Remus infostealer via Go loader: CAPE behavioural analysis

Kill chain

Times are UTC offsets within the CAPE run (T0 = 03:36:28.714). Solid steps were observed in the trace. Dashed steps are Remus-family behaviour this run never reached.

1. 0
   Pre-execution · inferred
   Delivery
   The run starts with program.exe on the guest Desktop, with no parent chain captured. Earlier waves of this cluster used ClickFix (paste-and-run) delivery, but this run contains no evidence of how the file arrived.
2. 1
   T+0.000 → +0.078 s
   Go runtime start-up
   The image is 3.3 MB (0x350000) at base 0x00B00000. Several threads share one start routine (0x00B6F8A0), heap arenas sit at 0xC000xxxxxx, and there are repeated NtSuspendThread → NtGetContextThread → NtResumeThread cycles from Go's async preemption. All of these are Go-runtime fingerprints. Hundreds of zero-length NtWriteFile calls to a NULL handle are Go stdout writes in a GUI process with no console.
3. 2
   T+0.157 s · 03:36:28.871
   Manual map of the embedded Remus PE
   NtAllocateVirtualMemory(BaseAddress=0x140000000, RegionSize=0x3F000, PAGE_EXECUTE_READWRITE). The 0x3F000 size exactly matches the payload's SizeOfImage (.reloc ends at 0x3D000 + 0x2000), and 0x140000000 is its preferred ImageBase, so no relocation is needed. No file read precedes the allocation, which means the payload bytes come from inside the loader.
4. 3
   T+0.157 → +0.672 s
   Hand-rolled import resolution
   The loader calls LoadLibraryExW(…, LOAD_LIBRARY_SEARCH_SYSTEM32) + GetProcAddress once per import, in the payload's IAT order: KERNEL32 (ExitProcess, GetComputerName*, Global(Un)Lock, LocalFree), ole32 (Co*), USER32 (CreateDesktopW, OpenDesktopW, GetKeyboardLayout*, GetDC…), ADVAPI32 (GetUserNameA, LookupPrivilegeValueW), GDI32 (BitBlt, GetDIBits…), OLEAUT32 (Sys*/Variant*). This is the mapped PE's import table being populated, not normal loader activity.
5. 4
   T+0.672 → +0.844 s · caller 0x1400xxxx
   Execution transfers into Remus
   From here the API callers are inside the mapped image (0x14000216, 0x14000829, 0x1400082D). Remus loads winhttp.dll and calls IsDebuggerPresent (returns FALSE). It performs COM/OLE activation set-up (CoInitializeSecurity, AppID look-ups for program.exe) and checks Wow64 machine type through RtlWow64GetCurrentMachine.
6. 5
   T+0.844 → +5.078 s
   Silent window, then a timing check
   For about 4.2 s, no hooked API fires at all. The window ends with a burst of 30× NtQuerySystemTime. Remus is documented as issuing direct syscalls, which user-mode hooks do not see. The most likely reading is a syscall-level sleep followed by a time-delta check that detects sleep-skipping. The trace does not prove this.
7. 6
   T+5.078 → +7.078 s
   Host fingerprinting over WMI
   IWbemLocator::ConnectServer("ROOT\CIMV2"), which loads amsi.dll and Defender's MpOav.dll into the process (normal for WMI client start-up), then:

   • SELECT * FROM Win32_OperatingSystem → Caption Windows 10 Pro, LocalDateTime, CurrentTimeZone, InstallDate 2024-02-14
   • SELECT * FROM Win32_VideoController → Name NVIDIA GTX 1650. GPU name is a classic VM tell, since virtual adapters are obvious.
   • GetComputerNameA, GetUserNameA, GetComputerNameExW (NetBIOS, DNS, physical domain)
   • ConnectServer("ROOT\SecurityCenter2") + SELECT * FROM AntiVirusProduct → Windows Defender, productState 397568 (0x61100: enabled, signatures up to date)

   The queries are serviced by WmiPrvSE.exe -secured -Embedding (PID 5816), started by svchost -k DcomLaunch.
8. 7
   T+7.094 s · 03:36:35.808
   Silent exit
   WMI DLLs unload and NtTerminateProcess(ExitCode=0) is called from payload code (0x1400021A, i.e. the imported ExitProcess). Process teardown completes at 03:36:37.761. No child processes, files, registry writes, persistence or network activity were recorded. The pattern fits Remus's documented silent ExitProcess(0) bail-out when it decides it is being analysed. A failed C2 lookup is an alternative explanation that can't be ruled out.
9. 8
   Not reached · family behaviour
   C2 resolution (EtherHiding)
   Remus resolves its C2 with an eth_call JSON-RPC request to a hard-coded smart contract on a public RPC endpoint, then decodes the hex result into the C2 URL. The winhttp.dll load at step 4 is the groundwork for this request, which never happened in this run.
10. 9
    Not reached · family behaviour + imported capability
    Collection & exfiltration
    Browser passwords and cookies, including App-Bound-Encryption bypass (SYSTEM token impersonation first, which is why LookupPrivilegeValueW is imported, with shellcode injection as the fallback); a browser launched on a hidden random 16-character desktop (CreateDesktopW); screenshots (BitBlt/GetDIBits); clipboard capture (GlobalLock); crypto wallets, Discord/Telegram/Steam session tokens; upload to C2 as an archive.

Process tree

services.exe (660)
├─ program.exe (5808)   PPID 3616 · C:\Users\Bruno\Desktop\program.exe · Go loader + in-memory Remus
├─ svchost.exe (796)      -k DcomLaunch -p
│  └─ WmiPrvSE.exe (5816) -secured -Embedding · serves CIMV2 / SecurityCenter2 queries
└─ svchost.exe (2676)     -k netsvcs -p -s Winmgmt · WMI repository (INDEX.BTR)

The WMI service processes only do provider work for the malware's queries: cimwin32, dxgi for the GPU query, the srvsvc/wkssvc/lsarpc pipes for domain data. They are expected side effects and are not compromised.

What the malware does, and how

The loader: embed, allocate RWX, populate the IAT, jump

The loader is a reflective PE loader written in Go. It never starts a second process and never hollows another one: all execution stays inside program.exe. Because it allocates at the payload's own preferred base, it needs no relocation fixups. That explains why only a single RWX region appears and no later NtProtectVirtualMemory tightens it to RX. A memory scanner will find a private, RWX, unbacked 252 KB region holding a full PE header at 0x140000000 inside a process whose own image sits at 0x00B00000.

The payload: anti-analysis first, fingerprint second

• Debugger check: IsDebuggerPresent called directly from payload code.
• Time-based evasion (assessed): a ~4.2 s window invisible to hooks, then 30 time samples.
• Environment profiling: OS edition, install date (a recently installed OS is a sandbox signal), local time and zone, GPU model, user/computer/domain names, installed AV and its state.
• Clean exit: exit code 0 with no error dialog and no crash, which leaves nothing for a user or an EDR crash handler to notice.

Capabilities present but not exercised

The mapped image's import table shows what the payload is equipped for, even though this run stopped before using any of it: hidden-desktop creation (CreateDesktopW/OpenDesktopW), full-screen capture (GetDC → CreateCompatibleDC/Bitmap → BitBlt → GetDIBits), clipboard reads (GlobalLock), keyboard-layout lookup (GetKeyboardLayout*, commonly a CIS-locale kill switch), and privilege look-up for token work (LookupPrivilegeValueW). The table is small: only 39 imports. Remus resolves most sensitive APIs at runtime by CRC32 hash and issues direct syscalls, so the IAT understates what it can do.

MITRE ATT&CK mapping

Indicators

No network indicators: the run recovered no RPC endpoint, contract address or C2.

Detection & hunting opportunities

• Memory: a private, unbacked PAGE_EXECUTE_READWRITE region at 0x140000000 beginning with MZ, inside a process whose main image is elsewhere (Go binaries load low, e.g. 0x00B00000). Scan running processes with the CAPE Remus YARA rule.
• WMI (Sysmon / ETW Microsoft-Windows-WMI-Activity): a user-writable-path executable (Desktop, Downloads, %TEMP%) runs SELECT * FROM AntiVirusProduct in ROOT\SecurityCenter2 and SELECT * FROM Win32_VideoController within ~10 s of process start.
• Image loads (Sysmon EID 7): a non-signed, user-path process loads winhttp.dll, wbemprox.dll and fastprox.dll in its first seconds and exits with code 0 shortly after.
• Network (when it does reach C2): a non-browser process POSTing JSON-RPC eth_call to public Ethereum/BSC/Polygon RPC endpoints. This is the EtherHiding resolution step and a strong, low-noise signal on endpoints.
• Sandboxing tip: the run bailed before C2. To push it further, reuse the guest with a real (non-dummy) GPU name, an older install date, and a believable user profile (Documents and browser history populated, no honey@pot.com.pst), and patch or skip the sleep at T+0.8 s.

Caveats

References

• Gen Threat Labs — Remus: 64-bit variant of Lumma Stealer (2026-04-07)
• BleepingComputer / Flare — Inside the Remus infostealer: session theft, MaaS and rapid evolution
• CAPEv2 sandbox (Remus YARA by kevoreilly)

Companion file: SecureLeaf_Remus_GoLoader_CAPE_2026-10-11.stix.json (STIX 2.1, 57 objects, deterministic UUIDv5 IDs).