guloader | 1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
Size 609KB
Sample260727-bkpndstycz
SHA256 1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab
MD5 17ae700cf861e07d94a5ef0422fca187
SHA1 c9f1e8c56848bf06e94788b922b9323f96eda4bd
SHA512 600ea27beab1702d509c8d2d5acfb448752cf2bdc4e050f51ff7ea1b0edb4bee81a7e77bb761708a02c9dae119a48fc1d08860538463de32e77763fee68020a1
SSDEEP 12288:QC3wdew5NKr6XviorEgLZJwXSzmC7ZKlB1m91:QAmewTW6fior/DCC7Z8B1
TLSH
T13BD4E0C2F14086E1EBDE1FF0187A9D6A43673D26C9A4064A7A46779A1FF3352603F907
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
1264	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
1264	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1264	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
1856	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1264 set thread context of 1856	1264	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe	89

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Stomachache191.dre	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1264	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1856	1264	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe	89
PID 1264 wrote to memory of 1856	1264	1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe	89

C:\Users\Admin\AppData\Local\Temp\1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
"C:\Users\Admin\AppData\Local\Temp\1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe
  "C:\Users\Admin\AppData\Local\Temp\1355a9f43795a3162b7cfd93d1e39cd4aba0b460fef572fced1c036473a222ab.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb916B.tmp\System.dll
Size 11KB
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
TLSH
T19A323918036442F3E5D5C83D186A3BAB5B28252196F08F53DFB39881FE386D66D39362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsg90ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg90ED.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsg90ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg90ED.tmp
Size 14B
SHA256 7a9d5de32c67cb645d31b7d278cee322b643f98342a2d3b350bef4477a806d1a
MD5 2f18f8f3b6d27674881e055d03e7e356
SHA1 7f6bb8aa1fa32dfb63b1da03d45c9aad694eeaf2
SHA512 8d9ee0a92f9a0b15213eab47d1cab60258bf34b82664b4744e130d23a7a28d895c687322ae670d04168e3897f31da50999ea12a2c7f730d22be1fc363ef13631
MD5 SHA1 SHA512

Submit Download

nsg90ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg90ED.tmp
Size 27B
SHA256 1628c6bee5afc85044309f45e34190bc9ce8bd9516e30792460e14362657d42d
MD5 b93641813851b1ad166b8163e5aeddc9
SHA1 642d989ceea62bcfd70fb74f3c62ade0c1c41d78
SHA512 eee31a0d51df3a7ba35ab4025f8d458c4d12b6f46412982ad34aef31d9e83c7070056a07777ed4b62fb3b92b376b618099374901ffe4f988fe0f853a0e57c8ec
MD5 SHA1 SHA512

Submit Download

nsg90ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg90ED.tmp
Size 70B
SHA256 ada9d1ffc0e78d2e2c05290b4ba1b1b04bc9c97a8f8e084ae0d49e36a9bb9c0c
MD5 f603843c4b1146c576a2c9e0826de265
SHA1 5de71ba33c20cfb74c19c706a4a44706d78fb102
SHA512 7a5a8ebc1c12193783ae711eb4716c1a2e52d1c4799dcd7f2a29924c246b1c665f456de3eaffd5e9cd7f42e788009e2798d1121c8d695698c86349bff17d5e8a
TLSH
T15FA00256358156A4FEC2C4711F65704CE59D303700C544032A4D48C89D45067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsg918B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg918B.tmp
Size 32B
SHA256 05ec837bf0f57ead1b3fae5bec24f103831be6946eda1fe4cec3700ae019b117
MD5 749841d5d4f33aa61da2072ca8c75d85
SHA1 ed779369af6004bb662353a1a1688de21c9d5964
SHA512 07884f39b2b1646dbad182d39167df36cb86fd3751b5c125b84ab3b3594dd0f6884d73f7f65d099e2874a0a73f8a76d7610b3ab30e174945a70073176e07b886
MD5 SHA1 SHA512

Submit Download

nsg918B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg918B.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsg9229.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg9229.tmp
Size 56B
SHA256 305d205c5c8358fd1d0f7639595c0146ca40dbafb8778f18cc1b3ee5624a483f
MD5 83126a76889a3e500ebe6fb3980d8e83
SHA1 b7fd539029137ecc3282984f3e055c5d021fc694
SHA512 6a003b75d705a1fa92da313bfc251f77db7b6c1b9043b036817ac95236b53f6408182495d18dc6bcd00b747176dc41e7298c397835772626f1072f5bad3be435
TLSH
T13090022915456A50B18AD8DA5C168A56D50865089C1B500246A965607455447440A540
MD5 SHA1 SHA512 TLSH

Submit Download

nsl91AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl91AB.tmp
Size 60B
SHA256 9388c79ab4c77b35f8c8ba134755b81640f6fb968c86e342379d58f5f489aa49
MD5 7edb517f32408f2981f8f1e511cee322
SHA1 3970ebd60dd0f56ec8b94dfe7309d3dcf2c5b2cf
SHA512 3f6f7943568949c44eb30d4f271875d0ddc13c6956e2fb8425fc115b7bde2df117508bc268f601d80acf0439a53c69c31e00e519f14899179f5f9b9bfc0f7569
TLSH
T1EFA0025A81814AF07647C42A6E36E135971DB9484D7614121BAD7A41B81314A4207109
MD5 SHA1 SHA512 TLSH

Submit Download

nsr9269.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr9269.tmp
Size 25B
SHA256 b06ac7eb718baa0f71c83a46cf55b5a1368d93fd3e2007fc6047b4854f3090fe
MD5 8862560e881d6575fee3adfb711d1c11
SHA1 b936ab218e307ea1dd7da7e3f3e0f727f15ee80d
SHA512 4ddd950a2da0b1c9fecf29fa48d1ac1847f4461bca2fc58f38d2af44657f810e07a8383878dc06a803d5ac77450f5fc90865551f7aea85b48ca97eb0022228b4
MD5 SHA1 SHA512

Submit Download

nsr9269.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr9269.tmp
Size 30B
SHA256 c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
MD5 f15bfdebb2df02d02c8491bde1b4e9bd
SHA1 93bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA512 1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
MD5 SHA1 SHA512

Submit Download

memory/1264-565-0x00000000053E0000-0x0000000007938000-memory.dmp

Download

memory/1264-566-0x00000000053E0000-0x0000000007938000-memory.dmp

Download

memory/1264-567-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/1264-576-0x00000000053E0000-0x0000000007938000-memory.dmp

Download

memory/1856-568-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/1856-569-0x00000000016F0000-0x0000000003C48000-memory.dmp

Download

memory/1856-570-0x00000000016F0000-0x0000000003C48000-memory.dmp

Download

memory/1856-571-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads