guloader | e8647660ca71f0f83d3ae55ad5e4f141931cf2d4d8a9c527f99956cf189f0e0b

General

Target

RFQ_0325.scr
Size

724KB
MD5

a479acd2da79c2dfeabc05b5d6194fba
SHA1

18e8097c57cf691e5c2719ade7d2bca4573d9d23
SHA256

359ab600c1c1cb25744c5fd24b563ed2fbcd4918061e6409929db2c8e16a070c
SHA512

0a2d4564e0cd54394332bba59a9fbeb24afff121c420d51e5613bd3af333418ed4ef0b2b7bfcddd992857b8ec4cad773142028cbb48eaeeb8c0e433082070023
SSDEEP

12288:LR3BUI4bnFjfy75TC+WfSCgoSdYza46l0xFXc3gIwEH:V3GI4jFe7EJKT1nl0Pg73H

Score

10^/10

guloader remcos new-host collection credential_access discovery downloader rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

New-Host

C2

176.65.142.81:9090

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-C2AG7V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/2000-59-0x0000000000400000-0x000000000047D000-memory.dmp	Nirsoft
behavioral1/memory/1880-68-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1740-67-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/2000-60-0x0000000000400000-0x000000000047D000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1740-67-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/2000-59-0x0000000000400000-0x000000000047D000-memory.dmp	WebBrowserPassView
behavioral1/memory/2000-60-0x0000000000400000-0x000000000047D000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 1 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1264	Chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
2196	RFQ_0325.scr
2196	RFQ_0325.scr

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	recover.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2736	RFQ_0325.scr

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2196	RFQ_0325.scr
2736	RFQ_0325.scr

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2000	2736	RFQ_0325.scr	38
PID 2736 set thread context of 1740	2736	RFQ_0325.scr	39
PID 2736 set thread context of 1880	2736	RFQ_0325.scr	40

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\crepe\satanerne.ini	RFQ_0325.scr
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_debug.log	Chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ_0325.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ_0325.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2736	RFQ_0325.scr
2000	recover.exe
1636	Chrome.exe
1636	Chrome.exe
1636	Chrome.exe
1636	Chrome.exe
2000	recover.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2196	RFQ_0325.scr
2736	RFQ_0325.scr
2736	RFQ_0325.scr
2736	RFQ_0325.scr

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	recover.exe
Token: SeShutdownPrivilege	1636	Chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	RFQ_0325.scr

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2736	RFQ_0325.scr

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2736	2196	RFQ_0325.scr	31
PID 2196 wrote to memory of 2736	2196	RFQ_0325.scr	31
PID 2196 wrote to memory of 2736	2196	RFQ_0325.scr	31
PID 2196 wrote to memory of 2736	2196	RFQ_0325.scr	31
PID 2196 wrote to memory of 2736	2196	RFQ_0325.scr	31
PID 1264 wrote to memory of 1636	1264	Chrome.exe	36
PID 1264 wrote to memory of 1636	1264	Chrome.exe	36
PID 1264 wrote to memory of 1636	1264	Chrome.exe	36
PID 1264 wrote to memory of 2332	1264	Chrome.exe	37
PID 1264 wrote to memory of 2332	1264	Chrome.exe	37
PID 1264 wrote to memory of 2332	1264	Chrome.exe	37
PID 2736 wrote to memory of 2000	2736	RFQ_0325.scr	38
PID 2736 wrote to memory of 2000	2736	RFQ_0325.scr	38
PID 2736 wrote to memory of 2000	2736	RFQ_0325.scr	38
PID 2736 wrote to memory of 2000	2736	RFQ_0325.scr	38
PID 2736 wrote to memory of 2000	2736	RFQ_0325.scr	38
PID 2736 wrote to memory of 1740	2736	RFQ_0325.scr	39
PID 2736 wrote to memory of 1740	2736	RFQ_0325.scr	39
PID 2736 wrote to memory of 1740	2736	RFQ_0325.scr	39
PID 2736 wrote to memory of 1740	2736	RFQ_0325.scr	39
PID 2736 wrote to memory of 1740	2736	RFQ_0325.scr	39
PID 2736 wrote to memory of 1880	2736	RFQ_0325.scr	40
PID 2736 wrote to memory of 1880	2736	RFQ_0325.scr	40
PID 2736 wrote to memory of 1880	2736	RFQ_0325.scr	40
PID 2736 wrote to memory of 1880	2736	RFQ_0325.scr	40
PID 2736 wrote to memory of 1880	2736	RFQ_0325.scr	40

C:\Users\Admin\AppData\Local\Temp\RFQ_0325.scr
"C:\Users\Admin\AppData\Local\Temp\RFQ_0325.scr" /S
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\RFQ_0325.scr
  "C:\Users\Admin\AppData\Local\Temp\RFQ_0325.scr" /S
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef6639758,0x7fef6639768,0x7fef6639778
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1636
  - - C:\Program Files\Google\Chrome\Application\Chrome.exe
      "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1112 --field-trial-handle=956,i,9794571915597907321,13299133818281055030,131072 --disable-features=PaintHolding /prefetch:8
      4⤵
      PID:2332
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\ehwantkweqodg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2000
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\ojbtnmdqaygijgjm"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Windows\SysWOW64\recover.exe
    C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\ydhdoeorogyvtuyqluzy"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

1

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

1

T1556

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Modify Authentication Process

1

T1556

Steal Web Session Cookie

1

T1539

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\metadata

Filesize
114B

MD5
1c440d6e9a4e5b33572176ba40cab54d

SHA1
266df21d59598e615f981aa785b2f5a06742600c

SHA256
49b8cfd3eb24973adbf66e6aa4d9a7fde7f5f4b38d01bb24a100ad8b5d13986b

SHA512
34e8185ff469b09ab5a93335b8fba5400a97b80eb1e8e14e1ffd882b606699bd192f0b20c16c0b55a4e262e78cf505e24d8bcb960814349b6913bae4b5c3428e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\reports\8e4b7765-89f5-4737-b604-5f8449a4e611.dmp

Filesize
620KB

MD5
01992ea5587b741334ad62f69fa8e676

SHA1
76aa2664a8e34b10856805636084191ea9d1e630

SHA256
fcba8959da080694b5500ed69ef3a35b105bd46767d9dc8cda1f3f21812e6519

SHA512
d889182cd6fe7597f8ade0fef759348e7fc6178eb4768e44afab64681195f6735440eb16365e13c029b4aaf6f1941661ffaf325ebeeeb9822b9091035070e908

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad\settings.dat

Filesize
40B

MD5
bb7c4214b3754845f899486e71a7ba59

SHA1
13fd0245a56a4d1fca11d91ded4e8b48fda35d62

SHA256
3d5d5fe0e7eac4f23c758c97563d6725a3f969fe7837f1d35ec9a06daadad14e

SHA512
0c9c1c9506300c51ea952d9a5e7ff1037b89cedf792eb30c905bd67e63960e8855a028f8090ce3dec21f3ec8ea55fb46655423546848b0ea099771ab804ee766

Download Submit
C:\Users\Admin\AppData\Local\Temp\ehwantkweqodg

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\nsyCABF.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
memory/1740-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1740-62-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1740-63-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1740-67-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1880-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1880-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1880-66-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2000-60-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2000-59-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2000-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2196-18-0x0000000003BE0000-0x0000000006D61000-memory.dmp

Filesize
49.5MB

Download
memory/2196-19-0x00000000775E1000-0x00000000776E2000-memory.dmp

Filesize
1.0MB

Download
memory/2196-20-0x00000000775E0000-0x0000000077789000-memory.dmp

Filesize
1.7MB

Download
memory/2736-48-0x00000000359E0000-0x0000000035A14000-memory.dmp

Filesize
208KB

Download
memory/2736-98-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-52-0x00000000359E0000-0x0000000035A14000-memory.dmp

Filesize
208KB

Download
memory/2736-46-0x00000000014F0000-0x0000000004671000-memory.dmp

Filesize
49.5MB

Download
memory/2736-45-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-41-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-21-0x00000000014F0000-0x0000000004671000-memory.dmp

Filesize
49.5MB

Download
memory/2736-96-0x00000000343A0000-0x00000000343B9000-memory.dmp

Filesize
100KB

Download
memory/2736-95-0x00000000343A0000-0x00000000343B9000-memory.dmp

Filesize
100KB

Download
memory/2736-92-0x00000000343A0000-0x00000000343B9000-memory.dmp

Filesize
100KB

Download
memory/2736-97-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-51-0x00000000359E0000-0x0000000035A14000-memory.dmp

Filesize
208KB

Download
memory/2736-99-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-100-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-101-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-102-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-103-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-104-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-105-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-108-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/2736-109-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads