guloader | 14ebb260ea6108908a82c04bf28b549b8b1e897baea185b62b994ceb00f16620

Analysis

max time kernel
298s
max time network
284s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/03/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
My Trip 2026.exe
Size 960KB
Sample260301-ryw8dsd18e
SHA256 14ebb260ea6108908a82c04bf28b549b8b1e897baea185b62b994ceb00f16620
MD5 bded28d3140b0fd54130c457b29a2d92
SHA1 e4aa05efb1200a0da89483a1f3377f2458c229cd
SHA512 20ed50cc6309a98f2c6e8a5d4831f9cc607505b1fcdd867e25beeae5912ac0dfab7246068b4559c4e3f3287ced6ea1d243d1e86542d100ed102e906dc536dd58
SSDEEP 24576:eDVpb69XPb/TgNrVgH1TCJsPufA2imDOWzNphmR5gw:eDVpbYjLgxVgHpbI3imDOkNphg
TLSH
T153252211B3419E27D9698BF34B66E3A42739EC141A122F0B77107B4D3FB03E48A3B691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

senders discovery downloader guloader remcos persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Senders

brajasas35safael1.duckdns.org:1771
brajasas35safael2.duckdns.org:1772
brajasas35safael3.duckdns.org:1771
brajasas35safael4.duckdns.org:1771
brajasas35safael5.duckdns.org:1771
brajasas35safael6.duckdns.org:1771

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
huopes.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
hjmiuowql-5541S0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Loads dropped DLL 1 IoCs

pid	Process
1164	My Trip 2026.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Supertankerne = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Preelect\\Condensedly.exe"	My Trip 2026.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	drive.google.com
1	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1164	My Trip 2026.exe
5012	My Trip 2026.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\diagnostikers\alliker.exe	My Trip 2026.exe
File opened for modification	C:\Program Files (x86)\Common Files\Skrteregimentets\affaldsproducents.ini	My Trip 2026.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\fredningsnvnenes\bedrugged.bin	My Trip 2026.exe
File opened for modification	C:\Windows\resources\fejlskud\Dyotheletism.txt	My Trip 2026.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3292	5012	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	My Trip 2026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	My Trip 2026.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1164	My Trip 2026.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3172	1164	My Trip 2026.exe	80
PID 1164 wrote to memory of 5012	1164	My Trip 2026.exe	81
PID 1164 wrote to memory of 5012	1164	My Trip 2026.exe	81
PID 5012 wrote to memory of 1224	5012	My Trip 2026.exe	84

C:\Users\Admin\AppData\Local\Temp\My Trip 2026.exe
"C:\Users\Admin\AppData\Local\Temp\My Trip 2026.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\My Trip 2026.exe
  "C:\Users\Admin\AppData\Local\Temp\My Trip 2026.exe"
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\My Trip 2026.exe
  "C:\Users\Admin\AppData\Local\Temp\My Trip 2026.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Users\Admin\AppData\Local\Temp\My Trip 2026.exe
    "C:\Users\Admin\AppData\Local\Temp\My Trip 2026.exe"
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 1600
    3⤵
    - Program crash
    PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5012 -ip 5012
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq2065.tmp\System.dll
Size 11KB
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
TLSH
T10D325D06235081F3E1914138846B3E175B7A15069BF58E97DFD38646BE30BE7BD79503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diskede.lnk

Path C:\Users\Admin\Desktop\diskede.lnk
Size 1KB
SHA256 e2a890d07e50b4f5409ba8944e430195f792f007503baae2b5f7ec1df94afcc8
MD5 6f9cfd5af1b2594cad352f70d56ededc
SHA1 c9b62ac4797a8951b120e4a758b1fda4396e61cf
SHA512 f49c2fd011c1e5bb7cfb9ad4dc6f8a006a5cb30ed68bee46a67f01f3db6bdf0cc8794a425315494d0ef27da4450e855d8bec4880667607926b7e198ff12747a5
TLSH
T17711F7219ED92320E6FB8E7495F67216C6A478A6DF481E0C0080C0042875764EAB5F1B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1164-255-0x00000000047D0000-0x000000000540B000-memory.dmp

Download

memory/1164-249-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/1164-250-0x0000000002970000-0x0000000002A4A000-memory.dmp

Download

memory/1164-248-0x00000000047D0000-0x000000000540B000-memory.dmp

Download

memory/5012-251-0x00000000017C0000-0x00000000023FB000-memory.dmp

Download

memory/5012-252-0x0000000076FB8000-0x0000000076FB9000-memory.dmp

Download

memory/5012-254-0x0000000076FCB000-0x0000000076FCC000-memory.dmp

Download

memory/5012-253-0x000000007704B000-0x000000007704C000-memory.dmp

Download

memory/5012-270-0x00000000017C0000-0x00000000023FB000-memory.dmp

Download

memory/5012-272-0x00000000017C0000-0x00000000023FB000-memory.dmp

Download

memory/5012-271-0x00000000004A0000-0x00000000017B7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads