guloader | 79d10ba0ee3b864953c9a46f1e231aab48efbf91e27325e5d83743a92ba225b8

Analysis

max time kernel
153s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 17:31

Target

79d10ba0ee3b864953c9a46f1e231aab48efbf91e27325e5d83743a92ba225b8.exe
Size

80KB
MD5

5c5c4cce6f8c9386b90a49556ec00733
SHA1

c28253e203bf0fedd86815deca56493b1362602a
SHA256

79d10ba0ee3b864953c9a46f1e231aab48efbf91e27325e5d83743a92ba225b8
SHA512

696e37ca1a3a77344409c019e07050d2e3d817f5f789ecc40636e42ac1485edb6c90926d83f4866a78da6727d8c53ecedb8822e07be67e0aca51a302e739742a
SSDEEP

768:4ABlsFBTnjIsNALaLAHYXnl7m7nl9imAN53LkvemH5CfRbMIr:HlOBjNlL8YVq7nlsVxNmAJB

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1OnLl_UVjzKc69AYy3Qv2_CYgHl7YVtTK

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/5096-134-0x0000000000420000-0x000000000042B000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

79d10ba0ee3b864953c9a46f1e231aab48efbf91e27325e5d83743a92ba225b8.exe

pid process

5096 79d10ba0ee3b864953c9a46f1e231aab48efbf91e27325e5d83743a92ba225b8.exe

pid	process
5096	79d10ba0ee3b864953c9a46f1e231aab48efbf91e27325e5d83743a92ba225b8.exe

C:\Users\Admin\AppData\Local\Temp\79d10ba0ee3b864953c9a46f1e231aab48efbf91e27325e5d83743a92ba225b8.exe
"C:\Users\Admin\AppData\Local\Temp\79d10ba0ee3b864953c9a46f1e231aab48efbf91e27325e5d83743a92ba225b8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5096

memory/5096-134-0x0000000000420000-0x000000000042B000-memory.dmp

Filesize
44KB

Download
memory/5096-135-0x00007FFCB8430000-0x00007FFCB8625000-memory.dmp

Filesize
2.0MB

Download