guloader | 71d93d9a145d177289f7350651f149de2b9ce8642452ff25e1fba72d7053018a

Analysis

max time kernel
24s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:27

Target

71d93d9a145d177289f7350651f149de2b9ce8642452ff25e1fba72d7053018a.exe
Size

72KB
MD5

9747bacd52e5d7f04fe073a87a3f4d6b
SHA1

150de36590e7a01715ca1a89b56381be5dd12c39
SHA256

71d93d9a145d177289f7350651f149de2b9ce8642452ff25e1fba72d7053018a
SHA512

496699d7c8e11c65189d3ae11957be304d4878bffd4ea014018e720daf7cab9df01313ae38a0f3378fa226ef8167b91ba2cce1dd3e6263f3a6133b109f9826fc
SSDEEP

1536:rDyT/x7V56SVABmKcMpcUdxlbYC8YbiD:reT/x7V7kzcMpcUdxlkC8ci

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=12jL2dCziC56lzHWX-gbXCLiOQKMh-XDw

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/2004-56-0x0000000000370000-0x000000000037B000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

71d93d9a145d177289f7350651f149de2b9ce8642452ff25e1fba72d7053018a.exe

pid process

2004 71d93d9a145d177289f7350651f149de2b9ce8642452ff25e1fba72d7053018a.exe

pid	process
2004	71d93d9a145d177289f7350651f149de2b9ce8642452ff25e1fba72d7053018a.exe

C:\Users\Admin\AppData\Local\Temp\71d93d9a145d177289f7350651f149de2b9ce8642452ff25e1fba72d7053018a.exe
"C:\Users\Admin\AppData\Local\Temp\71d93d9a145d177289f7350651f149de2b9ce8642452ff25e1fba72d7053018a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2004

memory/2004-56-0x0000000000370000-0x000000000037B000-memory.dmp

Filesize
44KB

Download
memory/2004-57-0x00000000771A0000-0x0000000077349000-memory.dmp

Filesize
1.7MB

Download