guloader | 1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200

Analysis

max time kernel
148s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 18:00

Target

1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe
Size

112KB
MD5

555a9213bfadf86fed1d30a05a61c7bb
SHA1

cf808e966b12aa76ae34cfb70f14394c523c49d2
SHA256

1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200
SHA512

ecb05eb82daed9945125d41af4b5b3440b35509792f752fe571adb91f23ca301b68120f3bcdd6acd32587ed64c7bc79ef946cd19603c399c5c52e7b25cd8b25b
SSDEEP

1536:1WMEz6fwRU5Ewgct557bycYucnN50nEaM//iqf:5OOmG57WmgN5Xrf

Score

10^/10

Family

guloader

https://construexpress.com/dff/janomo_zPWYwxJQWp126.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 2 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/812-134-0x0000000000670000-0x000000000067C000-memory.dmp	family_guloader
behavioral2/memory/812-136-0x0000000000670000-0x000000000067C000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe

pid process

812 1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe

pid	process
812	1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe

C:\Users\Admin\AppData\Local\Temp\1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe
"C:\Users\Admin\AppData\Local\Temp\1779cbb89282db10f9077e5378f0256513f2c3161222dd956bdc2fd4643e0200.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:812

memory/812-134-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/812-135-0x00007FFE26C50000-0x00007FFE26E45000-memory.dmp

Filesize
2.0MB

Download
memory/812-136-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download