guloader | e7043bdc05d203bb2bbe95e8eafaa1c7a9bd04dcdcef5253c9e6589d5d8a161a

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 15:54

Target

e7043bdc05d203bb2bbe95e8eafaa1c7a9bd04dcdcef5253c9e6589d5d8a161a.exe
Size

120KB
MD5

a823e99dc533f459b67d8e6f38dea8e4
SHA1

8c71778aaf2b30af756d0f4a090c3c21d2f443c3
SHA256

e7043bdc05d203bb2bbe95e8eafaa1c7a9bd04dcdcef5253c9e6589d5d8a161a
SHA512

87550e85a5773d05d9b65721221e40bfe9e1ac6280c6e3dc914496dc4e084b38ccd21d8fce2e1479d62ee03123bd231a24ebd674306b7584e837659a5ca56ced
SSDEEP

1536:3mlnhLeUSc6JGmnoqg8Nq16GudN8AE2aJHaBbzOHVqevaSCGUnNBZBm5NvE4SFE:WqLHnGosAEtqeCSCGUNBZUh

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1n1AKvYgKZOxakZvPSsJ3xlWdAHAztHu1

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e7043bdc05d203bb2bbe95e8eafaa1c7a9bd04dcdcef5253c9e6589d5d8a161a.exe

pid process

2020 e7043bdc05d203bb2bbe95e8eafaa1c7a9bd04dcdcef5253c9e6589d5d8a161a.exe

pid	process
2020	e7043bdc05d203bb2bbe95e8eafaa1c7a9bd04dcdcef5253c9e6589d5d8a161a.exe

C:\Users\Admin\AppData\Local\Temp\e7043bdc05d203bb2bbe95e8eafaa1c7a9bd04dcdcef5253c9e6589d5d8a161a.exe
"C:\Users\Admin\AppData\Local\Temp\e7043bdc05d203bb2bbe95e8eafaa1c7a9bd04dcdcef5253c9e6589d5d8a161a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2020

memory/2020-56-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/2020-57-0x0000000076D70000-0x0000000076F19000-memory.dmp

Filesize
1.7MB

Download