guloader | 1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
Size 495KB
Sample260727-cb9gwagh85
SHA256 1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a
MD5 1e00cdfab8f0c96ff7c511d3dbaf2c75
SHA1 e913d3ea7d8289c02d2c111043d93d9a539711fc
SHA512 9cea21f3a734bc7f488fd88c95a17aefc22dedff6978a71c3a31d2cd3ed981203fcedfd290de5573f414278cc9a0178d3f6368f08747d3294dd007968334c67e
SSDEEP 12288:5TA+Q4ew5hJduOwhDvTdU1EpDaY+6Vt0SGZNu49ezMgIa:5TAP4ea8N7haY+kuu8eAgIa
TLSH
T159B422111391D079CD52227952367BFDAEF53C606435970F6BE03E2A3AB0B42ED1EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
6032	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
6032	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
8	drive.google.com
13	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
6032	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
360	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\cablet\formlingen.ini	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
File opened for modification	C:\Windows\resources\0409\Sleyed\bortelimeneres.htm	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
File created	C:\Windows\resources\Feverously\cigarettnderens.lnk	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
File opened for modification	C:\Windows\Fonts\klys\radiostationers.gif	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
6032	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 352	6032	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe	89
PID 6032 wrote to memory of 360	6032	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe	90
PID 6032 wrote to memory of 360	6032	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe	90
PID 360 wrote to memory of 3676	360	1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe	91

C:\Users\Admin\AppData\Local\Temp\1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
"C:\Users\Admin\AppData\Local\Temp\1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Users\Admin\AppData\Local\Temp\1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
  "C:\Users\Admin\AppData\Local\Temp\1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe"
  2⤵
  PID:352
- C:\Users\Admin\AppData\Local\Temp\1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
  "C:\Users\Admin\AppData\Local\Temp\1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:360
- - C:\Users\Admin\AppData\Local\Temp\1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe
    "C:\Users\Admin\AppData\Local\Temp\1f718cbbd49a4acdb460945eb74a04fe48173802dd4ad1b05873dc63a0839b0a.exe"
    3⤵
    PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsa5D1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsa5D1F.tmp
Size 10B
SHA256 a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
MD5 9a53fc1d7126c5e7c81bb5c15b15537b
SHA1 e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA512 b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
MD5 SHA1 SHA512

Submit Download

nsa5D1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsa5D1F.tmp
Size 30B
SHA256 ad727ce745f959c78ea67f7d8f88f94d472f63c8e767907973c512f8e9bb629f
MD5 d72605426b740428d1d345dc47ca9df2
SHA1 458008bbc10687839c0f6cd00ba233f3210b2d73
SHA512 03717ae31475803f221324711041cad4f7c102104b0a51d2b867eaaea73a320d75ae7c1ae0c63d5ab1c65420f32a30c407c8aed67f4ce5d562910ced0b41b5d0
MD5 SHA1 SHA512

Submit Download

nsa5D1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsa5D1F.tmp
Size 52B
SHA256 e03e71e9145930b84c3754dcc9d2627c46099c2c6605da022c51553306cd221c
MD5 415ae85034873d2491b6cf1c817b09bd
SHA1 4028285a43a6699c1c148f29b21c76009f1d961a
SHA512 66ad87ca8585628fbee60bdd3890de99a803645456f894d62e66b1abf0a21b37bef9969ebd15486bb36ae27ace150763252794f0b8d7362a049af5288345a5d9
TLSH
T10B90026014497968B549E4A58C154995901D6404541A4006276541D076434878466944
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse5A7B.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsf5C53.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsf5C53.tmp
Size 1B
SHA256 8254c329a92850f6d539dd376f4816ee2764517da5e0235514af433164480d7a
MD5 8ce4b16b22b58894aa86c421e8759df3
SHA1 13fbd79c3d390e5d6585a21e11ff5ec1970cff0c
SHA512 2af8a9104b3f64ed640d8c7e298d2d480f03a3610cbc2b33474321ec59024a48592ea8545e41e09d5d1108759df48ede0054f225df39d4f0f312450e0aa9dd25
MD5 SHA1 SHA512

Submit Download

nsf5C53.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsf5C53.tmp
Size 2B
SHA256 8e5202705183bd3a20a29e224499b0f77a8273ee33cd93cca71043c57ad4bdfc
MD5 25bc6654798eb508fa0b6343212a74fe
SHA1 15d5e1d3b948fd5986aaff7d9419b5e52c75fc93
SHA512 5868c6241ed3cfcc5c34bfe42e4b9f5c69e74975e524771d8c9f35cafc13fd01cd943ec4d8caefee79a1f4a457e69d20b7a86f88db83a5bc3e6bd8a619972898
MD5 SHA1 SHA512

Submit Download

nsf5C53.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsf5C53.tmp
Size 5B
SHA256 ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
MD5 e2fecc970546c3418917879fe354826c
SHA1 63f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA512 3c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
MD5 SHA1 SHA512

Submit Download

nsf5C53.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsf5C53.tmp
Size 7B
SHA256 639b68bd180b47d542dd001d03557ee2d5b3065c3c783143bc9fb548f3fd7713
MD5 67cfa7364c4cf265b047d87ff2e673ae
SHA1 56e27889277981a9b63fcf5b218744a125bbc2fa
SHA512 17f28a136b20b89e9c3a418b08fd8e6fcaac960872dc33b2481af2d872efc44228f420759c57724f5d953c7ba98f2283e2acc7dfe5a58cbf719c6480ec7a648b
MD5 SHA1 SHA512

Submit Download

nsf5C53.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsf5C53.tmp
Size 19B
SHA256 2ba412a038068300e9e4a538ed1d2cfcefa9a1b91f44408785d90a5d838a9228
MD5 adfb82dfa0a66bd7e108a83873cbd4cf
SHA1 caaf90327bb1e7b6731e154351f351bf3a3bb1c4
SHA512 103f484f3497eaf8cc231f09a5c565ba524d5af523970272d9a853ede106fc176f524bb6aeb8f7f59992e7a5651abb55b80134d539bb050aaf780624422d982b
MD5 SHA1 SHA512

Submit Download

nsf5C53.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsf5C53.tmp
Size 27B
SHA256 92bbc71aa04b34f3d6666861e615244db3d3be6f1287b3947115ea9d0e98a5d7
MD5 a4fef08db3bf7402436db287f01bb2fc
SHA1 66c9356fcc83fdda2e04821fa06ab8bee4f26720
SHA512 3da695803076c9b338d9fac3d9da91ac8e0f8b4fb28665ad175325684a5688e83f56bff62766d99583ea9b2a0e394ad64f4fff3fc45b3fe154e6b4026ef7a44a
MD5 SHA1 SHA512

Submit Download

nsg5DDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg5DDC.tmp
Size 14B
SHA256 97e5daf6f20df9ce038a539d8bcf4d7b9efc1058102c9ce7ce1e6e169200672c
MD5 67bb7ef976d4ce39058a22b6174a0e72
SHA1 9be7c1328a129dfa8fbda22b646e803ff262c5ef
SHA512 12192b1718b77b437b383bca40335944b6bcaa772ccd398eb4b92a5b7882e3159a65470141fb98d7911f96bd97d46e93955302a9f5a19059ebcaa2c1a3f915e1
MD5 SHA1 SHA512

Submit Download

nsg5DDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg5DDC.tmp
Size 22B
SHA256 89870b6b02e2247d1e10942aceede7bf4adeb820bae945b77d0e2c5f5669e514
MD5 38f296e431f9e889c855110f746a1a1f
SHA1 a1f2212648b7d681e10a295ca270ec6ef9c7cb2a
SHA512 a074bd4debd9aa11fc50c3ab1cd5b1aaf365931d790600818ea51a58bfca6ea17feb872a1a11dfd8542cd5e1798bdf171e4305e81e4a409a0253db31c84b91e9
MD5 SHA1 SHA512

Submit Download

nsp5BA6.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsp5BA6.tmp
Size 9B
SHA256 ae789a65914ed002efb82dad89e5a4d4b9ec8e7faae30d0ed6e3c0d20f7d3858
MD5 2b3884fe02299c565e1c37ee7ef99293
SHA1 d8e2ef2a52083f6df210109fea53860ea227af9c
SHA512 aeb9374a52d0ad99336bfd4ec7bb7c5437b827845b8784d9c21f7d96a931693604689f6adc3ca25fad132a0ad6123013211ff550f427fa86e4f26c122ac6a0fe
MD5 SHA1 SHA512

Submit Download

nsp5BA6.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsp5BA6.tmp
Size 11B
SHA256 714144b6001dc56c1d3286dfd64909ca592a11aec7fdab9d290397d5393ab8f6
MD5 9b198a2aaf063ff060bb24b6fa5bb5df
SHA1 90b3670750dba26a0a1015b9403232ab9d4dd07e
SHA512 840d6d9f4db234e94aefb8b82a0ae406a22aba078ace2199d61a21d7e06190c44a38e2d5857f117de8b2019d90d382d1ce4f17204925951374f34d47fd99b1f7
MD5 SHA1 SHA512

Submit Download

nsu5A8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu5A8C.tmp
Size 70B
SHA256 ada9d1ffc0e78d2e2c05290b4ba1b1b04bc9c97a8f8e084ae0d49e36a9bb9c0c
MD5 f603843c4b1146c576a2c9e0826de265
SHA1 5de71ba33c20cfb74c19c706a4a44706d78fb102
SHA512 7a5a8ebc1c12193783ae711eb4716c1a2e52d1c4799dcd7f2a29924c246b1c665f456de3eaffd5e9cd7f42e788009e2798d1121c8d695698c86349bff17d5e8a
TLSH
T15FA00256358156A4FEC2C4711F65704CE59D303700C544032A4D48C89D45067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsu5A8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu5A8C.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsu5A8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu5A8C.tmp
Size 61B
SHA256 706dc879eaaeee6ada053cfd98acedee299c07a8dc98f0cc024cc614057c38b6
MD5 74b3a93cf5d11d11b8dff1d5ec57a81d
SHA1 bc7da5a65649e99c488e6a4c130f1134e80dcf74
SHA512 bef3b9fa70eec9ecb57ccc75bb54a5a76e1a0c4a8387823f7c931f091a1157bea4e678e19fcc775a7ee1c43d025d09e8ae4869b4c785dc7f8c4de39cf9bd7d82
TLSH
T18EA0025635814664FD82C4711B65700CE59D302600C544031A4D44485D05067CA0B5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nsu5A8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu5A8C.tmp
Size 48B
SHA256 46cc3e4da899bd4967072208983b1cc3f7bbfdac794a908d90e14f8dc97dd780
MD5 db255f53108568593d80f2b9196f73d5
SHA1 e00bde519e33311332599680b51d6c4bdda77f8f
SHA512 5b1032ca47c32dd2d23230ad83b1ccd2f74139b7c2da086140c93896f56cc65345c25f57cd54427e5786b4cb3ec675ad10184c8018a0e11118a580a1b3c68e87
MD5 SHA1 SHA512

Submit Download

nsu5A8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu5A8C.tmp
Size 59B
SHA256 5745e24f1d2217560ffd59274adb500eb2b350a3fcc86cda4e6181fbe4f96ece
MD5 42d9107b0a7dcefc04b2f720704232c6
SHA1 c1d191f3c1f96b4d587f76a5335bd52a53521748
SHA512 9b2d770cccc6966625fc63e6c8eb4410a35d656710494851ab4f5f6e94427819b1197370b54be88ad1f4fed76fe7a005e03314a87e69d6876940c8c0eacc5904
TLSH
T101A0025635814654FD82C4711B65700CE59D302600C544031A4D44485D05067CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/360-567-0x00000000772BF000-0x00000000772C0000-memory.dmp

Download

memory/360-568-0x000000007727D000-0x000000007727E000-memory.dmp

Download

memory/360-569-0x0000000077345000-0x0000000077346000-memory.dmp

Download

memory/360-573-0x0000000001770000-0x000000000226C000-memory.dmp

Download

memory/360-574-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/360-575-0x0000000077345000-0x0000000077346000-memory.dmp

Download

memory/6032-565-0x0000000073F45000-0x0000000073F46000-memory.dmp

Download

memory/6032-566-0x00000000050E0000-0x0000000005BDC000-memory.dmp

Download

memory/6032-564-0x00000000050E0000-0x0000000005BDC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads