guloader | 7d95b224db92ea13f9afcc758923979062f0a519c9856cf4e58377712de8e535

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:27

Target

7d95b224db92ea13f9afcc758923979062f0a519c9856cf4e58377712de8e535.exe
Size

96KB
MD5

fcd577a86d6c815e685d90facbbf0800
SHA1

fa89690a323a5016f20bc9f31ecd78031e85404f
SHA256

7d95b224db92ea13f9afcc758923979062f0a519c9856cf4e58377712de8e535
SHA512

24c4b1416930dadca5703d301794d6754849c9edb7277014baf437016ea9958f046de177a8148c64ba9bc8ecc0ac30be1b861104d279f1b6fe010d72cc2763ca
SSDEEP

1536:QPRPzktpaq8gG44d51orvaCbPvHZLwENkBn:QuCq8ThZgfv6X

Score

10^/10

Family

guloader

https://victoragboifo.com/ui/janomo_ZWptyvplG238.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/4920-134-0x0000000002290000-0x000000000229C000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7d95b224db92ea13f9afcc758923979062f0a519c9856cf4e58377712de8e535.exe

pid process

4920 7d95b224db92ea13f9afcc758923979062f0a519c9856cf4e58377712de8e535.exe

pid	process
4920	7d95b224db92ea13f9afcc758923979062f0a519c9856cf4e58377712de8e535.exe

C:\Users\Admin\AppData\Local\Temp\7d95b224db92ea13f9afcc758923979062f0a519c9856cf4e58377712de8e535.exe
"C:\Users\Admin\AppData\Local\Temp\7d95b224db92ea13f9afcc758923979062f0a519c9856cf4e58377712de8e535.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4920

memory/4920-134-0x0000000002290000-0x000000000229C000-memory.dmp

Filesize
48KB

Download
memory/4920-135-0x00007FF82E030000-0x00007FF82E225000-memory.dmp

Filesize
2.0MB

Download