Overview

overview

10

Static

static

1706bb74fd...28.exe

windows7-x64

10

1706bb74fd...28.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    39s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2023 15:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1706bb74fdb461372f51a1d3f6edc003942464b96c2eeb4ec4d91bb47bf7b028.exe

  • Size

    72KB

  • MD5

    6e6884d8a1d6cf23a69b71fa76ed507b

  • SHA1

    0200f50561d90db21a548afc715c0b5250b8b680

  • SHA256

    1706bb74fdb461372f51a1d3f6edc003942464b96c2eeb4ec4d91bb47bf7b028

  • SHA512

    1b0c5befe4216de8d49209e5a495552988519b976d27413ee2281d96a3db04276411513e182c3ca5943a14d599421e07926a1ff9cc9a65d3f253f9191a6fa997

  • SSDEEP

    1536:uXGnPsZfzCv6ttApZYlh2QMtdUAqOcEi3/EPX:u2UAv6PbvMPUbO1isP

Score
10/10
guloaderdownloaderguloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1d-ImNO2Z1s3iuTWB9trmwacJSxQC7hn4

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Guloader payload 1 IoCs
    guloader
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1706bb74fdb461372f51a1d3f6edc003942464b96c2eeb4ec4d91bb47bf7b028.exe
    "C:\Users\Admin\AppData\Local\Temp\1706bb74fdb461372f51a1d3f6edc003942464b96c2eeb4ec4d91bb47bf7b028.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2020-56-0x0000000000340000-0x000000000034B000-memory.dmp
    Filesize

    44KB

    Download
  • memory/2020-57-0x0000000076CB0000-0x0000000076E59000-memory.dmp
    Filesize

    1.7MB

    Download