Overview

overview

10

Static

static

949b414a95...f1.exe

windows7-x64

10

949b414a95...f1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    75s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2023 16:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    949b414a9516e4746044c40c3eceb7f74fcedd46455c6797a9b3f79e0d57dcf1.exe

  • Size

    96KB

  • MD5

    e58dc1160ff26daddcdc2e8c58d28f34

  • SHA1

    2f98d5c82ccb9a50ab7d1ba03f5044370499d1d9

  • SHA256

    949b414a9516e4746044c40c3eceb7f74fcedd46455c6797a9b3f79e0d57dcf1

  • SHA512

    65018b3311ba25bc00dea6e4a1bffbc97538d06f14a4bf1be0e92031e977e22b9df09c08f17c9a5ce1d43397d2fdc4bc434eb26c6839f2c7e2a2d9f4b7ae6c63

  • SSDEEP

    1536:Ik/p3GEnxggU4dMYzJg/QmDRYBZ2L3e3UTL1L/tz10p3GEnx:I53YdgF/30wT

Score
10/10
guloaderdownloader

Malware Config

Extracted

Family

guloader

C2

http://mtspsmjeli.sch.id/cl/XP_remcos%202021_HzUYr10.bin

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\949b414a9516e4746044c40c3eceb7f74fcedd46455c6797a9b3f79e0d57dcf1.exe
    "C:\Users\Admin\AppData\Local\Temp\949b414a9516e4746044c40c3eceb7f74fcedd46455c6797a9b3f79e0d57dcf1.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1500-56-0x0000000000240000-0x000000000024C000-memory.dmp
    Filesize

    48KB

    Download
  • memory/1500-57-0x00000000774C0000-0x0000000077669000-memory.dmp
    Filesize

    1.7MB

    Download