guloader | 424db2a4770b7f556a6240bb7397c5ef0f338e5b18e8433ab3c885936867d950

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:27

Target

424db2a4770b7f556a6240bb7397c5ef0f338e5b18e8433ab3c885936867d950.exe
Size

72KB
MD5

31495808b8ab66555d959d2ff0295966
SHA1

3dc1f662a4994b7cef14861c0546ad5104c78dec
SHA256

424db2a4770b7f556a6240bb7397c5ef0f338e5b18e8433ab3c885936867d950
SHA512

301134234f1d2198160cdf473c6f7544d3154d1bdc934e3105fd1d21dd93861f0331bd0b9008412403ce8522ba891d9102506b4a59a871878b6d82aa6f393f89
SSDEEP

1536:1DiY2mw+dFM771R2qgb4yQdeNCYOB3HD:1uY2mBP+R2qgb4yQgNC93H

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1EPLKE2jU-13GRwa9abDlLunXItGAGUy4

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1940-56-0x00000000003E0000-0x00000000003EA000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

424db2a4770b7f556a6240bb7397c5ef0f338e5b18e8433ab3c885936867d950.exe

pid process

1940 424db2a4770b7f556a6240bb7397c5ef0f338e5b18e8433ab3c885936867d950.exe

pid	process
1940	424db2a4770b7f556a6240bb7397c5ef0f338e5b18e8433ab3c885936867d950.exe

C:\Users\Admin\AppData\Local\Temp\424db2a4770b7f556a6240bb7397c5ef0f338e5b18e8433ab3c885936867d950.exe
"C:\Users\Admin\AppData\Local\Temp\424db2a4770b7f556a6240bb7397c5ef0f338e5b18e8433ab3c885936867d950.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1940

memory/1940-56-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/1940-57-0x0000000076D10000-0x0000000076EB9000-memory.dmp

Filesize
1.7MB

Download