Analysis
-
max time kernel
159s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 16:27
Static task
static1
Behavioral task
behavioral1
Sample
4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe
Resource
win10v2004-20221111-en
General
-
Target
4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe
-
Size
96KB
-
MD5
aa0c7f816d567d64f5f8239e31810bc2
-
SHA1
78f7ffa89a6db4a7dcd68b336e81bf931ca3acad
-
SHA256
4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35
-
SHA512
f142655218dfc79ffed3d64cb51cb028fb1685209fec7b05f6fcb87fba6fd5a5b9ae72c3db8fe004289ed0c312a613ac643ce011eaa1c26ab8cf09f2f02cc06c
-
SSDEEP
1536:w2xmcuHmk6DM5gpuo5J6ihRU7fP/bJ1P7Phz:hJZDMOuwna7fPrPF
Malware Config
Extracted
guloader
https://21twelveinteractive.com/fg/janomo_HrgqGK154.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Guloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4536-134-0x0000000002290000-0x000000000229C000-memory.dmp family_guloader -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exepid process 4536 4b6f906654e77aff5dce0d3c885fbe5f246f91f701b10510492ccc85bfcd0a35.exe