guloader | 4e5889e355cf6236c1b37e71aa84142037cb4a9cbc16d67ecf24d3ba0dd4d823 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows10_x64
resource
win10v20210410
submitted
21-04-2021 13:20

Sharing

Report Analysis Logs

General

Target

11.exe
Size

84KB
MD5

8ac9647955e7cd9a48cc6a4da0643035
SHA1

c65b88131b11402dff82e5ed45b319e34ea8cef0
SHA256

4e5889e355cf6236c1b37e71aa84142037cb4a9cbc16d67ecf24d3ba0dd4d823
SHA512

de490b82d6e157d320febe34f01654ceeb27a62c77085e307f8599f38e93ab41646fefce48869f52a61f2b934f6b1162c55d814a39d335926fd093a0660d0c3a

Score

10^/10

guloader downloader guloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3560-116-0x0000000002120000-0x000000000212A000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

11.exe

pid process

3560 11.exe

C:\Users\Admin\AppData\Local\Temp\11.exe
"C:\Users\Admin\AppData\Local\Temp\11.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3560

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3560-116-0x0000000002120000-0x000000000212A000-memory.dmp

Filesize
40KB

Download