guloader | 8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows10_x64
resource
win10-en-20210920
submitted
14-10-2021 06:11

Sharing

Report Analysis Logs

General

Target

8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90.exe
Size

204KB
MD5

8777020a37b6797241a489a707b9784b
SHA1

a1ed1029b967295f9ce5e9d219f41dc6c7fc4d1a
SHA256

8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90
SHA512

0a9d13ca582dd72b4cdce8c91a5226aeb8c70ac7a73fa5f9775c6d03753bf7ec856371f55bf5f5e38f0a1d84e375c80916e5508f89d91e7100a82c4e544174d8

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90.exe

pid process

2072 8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90.exe

C:\Users\Admin\AppData\Local\Temp\8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90.exe
"C:\Users\Admin\AppData\Local\Temp\8a45d901cab57a1b65c32aea2452f56436dcf01c37bdf7875838e6054f395d90.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-115-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2072-116-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2072-117-0x00000000021E0000-0x000000000220C000-memory.dmp

Filesize
176KB

Download