guloader | 75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570

Analysis

max time kernel
112s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 15:54

Target

75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe
Size

120KB
MD5

64f9a258a7b5ea2e7b6d721dabd43b35
SHA1

309b590a9c95321c50558fc7ac64b6bef6a4c6bd
SHA256

75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570
SHA512

951f325d447e7878681e33e62ac27abfff1ee599a97c65e1a1835cef97edaa9e41159d8814dd8d26a02516cae456a8f1b33b8562abb32e66edaa991957eb903c
SSDEEP

768:bGogmHSReVkFTodr8RnS6C1e6MZYj0BTt6k+S/avEQIcAHg5GcGkDNwVGFQ6Uztj:bIySg8SXrM+4LmEQyePsVtFjeMb

Score

10^/10

Family

guloader

https://www.feeclng.com/rubbing/filing.bin

https://parisgallery.com.my/rubbing/filing.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/4252-134-0x00000000001C0000-0x00000000001CB000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe

pid process

4252 75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe

pid	process
4252	75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe

C:\Users\Admin\AppData\Local\Temp\75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe
"C:\Users\Admin\AppData\Local\Temp\75cbe348f967b746ce8e769fa17f30906bc0d4e61a3556fba093360da41ae570.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4252

memory/4252-134-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/4252-135-0x00007FF917850000-0x00007FF917A45000-memory.dmp

Filesize
2.0MB

Download