guloader | e49ff3e9ecbbe320e8cd29470d13b72643674b66e75ab5a824dda36eef6bf05e | Triage™

Analysis

max time kernel
150s
max time network
38s
platform
windows7_x64
resource
win7-en-20210920
submitted
27/09/2021, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dokument VAT I - 85926 09 2021 MAG-8.exe
Size 88KB
Sample210927-m59d3sgfc3
SHA256 e49ff3e9ecbbe320e8cd29470d13b72643674b66e75ab5a824dda36eef6bf05e
MD5 0a2f51e6d3650f115c1b5484afbdf3a7
SHA1 6283d55e065802036f0e5da958bfd458a7999c09
SHA512 4dbbba19dd4965cff3e7c9406dc37ce105beccab3cfd466eda57a734a15d3f7786b7a651f36df41a673ec53263d540de3a5aa8065a7a3e561b2d289828cf4ce7
MD5 SHA1 SHA512

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1288	Dokument VAT I - 85926 09 2021 MAG-8.exe

C:\Users\Admin\AppData\Local\Temp\Dokument VAT I - 85926 09 2021 MAG-8.exe
"C:\Users\Admin\AppData\Local\Temp\Dokument VAT I - 85926 09 2021 MAG-8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-55-0x0000000075331000-0x0000000075333000-memory.dmp

Download

memory/1288-56-0x0000000000240000-0x0000000000251000-memory.dmp

Download