guloader | 98bbdc74c1ff5407450d9019407d2012a08075269228497f10b9bf6e6471de42 | Triage™

Analysis

max time kernel
109s
max time network
116s
platform
windows10_x64
resource
win10v20201028
submitted
24/02/2021, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
caraganas.exe
Size 72KB
Sample210224-c54m5adla2
SHA256 98bbdc74c1ff5407450d9019407d2012a08075269228497f10b9bf6e6471de42
MD5 99d875ac3341453383c9105669e14538
SHA1 c459b8df634dc70ea2537d9588eeeb3d2b644d94
SHA512 d31f378dfc326ce5b84a73e7831d465860a20bd1ea2c61df1276821ac28275ca66b604e75a1e0634aaee52e652ee9e0a514175109fe91721a0e33ea4f8176b69
MD5 SHA1 SHA512

Score

10^/10

guloader downloader guloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3992-4-0x00000000021A0000-0x00000000021AB000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3992	caraganas.exe

C:\Users\Admin\AppData\Local\Temp\caraganas.exe
"C:\Users\Admin\AppData\Local\Temp\caraganas.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3992-4-0x00000000021A0000-0x00000000021AB000-memory.dmp

Download