guloader | 121a554eb125e86a98409c860facb3a2eaa7af5640051246da84297b9786df32

Analysis

max time kernel
140s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 22:24

Target
51c9a6f7f9a6823d3abb459506044f4e_JaffaCakes118.exe
Size 68KB
Sample240517-2bp6nsec93
SHA256 121a554eb125e86a98409c860facb3a2eaa7af5640051246da84297b9786df32
MD5 51c9a6f7f9a6823d3abb459506044f4e
SHA1 b4e4eea5bf80a85986cae92dee3dd48a2e0b8c47
SHA512 640a816a67f28a98ff06c9eb1e8581186416bd9d4262d099c75122ae3a8f8a44ec7842e473be1cabd964fdf88eb8bae2b9a51690e9054ba07116c5d170eba18a
SSDEEP 768:udMvKt1SfbbU8mfi/iS4t2cSFCCEFGdAGVU/HmfGJA7:8hSgGOSXEFGHFfF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

xor.base64

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
648	51c9a6f7f9a6823d3abb459506044f4e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\51c9a6f7f9a6823d3abb459506044f4e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\51c9a6f7f9a6823d3abb459506044f4e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3308

memory/648-2-0x0000000002210000-0x000000000221C000-memory.dmp

Download