guloader | 0bb22a9609a12319cfdada9b2bcfef4e4a038441d9eb707a92958b02a0e974b8

Analysis

max time kernel
164s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:54

Target

0bb22a9609a12319cfdada9b2bcfef4e4a038441d9eb707a92958b02a0e974b8.exe
Size

96KB
MD5

3ac28d89503bf9bd8ac610b812367d20
SHA1

17bd201dfd9aa9777b10e8c026d1607f29e3781b
SHA256

0bb22a9609a12319cfdada9b2bcfef4e4a038441d9eb707a92958b02a0e974b8
SHA512

0250d74f673b617a1a69915d4c4a765917243ce43291f128373bddd846f80aeea7cd2bdd1c2677de74e61bb7245cfb97f85198f3d4bbc6725b3b3341265ee832
SSDEEP

1536:8bLxrsPF+dKaJgKtxFWkEXGlNZWquF6sfILilKmbL:cLCKgAr8M8MgILIL

Score

10^/10

Family

guloader

https://xixaofemw.com/bin_TzEfbcdxW254.bin

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0bb22a9609a12319cfdada9b2bcfef4e4a038441d9eb707a92958b02a0e974b8.exe

pid process

2300 0bb22a9609a12319cfdada9b2bcfef4e4a038441d9eb707a92958b02a0e974b8.exe

pid	process
2300	0bb22a9609a12319cfdada9b2bcfef4e4a038441d9eb707a92958b02a0e974b8.exe

C:\Users\Admin\AppData\Local\Temp\0bb22a9609a12319cfdada9b2bcfef4e4a038441d9eb707a92958b02a0e974b8.exe
"C:\Users\Admin\AppData\Local\Temp\0bb22a9609a12319cfdada9b2bcfef4e4a038441d9eb707a92958b02a0e974b8.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2300

memory/2300-134-0x0000000002120000-0x000000000212B000-memory.dmp

Filesize
44KB

Download
memory/2300-135-0x00007FFBF4430000-0x00007FFBF4625000-memory.dmp

Filesize
2.0MB

Download