guloader | b5d510179ab07f09c10cfa2ea9d95346fb696afd3f642af2882b3f4cd16d3ff5 | Triage

Analysis

max time kernel
96s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
24-02-2021 07:30

Sharing

Report Analysis Logs

General

Target

e18dbe57194dd717d54a907ba8e6d3e1.exe
Size

128KB
MD5

e18dbe57194dd717d54a907ba8e6d3e1
SHA1

76bacc8c5fbbf675399c39c42565dfc3d77be98b
SHA256

b5d510179ab07f09c10cfa2ea9d95346fb696afd3f642af2882b3f4cd16d3ff5
SHA512

b5b4064fb475590e7ebfa51857117e5c8dac0c98402809856cd17cf40edbf455a28ecab9bd4b431997c50ac1767ab7724f79ed356c33690aa9cb2dcdf38f7968

Score

10^/10

guloader downloader guloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1032-4-0x00000000001C0000-0x00000000001CC000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e18dbe57194dd717d54a907ba8e6d3e1.exe

pid process

1032 e18dbe57194dd717d54a907ba8e6d3e1.exe

C:\Users\Admin\AppData\Local\Temp\e18dbe57194dd717d54a907ba8e6d3e1.exe
"C:\Users\Admin\AppData\Local\Temp\e18dbe57194dd717d54a907ba8e6d3e1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1032

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-4-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download