guloader | 507008571ee028cb9152f476a2824f02a00bddeb617bcd41a0305acabe208f7f

Analysis

max time kernel
34s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 21:57

Target

507008571ee028cb9152f476a2824f02a00bddeb617bcd41a0305acabe208f7f.exe
Size

108KB
MD5

44b07a643d28bdb8a3dc72a5c01cff3e
SHA1

4a309a3d3e213cd5ec12ca5ee948436c8af01a91
SHA256

507008571ee028cb9152f476a2824f02a00bddeb617bcd41a0305acabe208f7f
SHA512

ae896fd60d0776bf073ba038ddf52b946868413b901ba9f97d1e8fa964fb07c5b7082167be7ddc79fd963c03fedb46c03fc985cf3c6f6f340abdbe1d1dcc92b3
SSDEEP

1536:DKiaF6l3XD2hBQr4kjZH17N4QnKVk7/a+/zbEQAAoqi8FxBjOFmygJdZ:D5lzZH17NrTa+rZAzF83BamygJj

Score

10^/10

Family

guloader

https://onedrive.live.com/download?cid=1EF46D95820B4241&resid=1EF46D95820B4241%21136&authkey=APq5090UCH5vIKY

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

507008571ee028cb9152f476a2824f02a00bddeb617bcd41a0305acabe208f7f.exe

pid process

1932 507008571ee028cb9152f476a2824f02a00bddeb617bcd41a0305acabe208f7f.exe

pid	process
1932	507008571ee028cb9152f476a2824f02a00bddeb617bcd41a0305acabe208f7f.exe

C:\Users\Admin\AppData\Local\Temp\507008571ee028cb9152f476a2824f02a00bddeb617bcd41a0305acabe208f7f.exe
"C:\Users\Admin\AppData\Local\Temp\507008571ee028cb9152f476a2824f02a00bddeb617bcd41a0305acabe208f7f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1932

memory/1932-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1932-57-0x00000000002A0000-0x00000000002AB000-memory.dmp

Filesize
44KB

Download
memory/1932-58-0x0000000077C00000-0x0000000077DA9000-memory.dmp

Filesize
1.7MB

Download