guloader | 0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05

Analysis

max time kernel
179s
max time network
177s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
Size 362KB
Sample260727-avfmsstcpa
SHA256 0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05
MD5 d31531ad3901eff5eede6243a9975daf
SHA1 d9acef1c5f9ed1cdbd609a3999806f55d85e3293
SHA512 5ce2c6fa460038ce891799fec95a914dd66a6ad5ad7226b2578b8b4008d54377b30998e80621faffc385d81a70f7cd9971d701ac20b0c19c961797f566e5b526
SSDEEP 6144:94t6LsCB7fXyMBDmJJm2DVe8JccHMQBOAmnFuy6UCEoWQ9:9kCBLXy8mJm2DvrROuyIWQ9
TLSH
T1FF8412163F64C55BC0B14272DA6AE6F632549DF1CBAE8F0F1E403E1DF9712418E1E26A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
3084	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
3084	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
13	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\hetaerocracy\Andenklasseskupes.gif	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3084	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
2988	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\bistre.lnk	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
File opened for modification	C:\Windows\resources\0409\amphirhine.ini	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3084	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 1720	3084	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe	90
PID 3084 wrote to memory of 2988	3084	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe	91
PID 3084 wrote to memory of 2988	3084	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe	91
PID 2988 wrote to memory of 920	2988	0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe	92

C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
"C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
  "C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe"
  2⤵
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
  "C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe
    "C:\Users\Admin\AppData\Local\Temp\0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05.exe"
    3⤵
    PID:920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsdB051.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsdB051.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nshAE96.tmp

Path C:\Users\Admin\AppData\Local\Temp\nshAE96.tmp
Size 46B
SHA256 8bf4c616c9a55aafdc1a48ebdb11f8fbea6fb2465aa2f216e4efad6d540a1d99
MD5 46bc3b3f30f2703822d77228cf71c47f
SHA1 880c185810ea2b075648c9d0aac41487c8383059
SHA512 b8dd0e24989ee9acf9eb6b86dfb7f87d1d11f96458981170b7557aa1e26bb995a9ff785c8a98a54327ab12a7868d9c404b221e5f09e401d431dbb0120042946d
MD5 SHA1 SHA512

Submit Download

nshAE96.tmp

Path C:\Users\Admin\AppData\Local\Temp\nshAE96.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsiAF35.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiAF35.tmp
Size 30B
SHA256 35dad955ee2ccfe66eb80d670721acf7f83915f1204f07d449aace9c9ca1f2e3
MD5 f7bcbbddb5cb20fdfce72f842cacabe1
SHA1 031c00c0eb114ed2234679c39cb34fdbb9debfb3
SHA512 2bdb271d96cece4289dec71c02b30a64e509e1e93f25168fd78c72b8197937cc398df0ece30dabc2253129621b8108ed38fa9b2ced12e70ff3f9c5f8ae7b0b29
MD5 SHA1 SHA512

Submit Download

nsiAF35.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiAF35.tmp
Size 34B
SHA256 ba493b1e2704c417662224230bffa2effae24f9fbf8c56a7bcb93ac02bc2abd9
MD5 2a9c98ea1aa7a05604ab51073fcd45c7
SHA1 3f970ebeb4f5ef40f8bb1e16d64ab410c3af3962
SHA512 fe999f6186c4bb20113cfdddba193cf777941a9ce223f0c6d8f85dc5e2668df6f820922d7b75f255ec2d5355f1881f3867686363f4c5f630ffa8b48b079d7647
MD5 SHA1 SHA512

Submit Download

nsiAF35.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiAF35.tmp
Size 41B
SHA256 7938b90dbe50e63bd3bc2b7ae77d43ba7c01c15354ab01f9a0b63ebac56b796d
MD5 088d509592627d226179707a88a1f4ee
SHA1 8c03f8a469d4dc4e7f65da8daa8c0e9cdebbe9f4
SHA512 f36c70cbb4dbb09a8081b472ceb712b983a676d5a34dc19ec4d0d95126c4e6b80cdd66640e304eb35445503255c9aac22edf386bf6782151844e8df4e1874d5f
MD5 SHA1 SHA512

Submit Download

nsiAF35.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiAF35.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsiAF84.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiAF84.tmp
Size 13B
SHA256 20ed8777c986040dba3187aab791c6df6f87f42c3002b15bcc8bfa9718d842e8
MD5 1783e9a8f74ea827208a35b5a8c0c0b4
SHA1 68913138931e5d1cdf495708cf86d082454dc6cf
SHA512 8da8702b8e97de4d9cd9c294574e10363e34f3cf7796b1e2c78be543a482472922be3d75a716c67b63a291b898528531c132553ef20174ea99eb3bd37ac3608b
MD5 SHA1 SHA512

Submit Download

nsiAF84.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiAF84.tmp
Size 22B
SHA256 d7c42493656ae25d5a3ff0b7fa739e43557d2c54a82833c8782ddbe8d364816d
MD5 1a976b081f77c04dad951286222ed3da
SHA1 1fd2c47eab6b8b5ee42fee2f8238bd065881d99d
SHA512 e087d4f397761e3525241f2610f8be1bd46533905fc0bf39435127e1341c1f4c21fc1d2f1b213d78b0505d8bafbc4f797b85537601a0f186850457d3d2847a23
MD5 SHA1 SHA512

Submit Download

nsiAF84.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsiAF84.tmp
Size 60B
SHA256 2da2e60d0848bcf167b2ea344577fc8355b5ee9a1cd78f956871b435952d8b9b
MD5 3a446bd2489aec83bdd13eb0df5ba2f2
SHA1 cf3bbc33619b9431fc9917062759c775ab5b0a95
SHA512 3d4b2d6a32fad705c3c24ffc5587dd757f9e1f54b6a9a6f2856ae221f5de44580edffab70794b6f79113d642fb54a467bb2bb8c84e5bd9fe4048997a739d89f4
TLSH
T1FAA0021941C14DE1A64785365E31A228531D684D4C76052A1BAD5945BC1324F828319B
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnAF05.tmp\System.dll
Size 11KB
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nssAFC3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nssAFC3.tmp
Size 44B
SHA256 fdc89c19e53d618f2337b51a54029f6c650eae3e579793eaf8bee7b73484ec5c
MD5 9fd06712553f3c75a7ee042e0d13d0b1
SHA1 06e0b5494d371983965c51efd3f7d80e316e1a98
SHA512 da5c09c1eff2d73e5e6ddb20a741a3fbeb3b3e8aed6167904ddf081c0c348c8d92b5c9a29576f4024368d1da2f10d4a948f94dc7371e9c6802ba759e08f64637
MD5 SHA1 SHA512

Submit Download

nssAFC3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nssAFC3.tmp
Size 56B
SHA256 e873a8c20fc5c95b338d32bb41b6a2e60722139f77cd644b097f0c8e8299b915
MD5 cfd37b6babb08bef640cff9e8ca63f57
SHA1 6ba0c3b84ea05591a48262f84f25bf31b1d360a5
SHA512 325043f052545538dcab716acb576bd5975fea9827c9a79f8f840ad1052cbe95dcc9aa6903dc885a8d3e8cd1dcabc63e8920c8aa7f729668a11c9e66466091c1
TLSH
T15890022819856D65E146E9F54C118A49910D65085C1B011906654494796158BC457586
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2988-564-0x0000000001770000-0x0000000003604000-memory.dmp

Download

memory/2988-574-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/2988-575-0x0000000001770000-0x0000000003604000-memory.dmp

Download

memory/3084-562-0x00000000057F0000-0x0000000007684000-memory.dmp

Download

memory/3084-563-0x0000000010004000-0x0000000010005000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads