guloader | c394bb5a204c6e25c1a23b3564d84fabf4e42dfde765add1421f77c47d643275

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:20

Target

c394bb5a204c6e25c1a23b3564d84fabf4e42dfde765add1421f77c47d643275.exe
Size

100KB
MD5

c8c40b010a3853eed35081c3675f5cc9
SHA1

2422b9359fa3e983816904abcd0d2edcc2e4602c
SHA256

c394bb5a204c6e25c1a23b3564d84fabf4e42dfde765add1421f77c47d643275
SHA512

8068127f874cf4e549f0268198af2f24b5ad825a2d38b4a6dcdf6d6c0261a2e7f73bd8aeb4915ee0eec31e865f1cecd8bffa2efc98dae3d560e645b157761f4f
SSDEEP

1536:JM+VffsakR8aXL0qyTkZdcm6DAZc7kb7R5X8:JM4sakRR7pMiqPcZcf

Score

10^/10

Family

guloader

http://185.161.211.58/XP_remcos%202021_HzUYr10.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c394bb5a204c6e25c1a23b3564d84fabf4e42dfde765add1421f77c47d643275.exe

pid process

1504 c394bb5a204c6e25c1a23b3564d84fabf4e42dfde765add1421f77c47d643275.exe

pid	process
1504	c394bb5a204c6e25c1a23b3564d84fabf4e42dfde765add1421f77c47d643275.exe

C:\Users\Admin\AppData\Local\Temp\c394bb5a204c6e25c1a23b3564d84fabf4e42dfde765add1421f77c47d643275.exe
"C:\Users\Admin\AppData\Local\Temp\c394bb5a204c6e25c1a23b3564d84fabf4e42dfde765add1421f77c47d643275.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1504

memory/1504-134-0x00000000021E0000-0x00000000021EB000-memory.dmp

Filesize
44KB

Download
memory/1504-135-0x00007FF90B5F0000-0x00007FF90B7E5000-memory.dmp

Filesize
2.0MB

Download