guloader | 5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
Size 870KB
Sample260703-xge6faew2t
SHA256 5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3
MD5 cc4fb917fe90ef34c9dcf83a2cde79b6
SHA1 246040d62d917037865d3576fa71081d44448d89
SHA512 edb738ab7e0a5b16b4c6b2444053b3aefe66dec077a5deab90468a0ec20c56c8034e7900332338a4fdfe5e174436bd0758e11e9b46a84d98eaa11087d582f0b8
SSDEEP 24576:zA7FRBJNy4YDnYYlMeBEFmNZpJGSqQc3DKtbPik+k:zKwNnYYrDHVSKtTik+k
TLSH
T14F152369F334431FD866D371C87A4750CBBCAD58754AA20F7349B2A53CA32DA46203EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
708	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
708	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
708	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
2760	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\slagterknive\kofferdammens.ini	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
708	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 5260	708	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	88
PID 708 wrote to memory of 2760	708	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	89
PID 708 wrote to memory of 2760	708	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	89
PID 2760 wrote to memory of 2036	2760	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	90

C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
"C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:708
- C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
  2⤵
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
    "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
    3⤵
    PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsiB17.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiB17.tmp
Size 56B
SHA256 7cad29d65ae87af0c0a39e44dac126deb031b527afc48189ca77cd3d645e4e03
MD5 999289eb620046a9c67a3815f38dcb10
SHA1 c32398c7b17cbb564db5b2a17ed6e6cac85ca623
SHA512 d99ab8abac7257e89a41102928dc9798cb6b46d2449bbbd91063f9a15fe6d40b160976b78fe16b29e23c1351493b3d4aede97aad681c8b6fe001cc7151fffd62
TLSH
T14690022855456978E156ECE64C514985910975045C2B0415066548907EA14878456555
MD5 SHA1 SHA512 TLSH

Submit Download

nsnB37.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnB37.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nss92F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nss92F.tmp
Size 65B
SHA256 2bad3065546719b1e5ff58cb7ca6231b6cb669fb1fd06fb30102e9df00d63e60
MD5 1bd5509d17a385dbcebec5b71de8dffc
SHA1 9d70c3f205dddda5e33e5de97c0a09feb6836130
SHA512 ca43f9d62ad2c3b950b816274869a1c0bd22b77bbb80fc810783ef23b9317362132fb2f29510bb51f4d00940d8c9038b5700560b6f1e38722b2e65037c148bbf
TLSH
T188A00256358156A4FEC2C4711F65700CE59D303600C544032A4D48489D05067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nss92F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nss92F.tmp
Size 5B
SHA256 ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
MD5 e2fecc970546c3418917879fe354826c
SHA1 63f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA512 3c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
MD5 SHA1 SHA512

Submit Download

nss92F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nss92F.tmp
Size 43B
SHA256 e57e26e68b9ee25d136d2b440e28ffc09be1233efac52ec2f050c098a7e8090c
MD5 11598c9bea98b902fd23f62d92e2c755
SHA1 5abf26b3891bde2c11143deac679d44d5af7dde4
SHA512 aa6045bade9bee63b80e2822d1e17ed4186202c8ba840af93f4d14dad4a2d32790e1ffd7448b4cbc8b92891967174cf70a54d2aa5957f3b266da7bb61d8f6b7c
MD5 SHA1 SHA512

Submit Download

nss92F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nss92F.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss930.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsxA88.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsxA88.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsyAD8.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsyAD8.tmp
Size 60B
SHA256 ae831a08a89f3b9fe28364d313a864d7b39a4132d7baa2579d024316defcab2e
MD5 1c6ad31a182818c434e3e4b571870fa0
SHA1 5ba018d9cb74eea5b903f0883c9d99d21d782bdd
SHA512 c7ac0af5a6d40248dc69acf3eb51fe69df96340dd173f5bbfca2f83f65b7ccf3eace21c8843b66cca089c9dfe14b6a4c27fce99e28645f23ea9bd5693b005298
TLSH
T130A00219818149E4A65788275E71A164531978454C7708261BAC5D41BD5314E429316A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/708-572-0x0000000005000000-0x00000000072AE000-memory.dmp

Download

memory/708-573-0x0000000073CF5000-0x0000000073CF6000-memory.dmp

Download

memory/2760-574-0x0000000001770000-0x0000000003A1E000-memory.dmp

Download

memory/2760-580-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/2760-581-0x0000000001770000-0x0000000003A1E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads