guloader | 53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
Size 485KB
Sample260727-fspqkshk21
SHA256 53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564
MD5 c84597aa4d5b05886c63028929a811bc
SHA1 9bba6cab2353e26957cbb60d34a9ac2d2cf02fad
SHA512 88736e4c1452a7a39b6d85d93b54488ff297578ec93138ab1c89aa27919c0b09eb3166acaee1e69f128b8407b099bfeef58a13eaecf54cb3575e74738cd291b0
SSDEEP 12288:Mfr9Ji2eibUKo7/0Bslgxo8oO8tbV+1DL:Mfr9JVxHQgxoLZ+V
TLSH
T1F3B4F10377C1D6EBD839433199AB83566776FD125B822B073348B71C6DB22921A4B78E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
5808	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
5808	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	drive.google.com
15	drive.google.com
29	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5808	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
4256	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\argonets\spankinger.ini	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\devow\fejlfrit.ini	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5808	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 4300	5808	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe	86
PID 5808 wrote to memory of 4256	5808	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe	87
PID 5808 wrote to memory of 4256	5808	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe	87
PID 4256 wrote to memory of 4536	4256	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe	91

C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
"C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
  "C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe"
  2⤵
  PID:4300
- C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
  "C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
    "C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe"
    3⤵
    PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsc8992.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsc8992.tmp
Size 60B
SHA256 1cbdbe394831ca0e5c7cb64d7eb474f5d76b5fbcae82f06c5dee5719c2b779fa
MD5 df312a6cdab89836cef927419cde2645
SHA1 341192989c2e3389ee64dca90dde5eb8a91d2b2b
SHA512 a0f9cd7a2bd9698760797674c01315c10ba95dcfa39a9a17ae84537f67c379e33fd60dfa0a0b6ed4c8e3a51a51155e98fed80809182a6e4eaa50e56cb837ca3a
TLSH
T1D5A0025D42816ED0364794266E35A128572D68494C7604121BED7591B96354E430755D
MD5 SHA1 SHA512 TLSH

Submit Download

nsh8A4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh8A4F.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nsm88E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm88E3.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsm88E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm88E3.tmp
Size 24B
SHA256 0717d3c2c8ad4b25752e43514cd4352de08c51bb9a8d153beb842dd421677b91
MD5 42e9d16f22a223f11084f22b94b42210
SHA1 7f4dcba6193c831687f6a1cac9b60231be8a6a1a
SHA512 a965c1381a0179e1bb1600fed3065741ebacc8c1e0a73db5d0db4eddbe5a45ec42cbd489a525d5c5151f52188daf367d0740e6555d9e41c1385a2fed4b7a6ec3
MD5 SHA1 SHA512

Submit Download

nsm88E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm88E3.tmp
Size 46B
SHA256 8bf4c616c9a55aafdc1a48ebdb11f8fbea6fb2465aa2f216e4efad6d540a1d99
MD5 46bc3b3f30f2703822d77228cf71c47f
SHA1 880c185810ea2b075648c9d0aac41487c8383059
SHA512 b8dd0e24989ee9acf9eb6b86dfb7f87d1d11f96458981170b7557aa1e26bb995a9ff785c8a98a54327ab12a7868d9c404b221e5f09e401d431dbb0120042946d
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm8932.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsm89D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm89D1.tmp
Size 24B
SHA256 3d42f06595afec189d9167ecf58d0da6c8294c155e9fc364d8fe8bdcdf25bc89
MD5 942a0add5de9c46c9874a72eba3ce9f6
SHA1 c51748200f0e8ff506ca5d9878573146be220491
SHA512 1813eba450ea8bb385b0da7ce4b54a196df7d8b8fb8e79ee9a8161aad31ba7e9e082a337e08c5f09aa19d48a19c1d3c20596893017f350dec28bab36b1366800
MD5 SHA1 SHA512

Submit Download

nsm89D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm89D1.tmp
Size 30B
SHA256 ad727ce745f959c78ea67f7d8f88f94d472f63c8e767907973c512f8e9bb629f
MD5 d72605426b740428d1d345dc47ca9df2
SHA1 458008bbc10687839c0f6cd00ba233f3210b2d73
SHA512 03717ae31475803f221324711041cad4f7c102104b0a51d2b867eaaea73a320d75ae7c1ae0c63d5ab1c65420f32a30c407c8aed67f4ce5d562910ced0b41b5d0
MD5 SHA1 SHA512

Submit Download

nsm89D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm89D1.tmp
Size 51B
SHA256 46930c50adaf9045504918511af5bc09319ee4333526bac9fb19b094788c32df
MD5 52de00a75d6326bb68af5638e42d59b2
SHA1 bf738c97d60f5e4be6570f669b7247ff0b99b517
SHA512 c7b3a2ba643d8b7bb109f366bb1a434102d79fe7ea19ba05f43f759698871061175a24d0dede0512f97c286ef0d8d98743655caa81b84a5c1d3bfbe1ef493b1a
TLSH
T1B290026415057E64B144F4A158358A05D4096408541A000106A5606076D288B801A948
MD5 SHA1 SHA512 TLSH

Submit Download

nsm89D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm89D1.tmp
Size 56B
SHA256 dd59afa8bca00d5e336ca22bd7a823b89f8a7bdd85a31b14aaf282eb0e3f06f7
MD5 89d89caae61e6b6f8a4befc57e0c70df
SHA1 4274b5ee303d7bdb8075d21d22080f622768c98a
SHA512 41706b58e18ee1c7a1b47894606709dd15229d05d800d9896de5a60c08cf1bdb0e89139c9ccbf90ba983067e063451f8bc18d3ac2562e5559cc54708d29b7ac3
TLSH
T1E190026816457E64F146F8E55C358A45D5096508581B000106A560A076D288B841A948
MD5 SHA1 SHA512 TLSH

Submit Download

nsr8952.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr8952.tmp
Size 50B
SHA256 6a3fde98ef05ef8b76bb66538de3e3e14b6d9928176532293645b0cb27325c9d
MD5 66232700b45a0cd2fca0b0ab4c15cf1d
SHA1 5b63ae813636c07f4de62f88425d23c3c75e024b
SHA512 f97a2e4779c99d335f4118b94dfb004c65efe5342c6fc75632bfa6f96ac14c5c35cd1adc11a7e5472dc22553e6151e109e2cca5694139eea6fa32e620c0c5054
TLSH
T19A90022306115E6978C7859348695555520A645599510495159409452542056CA8B285
MD5 SHA1 SHA512 TLSH

Submit Download

nsr8952.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr8952.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4256-564-0x00000000016E0000-0x00000000041DD000-memory.dmp

Download

memory/4256-565-0x00000000016E0000-0x00000000041DD000-memory.dmp

Download

memory/4256-566-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/5808-561-0x0000000004B80000-0x000000000767D000-memory.dmp

Download

memory/5808-562-0x0000000074155000-0x0000000074156000-memory.dmp

Download

memory/5808-563-0x0000000004B80000-0x000000000767D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads