guloader | a758f7ee57c6dcccc0b63276a47125db6ccd9ed8a4ce0f7217187326e2b4fbdf

Analysis

max time kernel
22s
max time network
55s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:27

Target

a758f7ee57c6dcccc0b63276a47125db6ccd9ed8a4ce0f7217187326e2b4fbdf.exe
Size

132KB
MD5

e78c711ec72c356d59e1a0b74859718c
SHA1

d24bc8acecb1b818d87d5c988b21e01bd7acfb3b
SHA256

a758f7ee57c6dcccc0b63276a47125db6ccd9ed8a4ce0f7217187326e2b4fbdf
SHA512

0e6627fdc65291ca05b7fcb9d3134f3c3b49b25606540192f9dd555e813b13ad84e017f8b0d583f90cd68c150116d5eee7329205b014eb36707d0f468dcf6f95
SSDEEP

1536:nmnVNuADosHDum4izsnQFyazxrZkr7RPp5Pk7YHOwQ:Wuy4XQFyazx9YNhYSOw

Score

10^/10

Family

guloader

https://onedrive.live.com/download?cid=604AA6C584DB9137&resid=604AA6C584DB9137%21124&authkey=AO7BkNNuodxtFuA

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a758f7ee57c6dcccc0b63276a47125db6ccd9ed8a4ce0f7217187326e2b4fbdf.exe

pid process

1460 a758f7ee57c6dcccc0b63276a47125db6ccd9ed8a4ce0f7217187326e2b4fbdf.exe

pid	process
1460	a758f7ee57c6dcccc0b63276a47125db6ccd9ed8a4ce0f7217187326e2b4fbdf.exe

C:\Users\Admin\AppData\Local\Temp\a758f7ee57c6dcccc0b63276a47125db6ccd9ed8a4ce0f7217187326e2b4fbdf.exe
"C:\Users\Admin\AppData\Local\Temp\a758f7ee57c6dcccc0b63276a47125db6ccd9ed8a4ce0f7217187326e2b4fbdf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1460

memory/1460-56-0x0000000000440000-0x000000000044B000-memory.dmp

Filesize
44KB

Download
memory/1460-57-0x0000000077880000-0x0000000077A29000-memory.dmp

Filesize
1.7MB

Download