guloader | bc2e148beb60feb25893a43786c91e22ec14fc46c162ab86f4d61c1fbb20f6b0

Analysis

max time kernel
25s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 15:21

Target

bc2e148beb60feb25893a43786c91e22ec14fc46c162ab86f4d61c1fbb20f6b0.exe
Size

72KB
MD5

bc856c56b2bd6bddc9c53a3326b77a43
SHA1

7a1d706694acbdc669d2903a152bb8fb152f62ca
SHA256

bc2e148beb60feb25893a43786c91e22ec14fc46c162ab86f4d61c1fbb20f6b0
SHA512

fe7d40cbfc9acc8dd3c1b366de9e6d8705e512a4bac96cef085c40eacb2d0b5726a512561c246dc7a36e637cb67020b59da41909e516039b76e4995dbed9e46a
SSDEEP

768:J7r7WmHIaW3sX2TZuwtAs5E9ZbjGV6bzm:Qp3sGTZuaAs2PjGgu

Score

10^/10

Family

guloader

https://onedrive.live.com/download?cid=CEF5C92BC9BD70BF&resid=CEF5C92BC9BD70BF%21116&authkey=AHPepkUqm8WDxTY

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bc2e148beb60feb25893a43786c91e22ec14fc46c162ab86f4d61c1fbb20f6b0.exe

pid process

2012 bc2e148beb60feb25893a43786c91e22ec14fc46c162ab86f4d61c1fbb20f6b0.exe

pid	process
2012	bc2e148beb60feb25893a43786c91e22ec14fc46c162ab86f4d61c1fbb20f6b0.exe

C:\Users\Admin\AppData\Local\Temp\bc2e148beb60feb25893a43786c91e22ec14fc46c162ab86f4d61c1fbb20f6b0.exe
"C:\Users\Admin\AppData\Local\Temp\bc2e148beb60feb25893a43786c91e22ec14fc46c162ab86f4d61c1fbb20f6b0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2012

memory/2012-56-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2012-57-0x0000000077A50000-0x0000000077BF9000-memory.dmp

Filesize
1.7MB

Download