guloader | 98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2025, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
Size 629KB
Sample250509-qf89kawkt9
SHA256 98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51
MD5 1dcb58d1e0db0fe9edfa71c89f09b1d8
SHA1 e201c843b39538d0f42e3ac3490f2a0038d16493
SHA512 99560dad5c18e99b530d284fbf001d3b24082bdfc20da18b48b9db83f5958259cdfd5b9572ccf1914357f59473766472fc19c039eb38d4941bfe43dc288ad7c6
SSDEEP 12288:gTAHY+hwvIGqltvoCKCpaD5Sa7niMtZMobimoLzNK4nr0LL9sXAWhHY:gTAHY+eWb2EaGOMucLpK00Lz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader persistence upx

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Executes dropped EXE 1 IoCs

pid	Process
4788	Ordlistehaandteringernes.exe

Loads dropped DLL 5 IoCs

pid	Process
4188	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
4188	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
4788	Ordlistehaandteringernes.exe
4788	Ordlistehaandteringernes.exe
2916	Ordlistehaandteringernes.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\stormwind = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Udenrigsministeriers\\Ordlistehaandteringernes.exe"	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\stormwind = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Udenrigsministeriers\\Ordlistehaandteringernes.exe"	Ordlistehaandteringernes.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4644	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
2916	Ordlistehaandteringernes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4188	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
4644	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
4788	Ordlistehaandteringernes.exe
2916	Ordlistehaandteringernes.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4644-122-0x0000000000400000-0x0000000001654000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ordlistehaandteringernes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ordlistehaandteringernes.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4188	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
4788	Ordlistehaandteringernes.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4644	4188	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe	91
PID 4188 wrote to memory of 4644	4188	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe	91
PID 4188 wrote to memory of 4644	4188	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe	91
PID 4188 wrote to memory of 4644	4188	98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe	91
PID 4816 wrote to memory of 4788	4816	cmd.exe	94
PID 4816 wrote to memory of 4788	4816	cmd.exe	94
PID 4816 wrote to memory of 4788	4816	cmd.exe	94
PID 4788 wrote to memory of 2916	4788	Ordlistehaandteringernes.exe	97
PID 4788 wrote to memory of 2916	4788	Ordlistehaandteringernes.exe	97
PID 4788 wrote to memory of 2916	4788	Ordlistehaandteringernes.exe	97
PID 4788 wrote to memory of 2916	4788	Ordlistehaandteringernes.exe	97

C:\Users\Admin\AppData\Local\Temp\98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
"C:\Users\Admin\AppData\Local\Temp\98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe
  "C:\Users\Admin\AppData\Local\Temp\98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:4644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Udenrigsministeriers\Ordlistehaandteringernes.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\Udenrigsministeriers\Ordlistehaandteringernes.exe
  C:\Users\Admin\AppData\Local\Temp\Udenrigsministeriers\Ordlistehaandteringernes.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Users\Admin\AppData\Local\Temp\Udenrigsministeriers\Ordlistehaandteringernes.exe
    C:\Users\Admin\AppData\Local\Temp\Udenrigsministeriers\Ordlistehaandteringernes.exe
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60
MD5 e192462f281446b5d1500d474fbacc4b
SHA1 5ed0044ac937193b78f9878ad7bac5c9ff7534ff
SHA512 cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3
MD5 SHA1 SHA512

Submit Download

608E140C9B0467F1F4DCA75A33391588

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\608E140C9B0467F1F4DCA75A33391588
Size 344B
SHA256 e30a3ac6a151f6675c92fa798b618d740770f84054ae36287682da0fc409bb87
MD5 6d9d5fe01aa8860e8ee9d8b6726544a0
SHA1 ceaa54ee7340f8cd2a3482cce7389d9877f81b1b
SHA512 422151a11d7bbfa91e2f542d79a0f34c0966072ec215548ea291e8f6ab1201340b1ceb9e5ee5fa8c2301f93149604ddff7d0c525bb3b877b4020c222fa604301
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6fb658aa0566e3634c91aa26746d97dc9b9dfba55cc7b3901f929e57b39da818
MD5 4d1d9d39ae2b9183f3575f764bed7e10
SHA1 e6d82284b2f8cf11c8afa50d5eef0c2d40ae36b8
SHA512 0fc0d43598ce79b7b5a3e5b9c46218a9b441da6c7edc216e335476783d6e27a16fe64634657c18102e8944fe3550f70c1b49b09b0a49ed90a052934c7ed10dfa
MD5 SHA1 SHA512

Submit Download

608E140C9B0467F1F4DCA75A33391588

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\608E140C9B0467F1F4DCA75A33391588
Size 540B
SHA256 65d3b2316a1ba63ab3493e9b692f72074d6c2c268fab1570002fbcde67e6a502
MD5 edef5068f92aad0cfaf9bbe0df69b4e3
SHA1 ef13b5030f1e7639295395f9875ec651639821ca
SHA512 c22c15395ae43c3306c2e7464ee514154aa60522814187e58efcde4eeb65a2a6a84575564f5c8a7a95e238ccc6a0de88bd78255fa787271680d0b84544278ed9
MD5 SHA1 SHA512

Submit Download

Smreolien.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Czigany\Smreolien.txt
Size 689B
SHA256 3594ef22aa077eeb70f58aabf26b679c2e1fff8c5b2cf6d2979347f0d617d235
MD5 22cc5217b80a5b862c9b686055b96e24
SHA1 e67f6e38d502d25d43c847325a3bf4fb29eddda7
SHA512 cf3c4d49dfa8d73a5243c133c5b7e236b71ee28419091c7a3f785405c31f675c406cf7c3afb9857e3ab5ab92e8ad9ca8a4fae27fde7783f627f4c68424d84b7b
MD5 SHA1 SHA512

Submit Download

Kondicyklens.ini

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Kondicyklens.ini
Size 569B
SHA256 56bc9f09b772f036cb8be49e2364e58c4631ee80cc1f2387d00e2eb01b491ac5
MD5 00c244716ea3c3ec1ff8e36445efb76f
SHA1 eec587339d988b460c1172be49c412d6658986bc
SHA512 c8fae7f3825a6f304cba11b10c4279522dfb27f20f00474063ddc5b9f9e4bc56d3dc742343ab1cedab959381101ba7a16cb11300a6b45be81081a1cadb198302
MD5 SHA1 SHA512

Submit Download

indskydninger.ini

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\naadestdenes\Splitninger\indskydninger.ini
Size 552B
SHA256 88dfeadecf5d56ba8c8d5c9eede688c822db089c3025d2d2089365731e086b63
MD5 d4054a42c705a82d1ecc6531c747f07f
SHA1 061569184e7fba3fa410712e5126faaef8c071cb
SHA512 4b8541637ab10e6feb4ac0e5606d090901874b88d09f29ff3035a805c64d593d6c4fb501944ce1f3e6a42917f6f987536a296700274907ab278773d0b6c70295
MD5 SHA1 SHA512

Submit Download

ufoer.che

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\naadestdenes\Splitninger\ufoer.che
Size 106KB
SHA256 b4c9c900b6906c8d0c118e2ee47fd58853de752dd0b6e4b70dd74a3b8d09e9a3
MD5 0c815fb84d0bbd22a44f835d084aceae
SHA1 6c9d8a1dedaa49288db400944e52669ab9842b81
SHA512 bd2dc42c43432e64edceb859681564283ece515abe1cb1152846efe8b58a2bd79acd7da4392eb49e7e69d8b4522834cd55fd6df7649ac693b8119f3f9fa60f9a
SSDEEP 384:EdfN4072wpWCzIEQdCgh6phfB4eeIcG7M:8407RIEQopBB4evW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ordlistehaandteringernes.exe

Path C:\Users\Admin\AppData\Local\Temp\Udenrigsministeriers\Ordlistehaandteringernes.exe
Size 629KB
SHA256 98feb7e5d2cdff3351f0bf47d2dfb7f0a3f7d0f637626a153ca6216c3a541e51
MD5 1dcb58d1e0db0fe9edfa71c89f09b1d8
SHA1 e201c843b39538d0f42e3ac3490f2a0038d16493
SHA512 99560dad5c18e99b530d284fbf001d3b24082bdfc20da18b48b9db83f5958259cdfd5b9572ccf1914357f59473766472fc19c039eb38d4941bfe43dc288ad7c6
SSDEEP 12288:gTAHY+hwvIGqltvoCKCpaD5Sa7niMtZMobimoLzNK4nr0LL9sXAWhHY:gTAHY+eWb2EaGOMucLpK00Lz
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh7E78.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmc.ini

Path C:\Users\Admin\AppData\Local\Temp\tmc.ini
Size 27B
SHA256 bddcbc9f6e35e10fa203e176d28cdb86ba3add97f2cffd2bda7a335b1037b71d
MD5 7ab6006a78c23c5dec74c202b85a51a4
SHA1 c0ff9305378be5ec16a18127c171bb9f04d5c640
SHA512 40464f667e1cdf9d627642be51b762245fa62097f09d3739bf94728bc9337e8a296ce4ac18380b1aed405adb72435a2cd915e3bc37f6840f34781028f3d8aed6
MD5 SHA1 SHA512

Submit Download

memory/2916-127-0x0000000001660000-0x0000000006393000-memory.dmp

Download

memory/2916-131-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/2916-139-0x0000000001660000-0x0000000006393000-memory.dmp

Download

memory/4188-42-0x0000000073E55000-0x0000000073E56000-memory.dmp

Download

memory/4188-41-0x0000000077201000-0x0000000077321000-memory.dmp

Download

memory/4188-40-0x0000000077201000-0x0000000077321000-memory.dmp

Download

memory/4644-46-0x0000000077201000-0x0000000077321000-memory.dmp

Download

memory/4644-45-0x0000000077288000-0x0000000077289000-memory.dmp

Download

memory/4644-122-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/4644-124-0x0000000077201000-0x0000000077321000-memory.dmp

Download

memory/4644-126-0x0000000077201000-0x0000000077321000-memory.dmp

Download

memory/4644-43-0x0000000001660000-0x0000000006393000-memory.dmp

Download

memory/4644-44-0x0000000000400000-0x0000000001654000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads