guloader | db9ba4ed720606aa9b538172c70b30ec75f6a11ffa869bfa5d90505c11fb272d

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 16:36

Target

db9ba4ed720606aa9b538172c70b30ec75f6a11ffa869bfa5d90505c11fb272d.exe
Size

172KB
MD5

44faa7312e7be4783d9bde23dd564c67
SHA1

30b3aafcc5bef855ff06b9fbda069d198c4d2b96
SHA256

db9ba4ed720606aa9b538172c70b30ec75f6a11ffa869bfa5d90505c11fb272d
SHA512

b5ee3ad95c2dcdfbc74618a3b14e1eb51c5d9737a394c3e580f519262a78d4a39f386102867df5b6c86f085b5ff2b64a3a2013607705d3b26167eb0bed19815c
SSDEEP

3072:0KVO27wv+MhKNGNykPQea/nJ181UMthWJtUeqdOkAJNe4:9I27+hKNGNykPQea/nJ181UMthUUeqd9

Score

10^/10

Family

guloader

https://onedrive.live.com/download?cid=26BBD7D5AD88DD29&resid=26BBD7D5AD88DD29%21112&authkey=AP5Ew4-I3UywOQI

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/540-134-0x00000000021A0000-0x00000000021AB000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

db9ba4ed720606aa9b538172c70b30ec75f6a11ffa869bfa5d90505c11fb272d.exe

pid process

540 db9ba4ed720606aa9b538172c70b30ec75f6a11ffa869bfa5d90505c11fb272d.exe

pid	process
540	db9ba4ed720606aa9b538172c70b30ec75f6a11ffa869bfa5d90505c11fb272d.exe

C:\Users\Admin\AppData\Local\Temp\db9ba4ed720606aa9b538172c70b30ec75f6a11ffa869bfa5d90505c11fb272d.exe
"C:\Users\Admin\AppData\Local\Temp\db9ba4ed720606aa9b538172c70b30ec75f6a11ffa869bfa5d90505c11fb272d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:540

memory/540-134-0x00000000021A0000-0x00000000021AB000-memory.dmp

Filesize
44KB

Download
memory/540-135-0x00007FFDED4F0000-0x00007FFDED6E5000-memory.dmp

Filesize
2.0MB

Download