 12288:fnPdhsFldr2BFS3Cr3HUNdAfZBAfYKBuyhleDJB:vPdhoeBYSrHU7K9KBuRJB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader remcos remotehost collection downloader rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

209.90.234.20:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YDAEDG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/3036-176-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/3036-179-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral1/memory/3036-193-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/656-169-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/656-170-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/656-188-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 9 IoCs

resource	yara_rule
behavioral1/memory/656-169-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/3036-176-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/656-170-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/3036-179-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/412-181-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/412-182-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/412-183-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/656-188-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/3036-193-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1320	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1684	powershell.exe
1320	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 1320	1684	powershell.exe	32
PID 1320 set thread context of 656	1320	wab.exe	35
PID 1320 set thread context of 3036	1320	wab.exe	36
PID 1320 set thread context of 412	1320	wab.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	1320	WerFault.exe	32

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
656	wab.exe
656	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1684	powershell.exe
1320	wab.exe
1320	wab.exe
1320	wab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	412	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	wab.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1684	1656	1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea.exe	28
PID 1656 wrote to memory of 1684	1656	1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea.exe	28
PID 1656 wrote to memory of 1684	1656	1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea.exe	28
PID 1656 wrote to memory of 1684	1656	1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea.exe	28
PID 1684 wrote to memory of 2208	1684	powershell.exe	30
PID 1684 wrote to memory of 2208	1684	powershell.exe	30
PID 1684 wrote to memory of 2208	1684	powershell.exe	30
PID 1684 wrote to memory of 2208	1684	powershell.exe	30
PID 1684 wrote to memory of 1320	1684	powershell.exe	32
PID 1684 wrote to memory of 1320	1684	powershell.exe	32
PID 1684 wrote to memory of 1320	1684	powershell.exe	32
PID 1684 wrote to memory of 1320	1684	powershell.exe	32
PID 1684 wrote to memory of 1320	1684	powershell.exe	32
PID 1684 wrote to memory of 1320	1684	powershell.exe	32
PID 1320 wrote to memory of 656	1320	wab.exe	35
PID 1320 wrote to memory of 656	1320	wab.exe	35
PID 1320 wrote to memory of 656	1320	wab.exe	35
PID 1320 wrote to memory of 656	1320	wab.exe	35
PID 1320 wrote to memory of 656	1320	wab.exe	35
PID 1320 wrote to memory of 3036	1320	wab.exe	36
PID 1320 wrote to memory of 3036	1320	wab.exe	36
PID 1320 wrote to memory of 3036	1320	wab.exe	36
PID 1320 wrote to memory of 3036	1320	wab.exe	36
PID 1320 wrote to memory of 3036	1320	wab.exe	36
PID 1320 wrote to memory of 412	1320	wab.exe	37
PID 1320 wrote to memory of 412	1320	wab.exe	37
PID 1320 wrote to memory of 412	1320	wab.exe	37
PID 1320 wrote to memory of 412	1320	wab.exe	37
PID 1320 wrote to memory of 412	1320	wab.exe	37
PID 1320 wrote to memory of 1716	1320	wab.exe	38
PID 1320 wrote to memory of 1716	1320	wab.exe	38
PID 1320 wrote to memory of 1716	1320	wab.exe	38
PID 1320 wrote to memory of 1716	1320	wab.exe	38

C:\Users\Admin\AppData\Local\Temp\1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea.exe
"C:\Users\Admin\AppData\Local\Temp\1353d2318463be28ebcffe36398b90b873ee21e2bde3d03f929103729c4b95ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden ; $limpiness=Get-Content 'C:\Users\Admin\AppData\Roaming\Usitative\healthless\hovedanpartshaver\ravnemorens\Frsteinstanserne\Instantiations.Lil';$Sears=$limpiness.SubString(55857,3);.$Sears($limpiness)
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
    3⤵
    PID:2208
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cjsdziqvlj"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:656
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mmfnraaxzrerl"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:3036
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xglgstlqnzwwvytwm"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 892
      4⤵
      Program crash
      PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cjsdziqvlj

Path C:\Users\Admin\AppData\Local\Temp\cjsdziqvlj
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Tandkrusenes.Unm

Path C:\Users\Admin\AppData\Roaming\Usitative\healthless\hovedanpartshaver\Keglestubs\Konkursbegringer\Ceyloneseren\Tandkrusenes.Unm
Size 332KB
SHA256 d21e3ddf67c09b2192e823d2969d8f441023764d7d8e7554328aaa547c43604e
MD5 fdf7c7dcc4871871d8bc9302bd01c148
SHA1 9d1f26dfa0773d6ea821954992ae8d416d70d206
SHA512 a6abd1b3b367701b22fcfee8715820dac0a0783a847545b3774fbc263213ef3ecaf8bc5d3eaf58ba486e4f0bd2001344a23da962a5722eca5ca44c57a4615dee
SSDEEP 6144:SIHZjQAdZL2oLBDbEoX7HfsYZH8/3TrJBL6tUIevp1wIQZ3LplpsPg84p4ND:SEZ0IZqoLb7HUYZHKRBQUf/wICV38k4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Instantiations.Lil

Path C:\Users\Admin\AppData\Roaming\Usitative\healthless\hovedanpartshaver\ravnemorens\Frsteinstanserne\Instantiations.Lil
Size 54KB
SHA256 eb26aa5b4ec7a1c0c0ad2be344c02a23f770815a40e84e5b1b5fe24c9b64edda
MD5 63d0c546b30964e943c2ac8fd5e236db
SHA1 7d46713cb1d3cbfe25efcaf24369fb067d310920
SHA512 91399fec920e3be9526e1af39a632512c6c00cea3566a9ce43fdbadf813c5b2b830620bfc381747b195a4e2c52b8ef4d81295b484ea6ed925979a97b8cf6a1ed
SSDEEP 768:stRSpMsDEBbiYzC9AUQg+Fj0VY6fgw8cl+ZzPhkrV439KaEJQkP5HF0GEFGRGI:uRUM0qbiCYYo3gnZzPKrOtKaiT8rE
MD5 SHA1 SHA512 SSDEEP

Submit Download

aflytningslov.lnk

Path C:\Users\Admin\Pictures\aflytningslov.lnk
Size 1KB
SHA256 d84bf8252836cc5789861fc363690702a6df6ebd6818d76ab3c546976a3b2da6
MD5 3a644ae8724d5106d5fa8931cf1383bc
SHA1 f6324df23735d41fc4e674e10a4fb20c97261bae
SHA512 9b698a447cdb44224d12a96f219d924a51b95d92fef841f367f651b943fd2b9a811cc8108af2d790fc86de995c603dab9a2db3c584b364bde51d4c07f62e815a
MD5 SHA1 SHA512

Submit Download

memory/412-181-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/412-182-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/412-183-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/412-180-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/412-175-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/656-188-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/656-167-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/656-170-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/656-169-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/656-163-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/656-161-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1320-159-0x0000000001B10000-0x0000000004034000-memory.dmp

Download

memory/1320-147-0x00000000770C0000-0x0000000077269000-memory.dmp

Download

memory/1320-198-0x0000000000AA0000-0x0000000001B02000-memory.dmp

Download

memory/1320-149-0x00000000772B0000-0x0000000077386000-memory.dmp

Download

memory/1320-150-0x00000000772E6000-0x00000000772E7000-memory.dmp

Download

memory/1320-151-0x0000000000AA0000-0x0000000001B02000-memory.dmp

Download

memory/1320-152-0x0000000000AA0000-0x0000000001B02000-memory.dmp

Download

memory/1320-156-0x00000000772B0000-0x0000000077386000-memory.dmp

Download

memory/1320-197-0x0000000000970000-0x0000000000989000-memory.dmp

Download

memory/1320-146-0x0000000001B10000-0x0000000004034000-memory.dmp

Download

memory/1320-194-0x0000000000970000-0x0000000000989000-memory.dmp

Download

memory/1320-191-0x00000000772B0000-0x0000000077386000-memory.dmp

Download

memory/1320-190-0x0000000000AA0000-0x0000000001B02000-memory.dmp

Download

memory/1320-177-0x00000000770C0000-0x0000000077269000-memory.dmp

Download

memory/1684-141-0x0000000006990000-0x0000000008EB4000-memory.dmp

Download

memory/1684-137-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Download

memory/1684-142-0x00000000770C0000-0x0000000077269000-memory.dmp

Download

memory/1684-148-0x0000000006990000-0x0000000008EB4000-memory.dmp

Download

memory/1684-157-0x0000000006990000-0x0000000008EB4000-memory.dmp

Download

memory/1684-143-0x0000000073940000-0x0000000073EEB000-memory.dmp

Download

memory/1684-140-0x0000000006990000-0x0000000008EB4000-memory.dmp

Download

memory/1684-139-0x0000000002CE0000-0x0000000002CE4000-memory.dmp

Download

memory/1684-145-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Download

memory/1684-144-0x00000000772B0000-0x0000000077386000-memory.dmp

Download

memory/1684-133-0x0000000073940000-0x0000000073EEB000-memory.dmp

Download

memory/1684-134-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Download

memory/1684-132-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Download

memory/1684-131-0x0000000073940000-0x0000000073EEB000-memory.dmp

Download

memory/3036-164-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/3036-176-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3036-193-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3036-179-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3036-168-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3036-174-0x0000000000400000-0x0000000000462000-memory.dmp

Download