guloader | 7201e7b9524c4f8a9618c3688d195c05f28221be67f8e1a51816f0972b6e8762

General

Target

HOLIDAY ADVISORY_pdf.exe
Size

831KB
MD5

a262509d9e7799ba517432a2468b826e
SHA1

d72c16f19686bf9afbb89347632eda3703396e90
SHA256

f229c284ec539c5ee4feaea921a24a06c900079b4e8cb4b0965bdbb9f2fcef18
SHA512

81fd20cad8f4a3ae4e4f3638b5242061968535d22032e7003288e59bbd7b0aebd719e39731345b2efbf2f2e66950735b05ae124b44d93a08660f6d0df6459c1a
SSDEEP

24576:JUjfV4MC3d0qTpv6IPX9ky5awvY/X6eR8Mw2:kWt3djZ6IPDRqBXn

Score

10^/10

guloader remcos remotehost discovery downloader rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:2404

196.251.93.4:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LQXWP4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Loads dropped DLL 2 IoCs

pid	Process
1916	HOLIDAY ADVISORY_pdf.exe
1916	HOLIDAY ADVISORY_pdf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\suppressionens.bin	HOLIDAY ADVISORY_pdf.exe
File opened for modification	C:\Windows\SysWOW64\quadrigae.jpg	HOLIDAY ADVISORY_pdf.exe
File opened for modification	C:\Windows\SysWOW64\Disarticulating.ini	HOLIDAY ADVISORY_pdf.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1540	HOLIDAY ADVISORY_pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1916	HOLIDAY ADVISORY_pdf.exe
1540	HOLIDAY ADVISORY_pdf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\dyppekogerens.ini	HOLIDAY ADVISORY_pdf.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\mechanicochemical.jpg	HOLIDAY ADVISORY_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOLIDAY ADVISORY_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOLIDAY ADVISORY_pdf.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1916	HOLIDAY ADVISORY_pdf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1540	1916	HOLIDAY ADVISORY_pdf.exe	31
PID 1916 wrote to memory of 1540	1916	HOLIDAY ADVISORY_pdf.exe	31
PID 1916 wrote to memory of 1540	1916	HOLIDAY ADVISORY_pdf.exe	31
PID 1916 wrote to memory of 1540	1916	HOLIDAY ADVISORY_pdf.exe	31
PID 1916 wrote to memory of 1540	1916	HOLIDAY ADVISORY_pdf.exe	31

C:\Users\Admin\AppData\Local\Temp\HOLIDAY ADVISORY_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\HOLIDAY ADVISORY_pdf.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\HOLIDAY ADVISORY_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\HOLIDAY ADVISORY_pdf.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\dyppekogerens.ini

Filesize
44B

MD5
6644a29c4fcb5c51650383ac2625163a

SHA1
75de5a6b73cd9bc47af952ad60679535cf768b27

SHA256
0d9e8205fb30192bec64aa7c4d7a0c9d98e469f6739aa321d3b85da16caa8abc

SHA512
2e6a476b3045a543a322332b2eb9d261002c3a278dc408b9eb5af3e4b136fe1b783c3091ce5edaaa7f3c8d2bffab714408bb23ae2e135cd034e1ff02ef36302a

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE468.tmp\System.dll

Filesize
11KB

MD5
8b3830b9dbf87f84ddd3b26645fed3a0

SHA1
223bef1f19e644a610a0877d01eadc9e28299509

SHA256
f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37

SHA512
d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03

Download Submit
memory/1540-296-0x0000000001510000-0x000000000537B000-memory.dmp

Filesize
62.4MB

Download
memory/1540-297-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/1540-317-0x00000000004A0000-0x0000000001502000-memory.dmp

Filesize
16.4MB

Download
memory/1540-319-0x00000000004A0000-0x0000000001502000-memory.dmp

Filesize
16.4MB

Download
memory/1916-295-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/1916-294-0x0000000077491000-0x0000000077592000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing