Analysis
-
max time kernel
37s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:00
Static task
static1
Behavioral task
behavioral1
Sample
1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe
Resource
win10v2004-20221111-en
General
-
Target
1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe
-
Size
112KB
-
MD5
555a9213bfadf86fed1d30a05a61c7bb
-
SHA1
cf808e966b12aa76ae34cfb70f14394c523c49d2
-
SHA256
1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200
-
SHA512
ecb05eb82daed9945125d41af4b5b3440b35509792f752fe571adb91f23ca301b68120f3bcdd6acd32587ed64c7bc79ef946cd19603c399c5c52e7b25cd8b25b
-
SSDEEP
1536:1WMEz6fwRU5Ewgct557bycYucnN50nEaM//iqf:5OOmG57WmgN5Xrf
Malware Config
Extracted
guloader
https://construexpress.com/dff/janomo_zPWYwxJQWp126.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1384-56-0x00000000004C0000-0x00000000004CC000-memory.dmp family_guloader -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exepid process 1384 1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe