guloader | af85d8000015b759cb9a92855ae9e30d627a774144439e9649eb58922d8c0105

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 15:21

Target

af85d8000015b759cb9a92855ae9e30d627a774144439e9649eb58922d8c0105.exe
Size

60KB
MD5

e9077d1ffd31f7b5d3ef5dbddf660a11
SHA1

afffda4d3b5d35cfa931419992224d5ee55ca66b
SHA256

af85d8000015b759cb9a92855ae9e30d627a774144439e9649eb58922d8c0105
SHA512

4f1c673d76672dd8b3d53dabc501ca0cb5d8ebb0ce39cee730461a539a0e32c10837f70fabc2031502429c467d3caba6cd9cbf6566c83b58f21e7f010ed037d8
SSDEEP

768:e2KgmR8m4t4Ey8e/artl92ig9Pk0DV5Ajf37M7ag380rr9woAMCj3SiXS8gb:0REt41/iT92ig9MkVM37EaMp9yx

Score

10^/10

Family

guloader

https://cervmp.cl/dstu_qnXdbri105.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

af85d8000015b759cb9a92855ae9e30d627a774144439e9649eb58922d8c0105.exe

pid process

3764 af85d8000015b759cb9a92855ae9e30d627a774144439e9649eb58922d8c0105.exe

pid	process
3764	af85d8000015b759cb9a92855ae9e30d627a774144439e9649eb58922d8c0105.exe

C:\Users\Admin\AppData\Local\Temp\af85d8000015b759cb9a92855ae9e30d627a774144439e9649eb58922d8c0105.exe
"C:\Users\Admin\AppData\Local\Temp\af85d8000015b759cb9a92855ae9e30d627a774144439e9649eb58922d8c0105.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3764

memory/3764-134-0x0000000002240000-0x000000000224A000-memory.dmp

Filesize
40KB

Download
memory/3764-135-0x00007FFA399B0000-0x00007FFA39BA5000-memory.dmp

Filesize
2.0MB

Download