guloader | 1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
Size 609KB
Sample260713-dcqltsbv3j
SHA256 1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab
MD5 17ae700cf861e07d94a5ef0422fca187
SHA1 c9f1e8c56848bf06e94788b922b9323f96eda4bd
SHA512 600ea27beab1702d509c8d2d5acfb448752cf2bdc4e050f51ff7ea1b0edb4bee81a7e77bb761708a02c9dae119a48fc1d08860538463de32e77763fee68020a1
SSDEEP 12288:QC3wdew5NKr6XviorEgLZJwXSzmC7ZKlB1m91:QAmewTW6fior/DCC7Z8B1
TLSH
T13BD4E0C2F14086E1EBDE1FF0187A9D6A43673D26C9A4064A7A46779A1FF3352603F907
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
3148	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
3148	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3148	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
3440	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3148 set thread context of 3440	3148	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe	87

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Stomachache191.dre	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3148	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 3440	3148	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe	87
PID 3148 wrote to memory of 3440	3148	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe	87

C:\Users\Admin\AppData\Local\Temp\1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
"C:\Users\Admin\AppData\Local\Temp\1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
  "C:\Users\Admin\AppData\Local\Temp\1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsfCF2E.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsfCF2E.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsfCF2E.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsfCF2E.tmp
Size 33B
SHA256 0ca259e86b73dc8d2f375e3860b6bf91b78b3680b5b90c262fdd82432492a77a
MD5 5555876f2521b3ae2424dd9d6ce983aa
SHA1 5dd9296584980764dc0bebb55e721e6f9aacc86b
SHA512 71992459867bdb629a697d2f1e750390983fd752fe46f3c753eb0671d8e7498850320145b5662c714229cfcad6f0a2fbffac4c5a6ff40c87a90701bfa69763dd
MD5 SHA1 SHA512

Submit Download

nsfCF2E.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsfCF2E.tmp
Size 34B
SHA256 c9eb8d8cea8dd215bb20f4674c6b4b3ea865cc9390eb982c501af89142dfd95d
MD5 44faec7c0702b7ef4cda5820a608da0a
SHA1 10313d20436f6968228a07ad4dfad29f37e6532d
SHA512 dd2bf84c8609abd2f9acc8f45ead13f65f2f804cc2951774b857c0a86616d2a4656a88af4d8277e71bb3bf34afd065ed4dd62577f215f8e4b2f6683967db3a39
MD5 SHA1 SHA512

Submit Download

nsfCFCD.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsfCFCD.tmp
Size 60B
SHA256 9388c79ab4c77b35f8c8ba134755b81640f6fb968c86e342379d58f5f489aa49
MD5 7edb517f32408f2981f8f1e511cee322
SHA1 3970ebd60dd0f56ec8b94dfe7309d3dcf2c5b2cf
SHA512 3f6f7943568949c44eb30d4f271875d0ddc13c6956e2fb8425fc115b7bde2df117508bc268f601d80acf0439a53c69c31e00e519f14899179f5f9b9bfc0f7569
TLSH
T1EFA0025A81814AF07647C42A6E36E135971DB9484D7614121BAD7A41B81314A4207109
MD5 SHA1 SHA512 TLSH

Submit Download

nsgD06B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsgD06B.tmp
Size 37B
SHA256 5317519bef17b0fa9c8b9b59aab08934554184798b80da78fed07f2a820cf3c9
MD5 cb5c25d70ce1764ab7b7378e3e1a470a
SHA1 f58e7722175ab389ab3831945d31645cd0e6724a
SHA512 5e71e0ab35472e7fa1b45d328ddda4b03cb9ead1b21636451188cf124982739954c596f1becb759fcf20b500f6f8097957741ff755538cb3ea09ae67fa673d17
MD5 SHA1 SHA512

Submit Download

nsgD06B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsgD06B.tmp
Size 44B
SHA256 53e2b656e573d68d6661b655eeacfc266e0ad4fc3150913032d94fa119138354
MD5 be0c9715d9e29c252b754ed332457f48
SHA1 1db68d37f9d0b80ae44c8c240ea5dbdd93864040
SHA512 9860a10dfc462897f80a31363bdb0b841b6ab232a4be91ba57c1e89c795b76d87497b12888654be74e8a9f037f410d0e3b088ed937378e06eba1dbdc3b0e48ed
MD5 SHA1 SHA512

Submit Download

nsgD06B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsgD06B.tmp
Size 56B
SHA256 305d205c5c8358fd1d0f7639595c0146ca40dbafb8778f18cc1b3ee5624a483f
MD5 83126a76889a3e500ebe6fb3980d8e83
SHA1 b7fd539029137ecc3282984f3e055c5d021fc694
SHA512 6a003b75d705a1fa92da313bfc251f77db7b6c1b9043b036817ac95236b53f6408182495d18dc6bcd00b747176dc41e7298c397835772626f1072f5bad3be435
TLSH
T13090022915456A50B18AD8DA5C168A56D50865089C1B500246A965607455447440A540
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nslCF9D.tmp\System.dll
Size 11KB
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
TLSH
T19A323918036442F3E5D5C83D186A3BAB5B28252196F08F53DFB39881FE386D66D39362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsqCFBD.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsqCFBD.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsqD0AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsqD0AA.tmp
Size 30B
SHA256 c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
MD5 f15bfdebb2df02d02c8491bde1b4e9bd
SHA1 93bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA512 1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
MD5 SHA1 SHA512

Submit Download

memory/3148-565-0x0000000005410000-0x0000000007968000-memory.dmp

Download

memory/3148-566-0x0000000005410000-0x0000000007968000-memory.dmp

Download

memory/3148-567-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/3148-576-0x0000000005410000-0x0000000007968000-memory.dmp

Download

memory/3440-568-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/3440-569-0x00000000016F0000-0x0000000003C48000-memory.dmp

Download

memory/3440-570-0x00000000016F0000-0x0000000003C48000-memory.dmp

Download

memory/3440-571-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads