guloader | e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6

General

Target

e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe
Size

930KB
MD5

c730d2226304c997f5cc1124a9cfe6fc
SHA1

79e71e9efb193582619f93287202404d73348088
SHA256

e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6
SHA512

b19281c8bbe04847bd4000da0569f9c9aa05be60e8b29c12ab116f8fa352d120675db8c165b00315366e13e6a0b5d055c36620f2f51eea300dac80deadd71e68
SSDEEP

24576:FerYnK4TwIld1V20+FDbzUMX5gBb4J4MOqsk3UiFZ:FerYnKRIlHV20+FDbzhX5gOJ8TJiz

Score

10^/10

guloader remcos odg-remotehost discovery downloader persistence rat

Malware Config

Extracted

Family

remcos

Botnet

odg-RemoteHost

C2

odg01.is-a-landscaper.com:49950

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GN5MV3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Loads dropped DLL 1 IoCs

pid	Process
4884	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Navngiven187 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Unweaned236\\Treehair.exe"	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1456	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4884	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe
1456	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000023c2c-21.dat	nsis_installer_1
behavioral2/files/0x0008000000023c2c-21.dat	nsis_installer_2

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4884	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1456	4884	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe	82
PID 4884 wrote to memory of 1456	4884	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe	82
PID 4884 wrote to memory of 1456	4884	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe	82
PID 4884 wrote to memory of 1456	4884	e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe	82

C:\Users\Admin\AppData\Local\Temp\e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe
"C:\Users\Admin\AppData\Local\Temp\e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe
  "C:\Users\Admin\AppData\Local\Temp\e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
95021467eb7c8dbe8f776cf97b05d703

SHA1
93c11b30cc62b3a6aebb127824b968aa22dcca21

SHA256
ba97f966488e27b7b389e93868119c81cafb6fc8ff539aeb62ec735856353a33

SHA512
2614cdc66ecf2c745d8b46c42e0f6b4a4a65fd8a952d6e175349e56c8add5f8d89eca9123037239d2f9729d85a3b41e04c82e98c5db669d7508ae384aa12a6ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unweaned236\Treehair.exe

Filesize
930KB

MD5
c730d2226304c997f5cc1124a9cfe6fc

SHA1
79e71e9efb193582619f93287202404d73348088

SHA256
e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6

SHA512
b19281c8bbe04847bd4000da0569f9c9aa05be60e8b29c12ab116f8fa352d120675db8c165b00315366e13e6a0b5d055c36620f2f51eea300dac80deadd71e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl14CD.tmp\System.dll

Filesize
12KB

MD5
dd87a973e01c5d9f8e0fcc81a0af7c7a

SHA1
c9206ced48d1e5bc648b1d0f54cccc18bf643a14

SHA256
7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1

SHA512
4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f

Download Submit
memory/1456-19-0x0000000077788000-0x0000000077789000-memory.dmp

Filesize
4KB

Download
memory/1456-42-0x0000000077701000-0x0000000077821000-memory.dmp

Filesize
1.1MB

Download
memory/1456-17-0x0000000001710000-0x0000000005F2F000-memory.dmp

Filesize
72.1MB

Download
memory/1456-20-0x0000000077701000-0x0000000077821000-memory.dmp

Filesize
1.1MB

Download
memory/1456-76-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/1456-35-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/1456-37-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/1456-40-0x0000000077701000-0x0000000077821000-memory.dmp

Filesize
1.1MB

Download
memory/1456-41-0x0000000001710000-0x0000000005F2F000-memory.dmp

Filesize
72.1MB

Download
memory/1456-18-0x0000000077701000-0x0000000077821000-memory.dmp

Filesize
1.1MB

Download
memory/1456-44-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/1456-47-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/1456-71-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/1456-53-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/1456-59-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/1456-62-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/4884-15-0x0000000077701000-0x0000000077821000-memory.dmp

Filesize
1.1MB

Download
memory/4884-16-0x0000000074565000-0x0000000074566000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads