Overview

overview

10

Static

static

575e19ad41...d6.exe

windows7-x64

10

575e19ad41...d6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    157s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 15:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    575e19ad416bf6a90324a40672263c1a4b13c4c3adc9c40fe6c935943d1bfed6.exe

  • Size

    72KB

  • MD5

    b91b610416a4c6dd5d35761c73b72d7b

  • SHA1

    30427a2889fb6e53279bfadab24d4cf9320f283e

  • SHA256

    575e19ad416bf6a90324a40672263c1a4b13c4c3adc9c40fe6c935943d1bfed6

  • SHA512

    cb695947768ed7cc38c36c8762f2f1eb4f70a4bfa56032033a64afe22a0dff98bfbda29767f2cb4b6936be2305d154f96379a4f80663f0873b01d2067204f4f0

  • SSDEEP

    1536:rXBAgCHlLmY9rZaKJ0OYaYnjQ8pXkpK3bqDX:r8aY9rZ/xHYjQ4X4K2D

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1JOvVsVpUZb8mWC2hAze-6oEaEatA8yg2

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Guloader payload 1 IoCs
    guloader
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\575e19ad416bf6a90324a40672263c1a4b13c4c3adc9c40fe6c935943d1bfed6.exe
    "C:\Users\Admin\AppData\Local\Temp\575e19ad416bf6a90324a40672263c1a4b13c4c3adc9c40fe6c935943d1bfed6.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4316-134-0x0000000002310000-0x000000000231B000-memory.dmp
    Filesize

    44KB

    Download
  • memory/4316-135-0x00007FFD9C550000-0x00007FFD9C745000-memory.dmp
    Filesize

    2.0MB

    Download