guloader | b4c9882ab1f710ecadad85626efa06b24f93bd03dcb5185bb71759897c27788c

Analysis

max time kernel
13s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:27

Target

b4c9882ab1f710ecadad85626efa06b24f93bd03dcb5185bb71759897c27788c.exe
Size

84KB
MD5

38871ade5dcbcd5b68ff50f4d812c8ac
SHA1

6adeb00430c420ce5f82a68ecbabda67489c6a2a
SHA256

b4c9882ab1f710ecadad85626efa06b24f93bd03dcb5185bb71759897c27788c
SHA512

b6e2022e9a7c839e928461d73f2edd7fca39cd2a5e673d36a20537ddf9bc32aedb9aa63a844bfad5458ea842f257794e4f203be5d74914cf8af9fbc15aee19d4
SSDEEP

768:MwlzEvMrLdKy8B4Tfc8Zv4G196fFRj58xg2NGlrpo/74aXuThRW:xlYUrLdZTbWQ4Sxg2N4p874NW

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1VJnD6uQHtBxca43VpSx9LuimmHo1dL4U

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/2148-134-0x00000000001C0000-0x00000000001CC000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b4c9882ab1f710ecadad85626efa06b24f93bd03dcb5185bb71759897c27788c.exe

pid process

2148 b4c9882ab1f710ecadad85626efa06b24f93bd03dcb5185bb71759897c27788c.exe

pid	process
2148	b4c9882ab1f710ecadad85626efa06b24f93bd03dcb5185bb71759897c27788c.exe

C:\Users\Admin\AppData\Local\Temp\b4c9882ab1f710ecadad85626efa06b24f93bd03dcb5185bb71759897c27788c.exe
"C:\Users\Admin\AppData\Local\Temp\b4c9882ab1f710ecadad85626efa06b24f93bd03dcb5185bb71759897c27788c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2148

memory/2148-134-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download
memory/2148-135-0x00007FF84BC50000-0x00007FF84BE45000-memory.dmp

Filesize
2.0MB

Download