guloader | 96942205b5b6d26c2bcf3992fac581e9deb2f09b45359f9736b89b35ca093756

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:27

Target

96942205b5b6d26c2bcf3992fac581e9deb2f09b45359f9736b89b35ca093756.exe
Size

96KB
MD5

dd7f628ba2ac5e60d415273a789f18be
SHA1

336a660ab0b0e708f16342e9c7aede8a7b9505cb
SHA256

96942205b5b6d26c2bcf3992fac581e9deb2f09b45359f9736b89b35ca093756
SHA512

108a3b3fa6dc1b9194cc69744bf96a2c743b594fba76f296db5cb444fcf8f050dcba8d8d1f434b04fbe39cd5f64c01876d6aad180a3163be983a134b37d895c7
SSDEEP

1536:EaAeCsa/WMafKICHYdrPHpFHx+KkjWh2Z:dCf/WMaSIhx/pXyz

Score

10^/10

Family

guloader

https://victoragboifo.com/ui/janomo_fQdIvwTxFA102.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/4368-134-0x00000000023A0000-0x00000000023AC000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

96942205b5b6d26c2bcf3992fac581e9deb2f09b45359f9736b89b35ca093756.exe

pid process

4368 96942205b5b6d26c2bcf3992fac581e9deb2f09b45359f9736b89b35ca093756.exe

pid	process
4368	96942205b5b6d26c2bcf3992fac581e9deb2f09b45359f9736b89b35ca093756.exe

C:\Users\Admin\AppData\Local\Temp\96942205b5b6d26c2bcf3992fac581e9deb2f09b45359f9736b89b35ca093756.exe
"C:\Users\Admin\AppData\Local\Temp\96942205b5b6d26c2bcf3992fac581e9deb2f09b45359f9736b89b35ca093756.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4368

memory/4368-134-0x00000000023A0000-0x00000000023AC000-memory.dmp

Filesize
48KB

Download
memory/4368-135-0x00007FF8350F0000-0x00007FF8352E5000-memory.dmp

Filesize
2.0MB

Download