guloader | 80dd14ae9d96970205e6ff6cbb18f7be89b1a748c7d4a0163026f7319bb5c3df

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:27

Target

80dd14ae9d96970205e6ff6cbb18f7be89b1a748c7d4a0163026f7319bb5c3df.exe
Size

96KB
MD5

c3086a11c6ae5b585016f32b8abf12c3
SHA1

4a8d4b9c11dfbf2152d1df31f139f67b2bbe1f04
SHA256

80dd14ae9d96970205e6ff6cbb18f7be89b1a748c7d4a0163026f7319bb5c3df
SHA512

9a8f13e1cacec5fc1352b7ce5cbaf40ea38997de39f6d1d91468b2b00001bc7e7a67d0f54273314d43c1b88d2564cdbd2eec47de8e02a50c4ec962d547819ad6
SSDEEP

1536:Q0bLxrsv9SDFtlZZkhSPWW1tq/+sKuMg3lKmbL:QULCEDlMhBW1tq/xUgXL

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1GKeyRCfgxwo0QHwDAdNQkkUuWCYhXamm

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

80dd14ae9d96970205e6ff6cbb18f7be89b1a748c7d4a0163026f7319bb5c3df.exe

pid process

2268 80dd14ae9d96970205e6ff6cbb18f7be89b1a748c7d4a0163026f7319bb5c3df.exe

pid	process
2268	80dd14ae9d96970205e6ff6cbb18f7be89b1a748c7d4a0163026f7319bb5c3df.exe

C:\Users\Admin\AppData\Local\Temp\80dd14ae9d96970205e6ff6cbb18f7be89b1a748c7d4a0163026f7319bb5c3df.exe
"C:\Users\Admin\AppData\Local\Temp\80dd14ae9d96970205e6ff6cbb18f7be89b1a748c7d4a0163026f7319bb5c3df.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2268

memory/2268-134-0x0000000002310000-0x000000000231B000-memory.dmp

Filesize
44KB

Download
memory/2268-135-0x00007FFA252F0000-0x00007FFA254E5000-memory.dmp

Filesize
2.0MB

Download