guloader | a36041a560d2411ca2cabe0fa90f7ccd5218e12493986145e21e832d6e87769b

Analysis

max time kernel
40s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 18:14

Target

a36041a560d2411ca2cabe0fa90f7ccd5218e12493986145e21e832d6e87769b.exe
Size

120KB
MD5

2c71726eaf541fb9608cf2a1fbc37e6c
SHA1

805e16968e25cb7bf57e5d342bfb687f7f74a27a
SHA256

a36041a560d2411ca2cabe0fa90f7ccd5218e12493986145e21e832d6e87769b
SHA512

3b090d549693b43654c0b7d8172067171f4488a94be065305e266539373f73f895b8d663a8571db2789adb7c89e62582308d18b644ba08807efe4259d8f2bad9
SSDEEP

1536:n2TQmz7e8r8zjmVO3w6Eaqn8zpOJkSXNvf36aqeJuVVO:nWZC8rwPz2tE8

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1Ed20ifLUd2sJyOtjGieeVM4gWJnn6uu-

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/832-56-0x00000000002C0000-0x00000000002CA000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a36041a560d2411ca2cabe0fa90f7ccd5218e12493986145e21e832d6e87769b.exe

pid process

832 a36041a560d2411ca2cabe0fa90f7ccd5218e12493986145e21e832d6e87769b.exe

pid	process
832	a36041a560d2411ca2cabe0fa90f7ccd5218e12493986145e21e832d6e87769b.exe

C:\Users\Admin\AppData\Local\Temp\a36041a560d2411ca2cabe0fa90f7ccd5218e12493986145e21e832d6e87769b.exe
"C:\Users\Admin\AppData\Local\Temp\a36041a560d2411ca2cabe0fa90f7ccd5218e12493986145e21e832d6e87769b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:832

memory/832-56-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download
memory/832-57-0x0000000077AF0000-0x0000000077C99000-memory.dmp

Filesize
1.7MB

Download