guloader | 092ee9258cae9bbe4f3c7fc08d672ea2d1c96af6f95a19b66ce31c40dd805a78

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Oferta HOM 344210922_SP_10_22_2021.exe
Size

112KB
MD5

5fac9245b7fae38433da73da3b54698a
SHA1

23c2bdd3f2b8117c5b3f144c8e3218058b44a1f4
SHA256

e03eae0b9428b7da5f1011e80c47094bd5191f69696fa2d0fd90ec7d8fe4ea85
SHA512

769b02b27ee17b52e24f9d69f2589c9cde65e2015a7b61678e5b7c7349b516dcf9e8f6324e29b6d3db8b582552d67753c52bbdec30b47dbb601c59259488d2eb
SSDEEP

1536:M8YaaNys/DQblWLHS/czIOYZGBKjMZht8flRu3i9fVzba2QPX2f:n1Eys/8mSyIO8Qt8tXzVS

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oferta HOM 344210922_SP_10_22_2021.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2548	Oferta HOM 344210922_SP_10_22_2021.exe

C:\Users\Admin\AppData\Local\Temp\Oferta HOM 344210922_SP_10_22_2021.exe
"C:\Users\Admin\AppData\Local\Temp\Oferta HOM 344210922_SP_10_22_2021.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-2-0x00000000002E0000-0x00000000002F4000-memory.dmp

Filesize
80KB

Download