guloader | 286ae740278234a35e85eb0c2931824f4df807b0840de2675c66e3ca2d892a17

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GRAADS.A. eINFO3634763575473644652467735.cmd
Size 6KB
Sample261026-vd25paxyhz
SHA256 286ae740278234a35e85eb0c2931824f4df807b0840de2675c66e3ca2d892a17
MD5 0950bdf90e621959b5550f3fe45a9c66
SHA1 6ed07c52478f00e170a16de91326945c3f2acf11
SHA512 dfb7fd34423c3af848f855a6d927ccf57b8affe970ee692287b51b7001aa5ad30d213b031efb525df3117099b0e12526ff032bdf6e07f9cf79a37dd0748cc6e4
SSDEEP 192:/bFmaJwxkpvGZQQWJeFF9fkmsORi6vEJc/gnPvTCBHVWPE:jFm1aGYmnf5O6v5/gnnTC3N
TLSH
T1B6D1D6101748634AE14B2FF2C4DFC687E6BD026CC5086840E2BACA49BD72D5C5BB89CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

buxtonfina collection defense_evasion discovery downloader execution guloader remcos persistence privilege_escalation rat suricata

Malware Config

Extracted

Family

remcos

Botnet

BuxtonFina

gumduck.duckdns.org:36511
gumduck1.duckdns.org:36511
gumduck2.duckdns.org:36511
rawegg123.duckdns.org:36511

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-16SUXA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication 8 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe

Suricata alert: REMCOS RAT Malware Outbound C2 Communication 11 IoCs

Network activity triggered a Suricata alert

suricata remcos

flow	pid	Process
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
43	2188	backgroundtaskhost.exe
44	2188	backgroundtaskhost.exe
44	2188	backgroundtaskhost.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/5084-68-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	4604	powershell.exe
12	4604	powershell.exe
17	4604	powershell.exe
18	4604	powershell.exe
19	4604	powershell.exe
20	4604	powershell.exe
22	4604	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4604	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	userinit.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe
Key queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lythrum = "%Uforskammetheder% -windowstyle 2 $Nontentative='HKCU:\\Software\\Bigotteriets\\';(.'gp' $Nontentative).'Smalsavens' \| %Uforskammetheder% -"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2188	backgroundtaskhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4604	powershell.exe
2188	backgroundtaskhost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 1356	2188	backgroundtaskhost.exe	112
PID 2188 set thread context of 456	2188	backgroundtaskhost.exe	114
PID 2188 set thread context of 5084	2188	backgroundtaskhost.exe	115

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1356	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4236	cmd.exe
3160	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundtaskhost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe
1356	sc.exe
1356	sc.exe
5084	userinit.exe
5084	userinit.exe
1356	sc.exe
1356	sc.exe
1356	sc.exe
1356	sc.exe
1356	sc.exe
1356	sc.exe
1356	sc.exe
1356	sc.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4604	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	5084	userinit.exe
Token: SeImpersonatePrivilege	1356	sc.exe
Token: SeImpersonatePrivilege	1356	sc.exe
Token: SeImpersonatePrivilege	1356	sc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2188	backgroundtaskhost.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 900	4236	cmd.exe	85
PID 4236 wrote to memory of 4604	4236	cmd.exe	86
PID 4604 wrote to memory of 5072	4604	powershell.exe	96
PID 4604 wrote to memory of 2188	4604	powershell.exe	97
PID 4604 wrote to memory of 2188	4604	powershell.exe	97
PID 2188 wrote to memory of 3944	2188	backgroundtaskhost.exe	98
PID 2188 wrote to memory of 3160	2188	backgroundtaskhost.exe	99
PID 3160 wrote to memory of 1760	3160	cmd.exe	101
PID 2188 wrote to memory of 688	2188	backgroundtaskhost.exe	102
PID 2188 wrote to memory of 4664	2188	backgroundtaskhost.exe	103
PID 2188 wrote to memory of 1940	2188	backgroundtaskhost.exe	104
PID 2188 wrote to memory of 2748	2188	backgroundtaskhost.exe	105
PID 2188 wrote to memory of 936	2188	backgroundtaskhost.exe	106
PID 2188 wrote to memory of 2688	2188	backgroundtaskhost.exe	107
PID 2188 wrote to memory of 364	2188	backgroundtaskhost.exe	108
PID 2188 wrote to memory of 3188	2188	backgroundtaskhost.exe	109
PID 2188 wrote to memory of 3752	2188	backgroundtaskhost.exe	110
PID 2188 wrote to memory of 1264	2188	backgroundtaskhost.exe	111
PID 2188 wrote to memory of 1356	2188	backgroundtaskhost.exe	112
PID 2188 wrote to memory of 3216	2188	backgroundtaskhost.exe	113
PID 2188 wrote to memory of 456	2188	backgroundtaskhost.exe	114
PID 2188 wrote to memory of 5084	2188	backgroundtaskhost.exe	115

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	userinit.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GRAADS.A. eINFO3634763575473644652467735.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo %mtrik% "
  2⤵
  PID:900
- C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\backgroundtaskhost.exe
    "C:\Windows\SysWOW64\backgroundtaskhost.exe"
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\backgroundtaskhost.exe
    "C:\Windows\SysWOW64\backgroundtaskhost.exe"
    3⤵
    - Suricata alert: REMCOS RAT Malware Inbound C2 Communication
    - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\SysWOW64\backgroundtaskhost.exe
      "C:\Windows\SysWOW64\backgroundtaskhost.exe"
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Lythrum" /t REG_EXPAND_SZ /d "%Uforskammetheder% -windowstyle 2 $Nontentative='HKCU:\Software\Bigotteriets\';(.'gp' $Nontentative).'Smalsavens' | %Uforskammetheder% -"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Lythrum" /t REG_EXPAND_SZ /d "%Uforskammetheder% -windowstyle 2 $Nontentative='HKCU:\Software\Bigotteriets\';(.'gp' $Nontentative).'Smalsavens' | %Uforskammetheder% -"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1760
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:688
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:4664
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:2748
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:936
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:3188
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:3752
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      PID:1264
  - - C:\Windows\SysWOW64\sc.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\jxricvv"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1356
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\tzxtcoffjg"
      4⤵
      PID:3216
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\tzxtcoffjg"
      4⤵
      Accesses Microsoft Outlook accounts
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      outlook_office_path
      PID:456
  - - C:\Windows\SysWOW64\userinit.exe
      /stext "C:\Users\Admin\AppData\Local\Temp\wtcldgqyxoctn"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 afd67e17dd16a32469a3669c39bb3a7676aad0f494b04c3731de44a41c143bc5
MD5 c55fc8f48e491245bf8dd6fa9b75bd58
SHA1 7909fc40baa9bfa6190a1db20348c143163b3cc5
SHA512 ba9677c18d72b68f7f29f150bff95fd8fcb2d02df3c3ab6e8f4cdbc21ed31706add989d8519badc78397f21511b09bc0b1f718dcf44444159f8eb06214200781
TLSH
T181C02B8933E000093C32B29784F700323A71FD00103CC40C21C1034C15F090020483D7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jsk4wsvj.0ey.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsk4wsvj.0ey.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jxricvv

Path C:\Users\Admin\AppData\Local\Temp\jxricvv
Size 4KB
SHA256 abfb0537f2f92a5cf805ed89e1b2bb75f9ae0faa3b84b7682e7f05fac67ab705
MD5 130a2e87e76dcbe7c93694fdd8acc6fc
SHA1 7adb7c186e171b3ea36a643b03727156f3a5999a
SHA512 7d4a649771cde0306563ae6b5716d1fd8deb899b12d81dee133c83cb58f1f12996917b499c1f64366f3308f671d0dbdf12a3ce41d10599dade024e22570da9d0
SSDEEP 48:wvvv02xfvvc2xfdvv02xBvv02xakvv027:mvzxvbp1vzPvzbvz7
TLSH
T16A916A0712F90408F0B2BA46D97711B64B7338599DBC815C61ECA3D90BE3910DAE37D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-70-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/688-51-0x0000000001290000-0x000000000130E000-memory.dmp

Download

memory/1356-72-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2188-78-0x000000001DDC0000-0x000000001DDD9000-memory.dmp

Download

memory/2188-74-0x000000001DDC0000-0x000000001DDD9000-memory.dmp

Download

memory/2188-33-0x0000000000B80000-0x0000000000BF5000-memory.dmp

Download

memory/2188-61-0x0000000000B80000-0x0000000000BF5000-memory.dmp

Download

memory/2188-77-0x000000001DDC0000-0x000000001DDD9000-memory.dmp

Download

memory/2188-45-0x0000000001000000-0x0000000002254000-memory.dmp

Download

memory/3216-62-0x0000000000480000-0x00000000004DE000-memory.dmp

Download

memory/4604-15-0x0000000005E30000-0x0000000005E4E000-memory.dmp

Download

memory/4604-35-0x0000000008A00000-0x000000000A3E6000-memory.dmp

Download

memory/4604-21-0x0000000007470000-0x0000000007506000-memory.dmp

Download

memory/4604-22-0x0000000007390000-0x00000000073B2000-memory.dmp

Download

memory/4604-23-0x0000000008450000-0x00000000089F4000-memory.dmp

Download

memory/4604-24-0x0000000004A30000-0x0000000004A40000-memory.dmp

Download

memory/4604-25-0x0000000004A30000-0x0000000004A40000-memory.dmp

Download

memory/4604-26-0x0000000004A30000-0x0000000004A40000-memory.dmp

Download

memory/4604-27-0x0000000004A30000-0x0000000004A40000-memory.dmp

Download

memory/4604-29-0x0000000004A30000-0x0000000004A40000-memory.dmp

Download

memory/4604-30-0x0000000004ED0000-0x0000000004ED4000-memory.dmp

Download

memory/4604-31-0x0000000008A00000-0x000000000A3E6000-memory.dmp

Download

memory/4604-32-0x0000000008A00000-0x000000000A3E6000-memory.dmp

Download

memory/4604-19-0x0000000007820000-0x0000000007E9A000-memory.dmp

Download

memory/4604-34-0x0000000004ED0000-0x0000000004ED4000-memory.dmp

Download

memory/4604-20-0x00000000071C0000-0x00000000071DA000-memory.dmp

Download

memory/4604-18-0x0000000007120000-0x0000000007196000-memory.dmp

Download

memory/4604-17-0x0000000006390000-0x00000000063D4000-memory.dmp

Download

memory/4604-0-0x0000000004A30000-0x0000000004A40000-memory.dmp

Download

memory/4604-16-0x0000000005E70000-0x0000000005EBC000-memory.dmp

Download

memory/4604-1-0x00000000048C0000-0x00000000048F6000-memory.dmp

Download

memory/4604-2-0x0000000004A30000-0x0000000004A40000-memory.dmp

Download

memory/4604-14-0x00000000057E0000-0x0000000005B34000-memory.dmp

Download

memory/4604-6-0x0000000004F80000-0x0000000004FE6000-memory.dmp

Download

memory/4604-5-0x0000000004F10000-0x0000000004F76000-memory.dmp

Download

memory/4604-4-0x0000000004E70000-0x0000000004E92000-memory.dmp

Download

memory/4604-3-0x0000000005070000-0x0000000005698000-memory.dmp

Download

memory/5084-68-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5084-64-0x0000000000400000-0x0000000000424000-memory.dmp

Download