Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 15:22
Static task
static1
Behavioral task
behavioral1
Sample
3f9f864ed54e44384cf7b555812093eda1b1ee9871c1314ec549daf3a67e3747.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3f9f864ed54e44384cf7b555812093eda1b1ee9871c1314ec549daf3a67e3747.exe
Resource
win10v2004-20220901-en
General
-
Target
3f9f864ed54e44384cf7b555812093eda1b1ee9871c1314ec549daf3a67e3747.exe
-
Size
72KB
-
MD5
3688f795d5c81265368cbea22964c97f
-
SHA1
8b649cf8652bc187822209ed64e7b5cf22295589
-
SHA256
3f9f864ed54e44384cf7b555812093eda1b1ee9871c1314ec549daf3a67e3747
-
SHA512
e21ca2a649a6af723ff0e137c1198614a7a986f4ab359c8b01072e27909e3276abc88dd9b371f5f048059712b0a2c722760494f2a78b154dd9985a2a8eea814d
-
SSDEEP
1536:0Xkky+qSfg1eu6gzZg/k+hFI4ARzyZs0R8LX:0dy+qW6lukcFNAtyZR8L
Malware Config
Extracted
guloader
https://drive.google.com/uc?export=download&id=1ABJ4O34hwHOuCcfJkzm0z2vbXEFV7L0w
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/904-56-0x0000000000290000-0x000000000029B000-memory.dmp family_guloader -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3f9f864ed54e44384cf7b555812093eda1b1ee9871c1314ec549daf3a67e3747.exepid process 904 3f9f864ed54e44384cf7b555812093eda1b1ee9871c1314ec549daf3a67e3747.exe