guloader | 09d8369604efe745036cd28a1423a7e1b05da2f9a253568dfb40f2ed1db4a2b1 | Triage

Analysis

max time kernel
61s
max time network
111s
platform
windows10_x64
resource
win10v20210410
submitted
20-04-2021 12:17

Sharing

Report Analysis Logs

General

Target

10.exe
Size

184KB
MD5

500d92d279b3f6f4babd9496f99eebd8
SHA1

68992d5074f6678ce33cee30f9d5268cecf7ac6c
SHA256

09d8369604efe745036cd28a1423a7e1b05da2f9a253568dfb40f2ed1db4a2b1
SHA512

cf6a7fae3dea7a83d4fb69e66f7d1474c4b2448b77a8e285ae9a60c48c0c4b8326be416ee0a8bd496425727c3eb03230a18f6612ec774c8f7e261e90f8ba14ca

Score

10^/10

guloader downloader guloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3992-116-0x00000000001C0000-0x00000000001CC000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

10.exe

pid process

3992 10.exe

C:\Users\Admin\AppData\Local\Temp\10.exe
"C:\Users\Admin\AppData\Local\Temp\10.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3992

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3992-116-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download