guloader | 8dc22051b3b116993095315408c14d174c2940288459d9f08b7748ce766d159d

Analysis

max time kernel
228s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:42

Target

8dc22051b3b116993095315408c14d174c2940288459d9f08b7748ce766d159d.exe
Size

72KB
MD5

9637ed14979db65038feef4198e52dd1
SHA1

2b4e7ff68836b91dce0cd8cf34ead1136bd6fe84
SHA256

8dc22051b3b116993095315408c14d174c2940288459d9f08b7748ce766d159d
SHA512

e1958a332a865e1fc5ea9388fe839182477f936a26bf5a82b4d231a8fd3397892aa64f7b10a6757b5ae0058e0c66266f095f94566d2e60d56ef5bca4224d24db
SSDEEP

1536:KDsqCVErgbEQ9RwK5aAcFYkKGuF+lQNYql/D:KYqCUgbEwR7RcFYkKGuF2QNx/

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=1ZHj4dLvE53vort3O5aUec7FCICQviii2

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral2/memory/1004-135-0x0000000002A60000-0x0000000002A6B000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8dc22051b3b116993095315408c14d174c2940288459d9f08b7748ce766d159d.exe

pid process

1004 8dc22051b3b116993095315408c14d174c2940288459d9f08b7748ce766d159d.exe

pid	process
1004	8dc22051b3b116993095315408c14d174c2940288459d9f08b7748ce766d159d.exe

C:\Users\Admin\AppData\Local\Temp\8dc22051b3b116993095315408c14d174c2940288459d9f08b7748ce766d159d.exe
"C:\Users\Admin\AppData\Local\Temp\8dc22051b3b116993095315408c14d174c2940288459d9f08b7748ce766d159d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1004

memory/1004-135-0x0000000002A60000-0x0000000002A6B000-memory.dmp

Filesize
44KB

Download
memory/1004-136-0x00007FFE9C930000-0x00007FFE9CB25000-memory.dmp

Filesize
2.0MB

Download