guloader | 6e4dac54232f26e52ee3056886bb92bdb950f6887cdb9707af69e0281d6c2409

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 16:27

Target

6e4dac54232f26e52ee3056886bb92bdb950f6887cdb9707af69e0281d6c2409.exe
Size

116KB
MD5

05531f51de1bf42f218a1491c8aa3011
SHA1

6bb34a8919f8d5a85a84a464a769008c6b8956d9
SHA256

6e4dac54232f26e52ee3056886bb92bdb950f6887cdb9707af69e0281d6c2409
SHA512

ce60b293d627692bbb98555b81049ac015e3f181027d993d74f79f5a8eb3ad34903bc4b00cedd8644b37dfeec566c43cb26a1dfb16cedb267309ebd8d27fd514
SSDEEP

1536:LGnahGXv3ns4Rj/23936+X+jWlZ0UuQ4KSyP4EPCqwRJ:LGwGfnsM2399XIUu1vyP9cRJ

Score

10^/10

Family

guloader

https://victoragboifo.com/ui/janomo_GvEFxS106.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/752-56-0x0000000000430000-0x000000000043C000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6e4dac54232f26e52ee3056886bb92bdb950f6887cdb9707af69e0281d6c2409.exe

pid process

752 6e4dac54232f26e52ee3056886bb92bdb950f6887cdb9707af69e0281d6c2409.exe

pid	process
752	6e4dac54232f26e52ee3056886bb92bdb950f6887cdb9707af69e0281d6c2409.exe

C:\Users\Admin\AppData\Local\Temp\6e4dac54232f26e52ee3056886bb92bdb950f6887cdb9707af69e0281d6c2409.exe
"C:\Users\Admin\AppData\Local\Temp\6e4dac54232f26e52ee3056886bb92bdb950f6887cdb9707af69e0281d6c2409.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:752

memory/752-56-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/752-57-0x00000000778E0000-0x0000000077A89000-memory.dmp

Filesize
1.7MB

Download