guloader | 0d490a0762558277e2b385a209a367e2c5bd623bc286ccd319fe5f481278a1a2

Analysis

max time kernel
117s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 21:57

Target

0d490a0762558277e2b385a209a367e2c5bd623bc286ccd319fe5f481278a1a2.exe
Size

108KB
MD5

86e4fff2aef9acf356a23d65e2fbbd83
SHA1

3bec3ff34e9f4517837a24ad8a74bf3604d9c2b0
SHA256

0d490a0762558277e2b385a209a367e2c5bd623bc286ccd319fe5f481278a1a2
SHA512

72e7b48bdf958d9ad712106876472de68496021e35499e7fd441a2bac93339c9b801b5541871360a75b8fbda1740f1a989f27145dff5853d80c1805e4f39fffd
SSDEEP

1536:mKiagmcJUSQ/rHATKqlH174wQnKVk7/a+/zbzDMOwZ++sP0aC:mSc+glH174TTa+rPAOVP0B

Score

10^/10

Family

guloader

https://onedrive.live.com/download?cid=1EF46D95820B4241&resid=1EF46D95820B4241%21134&authkey=AK0tHk81sryKxcQ

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0d490a0762558277e2b385a209a367e2c5bd623bc286ccd319fe5f481278a1a2.exe

pid process

4916 0d490a0762558277e2b385a209a367e2c5bd623bc286ccd319fe5f481278a1a2.exe

pid	process
4916	0d490a0762558277e2b385a209a367e2c5bd623bc286ccd319fe5f481278a1a2.exe

C:\Users\Admin\AppData\Local\Temp\0d490a0762558277e2b385a209a367e2c5bd623bc286ccd319fe5f481278a1a2.exe
"C:\Users\Admin\AppData\Local\Temp\0d490a0762558277e2b385a209a367e2c5bd623bc286ccd319fe5f481278a1a2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4916

memory/4916-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4916-135-0x0000000002170000-0x000000000217A000-memory.dmp

Filesize
40KB

Download
memory/4916-136-0x00007FFBD4390000-0x00007FFBD4585000-memory.dmp

Filesize
2.0MB

Download