guloader | 22cc3722d70e28656f0e553613b91cdfa806adcc132ef8dcdce60be7266e32fe | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 00:51

Sharing

Report Analysis Logs

General

Target

Selvfinansiering.exe
Size

124KB
MD5

7e4344fe8ab1388aa953c85658a6802b
SHA1

f1ca7460b212b5c83c5ff867b266d8e941cf5dbf
SHA256

4f150ed4669f3a26cfbb6cf06c9843de3bf2a619de4807053512502ef983a3b2
SHA512

2209449a2994627604380dae69b9972754190c29930170be63dcaeea36c2ddcd175631c3014e3e4274059a54606b95e8e20ae32d5cb612aeb91d563c52eb2d2d
SSDEEP

1536:IGpFzrNUgXMJkD5SR5IzR3TUrLk6joOhHf9B6HvcN1QpVx2JSHa/gX+:1p1NUIMDcNDAtoOhHT1Hz

Score

10^/10

guloader downloader guloader

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1KNgfBcxtyoDcrj3vTkeTjr-gnQjw04N2

xor.base64

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Guloader payload 1 IoCs
guloader

Processes:

resource yara_rule

behavioral1/memory/2784-2-0x0000000000350000-0x000000000035B000-memory.dmp family_guloader
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Selvfinansiering.exe

pid process

2784 Selvfinansiering.exe

C:\Users\Admin\AppData\Local\Temp\Selvfinansiering.exe
"C:\Users\Admin\AppData\Local\Temp\Selvfinansiering.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2784

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-2-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/2784-3-0x0000000077BC1000-0x0000000077CC2000-memory.dmp

Filesize
1.0MB

Download