guloader | d1650c8ba87bb2b1938eb6e5d9a14fa43f1897ed566d21c473a69778960d8e79

Analysis

max time kernel
60s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:42

Target

d1650c8ba87bb2b1938eb6e5d9a14fa43f1897ed566d21c473a69778960d8e79.exe
Size

72KB
MD5

8daca3fcbece201be9631385a1a05cdd
SHA1

b22c9effa83ef2727848a14b34dac3abeb07f059
SHA256

d1650c8ba87bb2b1938eb6e5d9a14fa43f1897ed566d21c473a69778960d8e79
SHA512

13364d4044fdd7ad8690bc5a8ef9dc493d02dced6f50909260dfd97e0fb08f4482456e43a520729ded62e99ba2213d3ac121caf58199e9d00974058c15fb837e
SSDEEP

1536:V2DVvJF6xnrMClmWokoLtnjMiCIY52IHD:V2ZvJF6HsWokoLtnjrCIsHH

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1lbp4Nqg2LZqJJb1BC6cI2NjWIY2vAJjy

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/1512-134-0x0000000002AA0000-0x0000000002AAA000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d1650c8ba87bb2b1938eb6e5d9a14fa43f1897ed566d21c473a69778960d8e79.exe

pid process

1512 d1650c8ba87bb2b1938eb6e5d9a14fa43f1897ed566d21c473a69778960d8e79.exe

pid	process
1512	d1650c8ba87bb2b1938eb6e5d9a14fa43f1897ed566d21c473a69778960d8e79.exe

C:\Users\Admin\AppData\Local\Temp\d1650c8ba87bb2b1938eb6e5d9a14fa43f1897ed566d21c473a69778960d8e79.exe
"C:\Users\Admin\AppData\Local\Temp\d1650c8ba87bb2b1938eb6e5d9a14fa43f1897ed566d21c473a69778960d8e79.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1512

memory/1512-134-0x0000000002AA0000-0x0000000002AAA000-memory.dmp

Filesize
40KB

Download
memory/1512-135-0x00007FFD8B1F0000-0x00007FFD8B3E5000-memory.dmp

Filesize
2.0MB

Download