Overview

overview

10

Static

static

9d4fef68ce...6b.exe

windows7-x64

10

9d4fef68ce...6b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2023 21:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9d4fef68cea3a9741e7ec17df630c91ec8be60764c9794dbf4c0c0b15c72866b.exe

  • Size

    64KB

  • MD5

    50fcbd0927ae25c74e818cf3a2e39abd

  • SHA1

    13652b28506e98577505a34ef21e8ef0073d0ad1

  • SHA256

    9d4fef68cea3a9741e7ec17df630c91ec8be60764c9794dbf4c0c0b15c72866b

  • SHA512

    4cabfaf9ef0155e435fd4f9fdf4471810eb635d17fd7aa2fb5a899978c42e9603b30126fe9b1aadde5c192ab477db590c33d59fdf624217455561891f06547f9

  • SSDEEP

    768:hX76pMOAudWfklC3wbiypeqPGS4pLP4pexKWkRRVXlcxE9qms:B70P1DjeqL4uexngRVpA

Score
10/10
guloaderdownloader

Malware Config

Extracted

Family

guloader

C2

https://cagno-di.com/wp-admin/bin_lUQUaSkho34.bin

http://103.141.138.118/bin_lUQUaSkho34.bin
xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d4fef68cea3a9741e7ec17df630c91ec8be60764c9794dbf4c0c0b15c72866b.exe
    "C:\Users\Admin\AppData\Local\Temp\9d4fef68cea3a9741e7ec17df630c91ec8be60764c9794dbf4c0c0b15c72866b.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1292-56-0x00000000002F0000-0x00000000002F9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1292-57-0x00000000770A0000-0x0000000077249000-memory.dmp

    Filesize

    1.7MB

    Download