guloader | bffbffc2b1be154742fb81ecea14cb779b8fd81581ffce2855cf588f21a8020f | Triage

Analysis

max time kernel
146s
max time network
130s
platform
windows7_x64
resource
win7-en-20210920
submitted
28-09-2021 05:55

Sharing

Report Analysis Logs

General

Target

Hesap Hareketleri 28-09-2021.exe
Size

88KB
MD5

2fca7a3e51417ee2e8aefafede0847d9
SHA1

931518250bed6cd21b6cab529ed3ad9ead83cdcf
SHA256

bffbffc2b1be154742fb81ecea14cb779b8fd81581ffce2855cf588f21a8020f
SHA512

4d56a20cc61aa096fbd1e181ce72a79d237d90b7e20078fed0e3c767dfead51a5b1d150307ca911fbaffac206ef3679c99e9dc93dd37b3f5f419a55bb683220a

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Hesap Hareketleri 28-09-2021.exe

pid process

2004 Hesap Hareketleri 28-09-2021.exe

C:\Users\Admin\AppData\Local\Temp\Hesap Hareketleri 28-09-2021.exe
"C:\Users\Admin\AppData\Local\Temp\Hesap Hareketleri 28-09-2021.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x0000000000280000-0x0000000000291000-memory.dmp

Filesize
68KB

Download