guloader | 59146210128ee1a74ca1eb304bb156d7c83b3c85f3bc95a861fdb8ad2c885b3b

General

Target

PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
Size

855KB
MD5

0bca5053e588b923a819758a40d15fcf
SHA1

3ced9b60e382958d810022d5aa7101b828dfd8a5
SHA256

59146210128ee1a74ca1eb304bb156d7c83b3c85f3bc95a861fdb8ad2c885b3b
SHA512

51a39f3cdfe1909979162fac0ce6051239004cae07dd229462bb65bf7fe84f579c0cddffa828a8c533ef468b3c183fc19a4dfc4781d674503be228f609f4b8cf
SSDEEP

24576:vpwwZ9hDcP30jmiX0ZoDTRgrLTr8436/V4uVtCNOyO:Rx91cv0rOlrLTzK/VSOyO

Score

10^/10

guloader remcos chima discovery downloader persistence rat

Malware Config

Extracted

Family

remcos

Botnet

chima

C2

198.135.50.224:53648

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-512LV7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Downloads MZ/PE file 1 IoCs

flow	pid	Process
42	2872	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
4380	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Maithili = "C:\\Users\\Admin\\AppData\\Local\\Temp\\soothingness\\Maaneskinsarbejdets.exe"	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
600	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4380	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
600	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\multiplicere\mortify.Pun	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
File opened for modification	C:\Windows\Grecianize\turritellidae.ini	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3412	MicrosoftEdgeUpdate.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0002000000022c48-25.dat	nsis_installer_1
behavioral2/files/0x0002000000022c48-25.dat	nsis_installer_2

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4380	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
600	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 600	4380	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe	89
PID 4380 wrote to memory of 600	4380	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe	89
PID 4380 wrote to memory of 600	4380	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe	89
PID 4380 wrote to memory of 600	4380	PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe	89

C:\Users\Admin\AppData\Local\Temp\PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:600

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzhENjk4M0QtQkEyMy00QkVFLUJFRjQtMTU2QUE4RkMyOTcwfSIgdXNlcmlkPSJ7QzQ0NEE2RjEtNTUxNC00NTFCLUJBQkYtQzFENEQzMEUwODA0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTk4N0UyMzUtNDc5My00Q0M3LUEwMEUtQjBGMUEzQTYxRUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMyMzYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI1MTE0ODAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjQ5OTExODU5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
8b2ffe7249a87b1d53f4b6a03fca3851

SHA1
f16074685ca8403a7a1ca1a03ff2d071799a4a00

SHA256
449b684fd1a6f6698c7d030f1199ba40a1878feb67896ce903cb9e162d03fb54

SHA512
602247492265e6cee94d9567d342bf851181888bb0e1a271d337d52079d03161f3d7a448c3fc3e5d8bd33b15c61828d9049a3a7109d1bebfa0529242e93b8696

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswD766.tmp\System.dll

Filesize
11KB

MD5
b8992e497d57001ddf100f9c397fcef5

SHA1
e26ddf101a2ec5027975d2909306457c6f61cfbd

SHA256
98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

SHA512
8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\soothingness\Maaneskinsarbejdets.exe

Filesize
855KB

MD5
0bca5053e588b923a819758a40d15fcf

SHA1
3ced9b60e382958d810022d5aa7101b828dfd8a5

SHA256
59146210128ee1a74ca1eb304bb156d7c83b3c85f3bc95a861fdb8ad2c885b3b

SHA512
51a39f3cdfe1909979162fac0ce6051239004cae07dd229462bb65bf7fe84f579c0cddffa828a8c533ef468b3c183fc19a4dfc4781d674503be228f609f4b8cf

Download Submit
memory/600-47-0x00000000016B0000-0x0000000005767000-memory.dmp

Filesize
64.7MB

Download
memory/600-51-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-23-0x0000000077B18000-0x0000000077B19000-memory.dmp

Filesize
4KB

Download
memory/600-24-0x0000000077A91000-0x0000000077BB1000-memory.dmp

Filesize
1.1MB

Download
memory/600-21-0x00000000016B0000-0x0000000005767000-memory.dmp

Filesize
64.7MB

Download
memory/600-27-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-45-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-76-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-48-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-22-0x0000000077A91000-0x0000000077BB1000-memory.dmp

Filesize
1.1MB

Download
memory/600-55-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-73-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-58-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-61-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-64-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-67-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/600-70-0x0000000000450000-0x00000000016A4000-memory.dmp

Filesize
18.3MB

Download
memory/4380-19-0x0000000077A91000-0x0000000077BB1000-memory.dmp

Filesize
1.1MB

Download
memory/4380-20-0x0000000010004000-0x0000000010005000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads