guloader | c4c6dc5465aa1676119c00c0b45c0f3be1d525e31eff1d87072952f839e5cbf9 | Triage

Analysis

max time kernel
49s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
22-04-2021 12:02

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Mal.Generic-S.24480.13627.exe
Size

153KB
MD5

fe81c0cdf996335c5d5a6f75b564da51
SHA1

389709fb8a2845f373c82ff74f9478d11b115326
SHA256

c4c6dc5465aa1676119c00c0b45c0f3be1d525e31eff1d87072952f839e5cbf9
SHA512

bca1924b48e15f11a3160727e0b4551860bc19b7f38a573a97d4ef34670d5355201b89fff365371c4cb74a4b5af2b6e8f5c06d36a7f83b05aeda9d6b5dcc7c62

Score

10^/10

guloader downloader guloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3952-116-0x00000000021F0000-0x00000000021FA000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SecuriteInfo.com.Mal.Generic-S.24480.13627.exe

pid process

3952 SecuriteInfo.com.Mal.Generic-S.24480.13627.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.Generic-S.24480.13627.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.Generic-S.24480.13627.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-116-0x00000000021F0000-0x00000000021FA000-memory.dmp

Filesize
40KB

Download