guloader | e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf

General

Target

e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
Size

885KB
MD5

5009d8c72623d30ce09149187c66d37c
SHA1

5c6035f099f16ff4753198e5f631ba410e98227f
SHA256

e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf
SHA512

5908f38589b4097fd96f35129bbfa344a7940193ef0df6dab4e514106e7054c8ea9b3e97f9ebb7ff36fdbbd7c724cd1500e37f6c1ea6013f51842d39a642b5c1
SSDEEP

12288:i3nIF6bq58AFe0TenvBdHdpUXjwxipfpQGYAGau5yxX9O9R:i3IFsmez5pdpUXjUiNuGYpawA9uR

Score

10^/10

guloader remcos remotehost collection discovery downloader rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

162.251.122.106:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BHLA3T
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 6 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4856-311-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/5096-317-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/5096-321-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4856-312-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4536-310-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4536-326-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5096-317-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/5096-321-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4536-310-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4536-326-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Loads dropped DLL 2 IoCs

pid	Process
3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 4848	3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	91
PID 4848 set thread context of 4536	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	98
PID 4848 set thread context of 5096	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	99
PID 4848 set thread context of 4856	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	100

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\kvindagtigt.ini	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4856	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4536	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4856	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4536	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4536	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4536	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4848	3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	91
PID 3288 wrote to memory of 4848	3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	91
PID 3288 wrote to memory of 4848	3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	91
PID 3288 wrote to memory of 4848	3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	91
PID 3288 wrote to memory of 4848	3288	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	91
PID 4848 wrote to memory of 4536	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	98
PID 4848 wrote to memory of 4536	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	98
PID 4848 wrote to memory of 4536	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	98
PID 4848 wrote to memory of 5096	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	99
PID 4848 wrote to memory of 5096	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	99
PID 4848 wrote to memory of 5096	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	99
PID 4848 wrote to memory of 4856	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	100
PID 4848 wrote to memory of 4856	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	100
PID 4848 wrote to memory of 4856	4848	e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe	100

C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
"C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
  "C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
    C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe /stext "C:\Users\Admin\AppData\Local\Temp\rbdlwbdekaryrkurznvcgebcflu"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4536
- - C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
    C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe /stext "C:\Users\Admin\AppData\Local\Temp\bdjvxtoxyikdtyqviyqwjjvloseqrho"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
    C:\Users\Admin\AppData\Local\Temp\e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe /stext "C:\Users\Admin\AppData\Local\Temp\lxooylyzuqcidfezzjdxuvqcpgwrksejsa"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\kvindagtigt.ini

Filesize
52B

MD5
f298228d2d42ced0a00b0c5320000835

SHA1
fb06f02ddcda4c9ec752a688ee617064db3a49eb

SHA256
e399afe89f97eae7bcdae626913da1618f4f42ba11887217cdbf524720532ab2

SHA512
464da89f9e1d5935810443b20c3d19f77585d964df89f5cb427482a03c8ef6274d06cbc01533d92c691ffd55e1725ba5f427d023a45a5128bced0eee11e083fe

Download Submit
C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
1f8bb0670a04e9d0a107e652fc5e3349

SHA1
3e7f71f4ca516a8236204dea279552348a554eab

SHA256
1780707ee5b24f87af0f34dac546fb2ebb57b78d6676625eb7b0cff92915b459

SHA512
dbfea78c6e9dddfcec383a789d7cfcaa4ef03e57fd6a38be4de3ed83cc2265f381a2304f669c171791ae1a9d82fdfc5e2008d24d199d625b9569a87c9b91e3c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7C07.tmp\System.dll

Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\rbdlwbdekaryrkurznvcgebcflu

Filesize
4KB

MD5
16dfb23eaa7972c59c36fcbc0946093b

SHA1
1e9e3ff83a05131575f67e202d352709205f20f8

SHA256
36c49c94327c8cadcad4c0d2b3a8f5162fc7bb86624923484476c5f7b960bc4c

SHA512
a8b38b5e7bf886b78c5c7f01234b44647a252d4dfbcc06c99b863f8e160e3cfc151b2a83b8b49e09d13e8547419467da4bffbb8dee5fc6740032eb7c839d89dc

Download Submit
memory/3288-294-0x00000000045D0000-0x000000000602F000-memory.dmp

Filesize
26.4MB

Download
memory/3288-295-0x0000000077A51000-0x0000000077B71000-memory.dmp

Filesize
1.1MB

Download
memory/3288-296-0x00000000746A5000-0x00000000746A6000-memory.dmp

Filesize
4KB

Download
memory/3288-297-0x00000000045D0000-0x000000000602F000-memory.dmp

Filesize
26.4MB

Download
memory/4536-310-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4536-306-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4536-326-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4536-305-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4848-339-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-348-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-372-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-369-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-366-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-354-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-351-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-320-0x0000000001AA0000-0x00000000034FF000-memory.dmp

Filesize
26.4MB

Download
memory/4848-345-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-342-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-328-0x0000000034620000-0x0000000034639000-memory.dmp

Filesize
100KB

Download
memory/4848-331-0x0000000034620000-0x0000000034639000-memory.dmp

Filesize
100KB

Download
memory/4848-332-0x0000000034620000-0x0000000034639000-memory.dmp

Filesize
100KB

Download
memory/4848-333-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-336-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-299-0x0000000000840000-0x0000000001A94000-memory.dmp

Filesize
18.3MB

Download
memory/4848-298-0x0000000001AA0000-0x00000000034FF000-memory.dmp

Filesize
26.4MB

Download
memory/4856-311-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4856-308-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4856-309-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4856-312-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5096-317-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5096-307-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5096-316-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5096-321-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing