guloader | f6481e8a971424320afe55cb934e03e312a64e9a9832123db18bcc293b04c861 | Triage

Analysis

max time kernel
29s
max time network
46s
platform
windows7_x64
resource
win7v20210408
submitted
27-07-2021 07:24

Sharing

Report Analysis Logs

General

Target

b71e99f16b0c55a697bba6f37a61e6f8c5c4cf47d3687abdf5d4e4c3d0281b84.exe
Size

108KB
MD5

14dfffbcec6e3967787a556ab0616746
SHA1

983023f69d647628fa9949a07a5ad2a475f8df45
SHA256

b71e99f16b0c55a697bba6f37a61e6f8c5c4cf47d3687abdf5d4e4c3d0281b84
SHA512

9d2cf8cc3efb3d9221b05133e4e4d7bf8cdb93c99879b15a215f555553dbc0db932ab9119af0d3fd245dd7619826dfb51ce91ea4fb37a0bbe7dbd7a7aef73e58

Score

10^/10

guloader downloader

Malware Config

Extracted

Family

guloader

C2

https://onedrive.live.com/download?cid=5A3ABE07CAFFD4AC&resid=5A3ABE07CAFFD4AC%21114&authkey=ACQJWu1mCGGeplA

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b71e99f16b0c55a697bba6f37a61e6f8c5c4cf47d3687abdf5d4e4c3d0281b84.exe

pid process

2016 b71e99f16b0c55a697bba6f37a61e6f8c5c4cf47d3687abdf5d4e4c3d0281b84.exe

C:\Users\Admin\AppData\Local\Temp\b71e99f16b0c55a697bba6f37a61e6f8c5c4cf47d3687abdf5d4e4c3d0281b84.exe
"C:\Users\Admin\AppData\Local\Temp\b71e99f16b0c55a697bba6f37a61e6f8c5c4cf47d3687abdf5d4e4c3d0281b84.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-62-0x0000000000270000-0x000000000027B000-memory.dmp

Filesize
44KB

Download
memory/2016-63-0x0000000076E50000-0x0000000076FF9000-memory.dmp

Filesize
1.7MB

Download