guloader | c06665899a1e0888f33d4feb16e5ddeebb333bf269c80393ff12118baa5cfa0e | Triage

Analysis

max time kernel
15s
max time network
39s
platform
windows7_x64
resource
win7v20210408
submitted
14-07-2021 16:22

Sharing

Report Analysis Logs

General

Target

3b73187bb0bb1bc3f9b112710969da4340b5791d63c6ac0d45f7c2bbf2dfd588.exe
Size

124KB
MD5

cb5dc8065dc38d47971aada093d6eea2
SHA1

b0806ab4ea8a53ab93e028a6eb9a3496c22da859
SHA256

3b73187bb0bb1bc3f9b112710969da4340b5791d63c6ac0d45f7c2bbf2dfd588
SHA512

7ff14d8a372763794c2835f17d0e2d0a8752c89853ba2e9eaeae431864b147aa7c1f914c9138c58a7fc332b1c56922e56001e7154daadb0674af093cf2e64870

Score

10^/10

guloader downloader

Malware Config

Extracted

Family

guloader

C2

https://jpfcomputings.nl/b/bitrratrw_KWQGoLaD112.bin

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3b73187bb0bb1bc3f9b112710969da4340b5791d63c6ac0d45f7c2bbf2dfd588.exe

pid process

1120 3b73187bb0bb1bc3f9b112710969da4340b5791d63c6ac0d45f7c2bbf2dfd588.exe

C:\Users\Admin\AppData\Local\Temp\3b73187bb0bb1bc3f9b112710969da4340b5791d63c6ac0d45f7c2bbf2dfd588.exe
"C:\Users\Admin\AppData\Local\Temp\3b73187bb0bb1bc3f9b112710969da4340b5791d63c6ac0d45f7c2bbf2dfd588.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1120

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-62-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download