guloader | 6ac0d9d340a97a331139797d4b78d39d26e75f9712dcf05288e64d5b06e47f3f | Triage

Analysis

max time kernel
40s
max time network
119s
platform
windows10_x64
resource
win10v20210408
submitted
26-07-2021 11:53

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.__vbaHresultCheckObj.10933.22333.exe
Size

220KB
MD5

b7cca234c8a88db68c353d9d5310e27a
SHA1

ee1ab7e21ba4a3e602045fbb41709c3ce2bb02af
SHA256

6ac0d9d340a97a331139797d4b78d39d26e75f9712dcf05288e64d5b06e47f3f
SHA512

3c30fa29f089f4b9f4b438d7b5632727d35998ba966f3f3619bc2731b285263a803e63005dec33737c109883c945794efe66578e67e58e888565c583bf4011cb

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SecuriteInfo.com.__vbaHresultCheckObj.10933.22333.exe

pid process

3008 SecuriteInfo.com.__vbaHresultCheckObj.10933.22333.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.__vbaHresultCheckObj.10933.22333.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.__vbaHresultCheckObj.10933.22333.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3008

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-116-0x0000000002260000-0x0000000002273000-memory.dmp

Filesize
76KB

Download