guloader | d3a1c888cb237bd60ab88e3eafd7d84e52a38ff19fab31b1d031ab4ca5e6ffc3

Analysis

max time kernel
36s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 17:42

Target

d3a1c888cb237bd60ab88e3eafd7d84e52a38ff19fab31b1d031ab4ca5e6ffc3.exe
Size

72KB
MD5

e44bbe2bb2ba810236fe71b43ddfb9f6
SHA1

e7fd5d0c71853a62088b8ed9da5ad2143cd2f2ba
SHA256

d3a1c888cb237bd60ab88e3eafd7d84e52a38ff19fab31b1d031ab4ca5e6ffc3
SHA512

17362c38e5b1013460f05876e9cb565ecad6a2feeb2a41385a9b312c1a2dc2087e9d361641628b5ad4ca56b2367d481bcebe7539610f1738aa8fbbc266ab6789
SSDEEP

768:qqqDkvWFN/nUe7IhsxO+UZd3fC+uu7s6Ib0eWzk/UYx9BHAGgYbbpA3mD:KDXTBnxlUZ580s6201hYx9BHAGgY2mD

Score

10^/10

Family

guloader

https://drive.google.com/uc?export=download&id=13x0HqxKngLRTu4Qm1jt50xYvdMr428PV

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Guloader payload 1 IoCs

guloader

Processes:

resource	yara_rule
behavioral1/memory/1644-56-0x00000000002D0000-0x00000000002DA000-memory.dmp	family_guloader

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d3a1c888cb237bd60ab88e3eafd7d84e52a38ff19fab31b1d031ab4ca5e6ffc3.exe

pid process

1644 d3a1c888cb237bd60ab88e3eafd7d84e52a38ff19fab31b1d031ab4ca5e6ffc3.exe

pid	process
1644	d3a1c888cb237bd60ab88e3eafd7d84e52a38ff19fab31b1d031ab4ca5e6ffc3.exe

C:\Users\Admin\AppData\Local\Temp\d3a1c888cb237bd60ab88e3eafd7d84e52a38ff19fab31b1d031ab4ca5e6ffc3.exe
"C:\Users\Admin\AppData\Local\Temp\d3a1c888cb237bd60ab88e3eafd7d84e52a38ff19fab31b1d031ab4ca5e6ffc3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1644

memory/1644-56-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/1644-57-0x0000000077380000-0x0000000077529000-memory.dmp

Filesize
1.7MB

Download