guloader | 0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
Size 362KB
Sample260608-lgedcsb18s
SHA256 0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05
MD5 d31531ad3901eff5eede6243a9975daf
SHA1 d9acef1c5f9ed1cdbd609a3999806f55d85e3293
SHA512 5ce2c6fa460038ce891799fec95a914dd66a6ad5ad7226b2578b8b4008d54377b30998e80621faffc385d81a70f7cd9971d701ac20b0c19c961797f566e5b526
SSDEEP 6144:94t6LsCB7fXyMBDmJJm2DVe8JccHMQBOAmnFuy6UCEoWQ9:9kCBLXy8mJm2DvrROuyIWQ9
TLSH
T1FF8412163F64C55BC0B14272DA6AE6F632549DF1CBAE8F0F1E403E1DF9712418E1E26A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
2356	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
2356	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\hetaerocracy\Andenklasseskupes.gif	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2356	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
1560	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\bistre.lnk	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
File opened for modification	C:\Windows\resources\0409\amphirhine.ini	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2356	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 908	2356	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe	79
PID 2356 wrote to memory of 1560	2356	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe	80
PID 2356 wrote to memory of 1560	2356	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe	80
PID 1560 wrote to memory of 2204	1560	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe	81

C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
"C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
  "C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe"
  2⤵
  PID:908
- C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
  "C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
    "C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe"
    3⤵
    PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nse502F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nse502F.tmp
Size 66B
SHA256 cc1c32ae1abcb46fd4871832a8b7a51a440905d97709c53e66d16a0cd33276ee
MD5 3a055708070979e7bf5088d9471320ba
SHA1 cb4e803ae05765ee43787cbd3abb91166bbf8fd7
SHA512 3f3b5c9c1fdca9e76fda76ff601d11320b4866ee0b0358b014699e33be79252cb94390fb589fa5099b68d00491a207f3fe6223b955a5a4be6f1df1b389fd613e
TLSH
T17DA00256358156A4FEC2C4711F65700CE59D303600C544032A4D48889D45067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nse502F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nse502F.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nse5081.tmp

Path C:\Users\Admin\AppData\Local\Temp\nse5081.tmp
Size 56B
SHA256 e873a8c20fc5c95b338d32bb41b6a2e60722139f77cd644b097f0c8e8299b915
MD5 cfd37b6babb08bef640cff9e8ca63f57
SHA1 6ba0c3b84ea05591a48262f84f25bf31b1d360a5
SHA512 325043f052545538dcab716acb576bd5975fea9827c9a79f8f840ad1052cbe95dcc9aa6903dc885a8d3e8cd1dcabc63e8920c8aa7f729668a11c9e66466091c1
TLSH
T15890022819856D65E146E9F54C118A49910D65085C1B011906654494796158BC457586
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk5050.tmp\System.dll
Size 11KB
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsk5051.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsk5051.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsp50C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsp50C1.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nsz5061.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsz5061.tmp
Size 60B
SHA256 2da2e60d0848bcf167b2ea344577fc8355b5ee9a1cd78f956871b435952d8b9b
MD5 3a446bd2489aec83bdd13eb0df5ba2f2
SHA1 cf3bbc33619b9431fc9917062759c775ab5b0a95
SHA512 3d4b2d6a32fad705c3c24ffc5587dd757f9e1f54b6a9a6f2856ae221f5de44580edffab70794b6f79113d642fb54a467bb2bb8c84e5bd9fe4048997a739d89f4
TLSH
T1FAA0021941C14DE1A64785365E31A228531D684D4C76052A1BAD5945BC1324F828319B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1560-576-0x0000000000480000-0x0000000001797000-memory.dmp

Download

memory/1560-577-0x00000000017A0000-0x0000000003634000-memory.dmp

Download

memory/2356-562-0x0000000004DE0000-0x0000000006C74000-memory.dmp

Download

memory/2356-563-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/2356-564-0x0000000004DE0000-0x0000000006C74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads