guloader | 4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35

Analysis

max time kernel
16s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:27

Target

4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe
Size

96KB
MD5

aa0c7f816d567d64f5f8239e31810bc2
SHA1

78f7ffa89a6db4a7dcd68b336e81bf931ca3acad
SHA256

4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35
SHA512

f142655218dfc79ffed3d64cb51cb028fb1685209fec7b05f6fcb87fba6fd5a5b9ae72c3db8fe004289ed0c312a613ac643ce011eaa1c26ab8cf09f2f02cc06c
SSDEEP

1536:w2xmcuHmk6DM5gpuo5J6ihRU7fP/bJ1P7Phz:hJZDMOuwna7fPrPF

Score

10^/10

Family

guloader

https://21twelveinteractive.com/fg/janomo_HrgqGK154.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1120-56-0x0000000000280000-0x000000000028C000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe

pid process

1120 4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe

pid	process
1120	4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe

C:\Users\Admin\AppData\Local\Temp\4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe
"C:\Users\Admin\AppData\Local\Temp\4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1120

memory/1120-57-0x0000000076EC0000-0x0000000077069000-memory.dmp

Filesize
1.7MB

Download
memory/1120-56-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download