guloader | e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/03/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe
Size 242KB
Sample260306-slde7ahs8n
SHA256 e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810
MD5 ac0e44d9ae12d9fb5184e7d092b32fd3
SHA1 2153ebdedda177192a35d4b1a49d6da6e47f6b40
SHA512 5aadedf0334395bbd59bb04f974b343f290cf3c14d36215b655de0a5d4aea3d87a574812445a56ef60aba6cf5d0362ac588a308192937d928a6853a0dd5ea19b
SSDEEP 6144:+cBvWb0yCv3l1Om9LuIjfEBzRzT4beuo3LlCN0i:LO0TPOqLF7KRzT4qTi
TLSH
T17F341216A270D487E571133099BB96BA9EE6FB2314B15B8F3FF4AF1C7C15360592A013
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 1 IoCs

pid	Process
8	e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
8	e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5564	5896	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
8	e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 5488	8	e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe	79
PID 8 wrote to memory of 5896	8	e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe	80
PID 8 wrote to memory of 5896	8	e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe	80

C:\Users\Admin\AppData\Local\Temp\e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe
"C:\Users\Admin\AppData\Local\Temp\e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe
  "C:\Users\Admin\AppData\Local\Temp\e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe"
  2⤵
  PID:5488
- C:\Users\Admin\AppData\Local\Temp\e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe
  "C:\Users\Admin\AppData\Local\Temp\e332eea4b6dc0e3623dc1aa6d33db82bec7264b4308b2d2d60f04feb8c4ce810.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 192
    3⤵
    - Program crash
    PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5896 -ip 5896
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk6BD5.tmp\System.dll
Size 12KB
SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
MD5 12b140583e3273ee1f65016becea58c4
SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
TLSH
T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-11-0x0000000004DA0000-0x0000000006B2B000-memory.dmp

Download

memory/8-12-0x0000000074B55000-0x0000000074B56000-memory.dmp

Download

memory/8-14-0x0000000004DA0000-0x0000000006B2B000-memory.dmp

Download

memory/5896-13-0x0000000000400000-0x0000000001717000-memory.dmp

Download

memory/5896-15-0x0000000001720000-0x00000000034AB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads