guloader | 085f074477fc21d7ff8d79377a049772be5a6ac3ff44a2bba706a05c8c90aefb

Analysis

max time kernel
163s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 21:57

Target

085f074477fc21d7ff8d79377a049772be5a6ac3ff44a2bba706a05c8c90aefb.exe
Size

68KB
MD5

83c14a66b24119744113c9b6e5b8803d
SHA1

4a1c5058f99a63f4b9ae54a1fbde37830a7bc736
SHA256

085f074477fc21d7ff8d79377a049772be5a6ac3ff44a2bba706a05c8c90aefb
SHA512

2013cb9b6cbb3cd04f5141b456437fffb2b10f5a43c05f79739b956655ad5508a418c7e912a3c1e33ac2c4081fbddfcb70309fd67e658b86a39278ccc14c116a
SSDEEP

768:ZKwUy2YNMz+jd9N3gPXylbgRqd0KwrbFTmMcgQNrN6aUJT1nwPdu06BLIwObEIg:cwBjeaDZoKwrbFqHN6aUPS9b0

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1QFtP4O3h15SCAenwyvIgbYE8H071KTE8

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/3012-134-0x00000000021F0000-0x00000000021FB000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

085f074477fc21d7ff8d79377a049772be5a6ac3ff44a2bba706a05c8c90aefb.exe

pid process

3012 085f074477fc21d7ff8d79377a049772be5a6ac3ff44a2bba706a05c8c90aefb.exe

pid	process
3012	085f074477fc21d7ff8d79377a049772be5a6ac3ff44a2bba706a05c8c90aefb.exe

C:\Users\Admin\AppData\Local\Temp\085f074477fc21d7ff8d79377a049772be5a6ac3ff44a2bba706a05c8c90aefb.exe
"C:\Users\Admin\AppData\Local\Temp\085f074477fc21d7ff8d79377a049772be5a6ac3ff44a2bba706a05c8c90aefb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3012

memory/3012-134-0x00000000021F0000-0x00000000021FB000-memory.dmp

Filesize
44KB

Download
memory/3012-135-0x00007FF83A210000-0x00007FF83A405000-memory.dmp

Filesize
2.0MB

Download