guloader | 002da5544c439873fdeac3e2aa0e64f1928dbffa5699b225ecdb4b9e0f05e56f

Analysis

max time kernel
16s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:27

Target

002da5544c439873fdeac3e2aa0e64f1928dbffa5699b225ecdb4b9e0f05e56f.exe
Size

120KB
MD5

0f8ab5c292125cbf9fd5627c93f4f00b
SHA1

a57f4af2ef17b9584f5cfd1ab326528231a570ec
SHA256

002da5544c439873fdeac3e2aa0e64f1928dbffa5699b225ecdb4b9e0f05e56f
SHA512

627e61fef0ca7f82abe22830453d9806466f58b432def8b5f2235fa4befe48447e492d9fbf11b4e64bd435ad4069b24c2d6fbf68c887c12b8c1d810cba2f819c
SSDEEP

1536:Zk/fQD+j14nyS1wI0Etv7CTIZmneYqxV5aVg:ZkHjlJdYWPoAVg

Score

10^/10

Family

guloader

https://21twelveinteractive.com/yj/janomo_wgPYBASsWX114.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1352-56-0x00000000003C0000-0x00000000003CC000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

002da5544c439873fdeac3e2aa0e64f1928dbffa5699b225ecdb4b9e0f05e56f.exe

pid process

1352 002da5544c439873fdeac3e2aa0e64f1928dbffa5699b225ecdb4b9e0f05e56f.exe

pid	process
1352	002da5544c439873fdeac3e2aa0e64f1928dbffa5699b225ecdb4b9e0f05e56f.exe

C:\Users\Admin\AppData\Local\Temp\002da5544c439873fdeac3e2aa0e64f1928dbffa5699b225ecdb4b9e0f05e56f.exe
"C:\Users\Admin\AppData\Local\Temp\002da5544c439873fdeac3e2aa0e64f1928dbffa5699b225ecdb4b9e0f05e56f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1352

memory/1352-56-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/1352-57-0x00000000772B0000-0x0000000077459000-memory.dmp

Filesize
1.7MB

Download