guloader | 53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
Size 485KB
Sample260727-fspqkshk21
SHA256 53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564
MD5 c84597aa4d5b05886c63028929a811bc
SHA1 9bba6cab2353e26957cbb60d34a9ac2d2cf02fad
SHA512 88736e4c1452a7a39b6d85d93b54488ff297578ec93138ab1c89aa27919c0b09eb3166acaee1e69f128b8407b099bfeef58a13eaecf54cb3575e74738cd291b0
SSDEEP 12288:Mfr9Ji2eibUKo7/0Bslgxo8oO8tbV+1DL:Mfr9JVxHQgxoLZ+V
TLSH
T1F3B4F10377C1D6EBD839433199AB83566776FD125B822B073348B71C6DB22921A4B78E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
5336	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
5336	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	drive.google.com
1	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5336	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
4956	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\argonets\spankinger.ini	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\devow\fejlfrit.ini	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5336	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 3284	5336	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe	90
PID 5336 wrote to memory of 4956	5336	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe	91
PID 5336 wrote to memory of 4956	5336	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe	91
PID 4956 wrote to memory of 4464	4956	53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe	92

C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
"C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
  "C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe"
  2⤵
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
  "C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe
    "C:\Users\Admin\AppData\Local\Temp\53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564.exe"
    3⤵
    PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsdB184.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsdB184.tmp
Size 62B
SHA256 fcc0de8ebc57a00f3f48bc8ba2e93cedc7efe9ecc9600ad63cdd1ba1d6c4fdea
MD5 903e0572b61353c5e9e2f94582bd26d9
SHA1 bf6d18b2607a519c4486e845921b7070e53cb8eb
SHA512 3857e85783aa8af1cd075e91729bfd471c3df9d93d944501bf8bd663df9ad1348ee9d81403505851d468beaea9a3ac0ad6799eb4b2e328176c27d32cdf206b94
TLSH
T159A0025635814664FE82C4711B65700CE59D302600C544031A4D44485D05067CA0B5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nsdB184.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsdB184.tmp
Size 68B
SHA256 860e81e337b378b1d03c4f9205ef876d901e44758d7068a43f7d80eaec9c59aa
MD5 acc8e2dc8ef177e828af296be96c6a4e
SHA1 7cc55fd8ac9beeedff4b42acbe7a99d0559f178c
SHA512 ba120dda31785f9ff6d9c4ba55eee99c8c0fffa7cc84afac054387da49dd5085e454996a4acd9018cfb4eea887e7610b6265533b9be8bbb2c5063ed071bb9e33
TLSH
T110A00256358156A4FEC2C4711F65700CE59D303700C544032A4D48889D45067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsdB184.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsdB184.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nseB223.tmp

Path C:\Users\Admin\AppData\Local\Temp\nseB223.tmp
Size 11B
SHA256 714144b6001dc56c1d3286dfd64909ca592a11aec7fdab9d290397d5393ab8f6
MD5 9b198a2aaf063ff060bb24b6fa5bb5df
SHA1 90b3670750dba26a0a1015b9403232ab9d4dd07e
SHA512 840d6d9f4db234e94aefb8b82a0ae406a22aba078ace2199d61a21d7e06190c44a38e2d5857f117de8b2019d90d382d1ce4f17204925951374f34d47fd99b1f7
MD5 SHA1 SHA512

Submit Download

nseB223.tmp

Path C:\Users\Admin\AppData\Local\Temp\nseB223.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nseB2C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nseB2C1.tmp
Size 16B
SHA256 0c09cbcf0803dc2c44739757d37fe7f33fa193d747df71db3172e68aa0ddb309
MD5 1a069d3d8cca839a3c2f44a0e833d67c
SHA1 2bdc93e3d3aac0914cd4d3d43210bc2b2c7f09cf
SHA512 970ed67a84e4132b0336cd8f7c07c4ab6dc56ce97993b64e4e94a80e76ee7bd4ca04349cd0113df5e04053fbfde9d27c3cb5ab61a9492d584b7febfcaddf53e2
MD5 SHA1 SHA512

Submit Download

nseB2C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nseB2C1.tmp
Size 56B
SHA256 dd59afa8bca00d5e336ca22bd7a823b89f8a7bdd85a31b14aaf282eb0e3f06f7
MD5 89d89caae61e6b6f8a4befc57e0c70df
SHA1 4274b5ee303d7bdb8075d21d22080f622768c98a
SHA512 41706b58e18ee1c7a1b47894606709dd15229d05d800d9896de5a60c08cf1bdb0e89139c9ccbf90ba983067e063451f8bc18d3ac2562e5559cc54708d29b7ac3
TLSH
T1E190026816457E64F146F8E55C358A45D5096508581B000106A560A076D288B841A948
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoB1C4.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nszB253.tmp

Path C:\Users\Admin\AppData\Local\Temp\nszB253.tmp
Size 60B
SHA256 1cbdbe394831ca0e5c7cb64d7eb474f5d76b5fbcae82f06c5dee5719c2b779fa
MD5 df312a6cdab89836cef927419cde2645
SHA1 341192989c2e3389ee64dca90dde5eb8a91d2b2b
SHA512 a0f9cd7a2bd9698760797674c01315c10ba95dcfa39a9a17ae84537f67c379e33fd60dfa0a0b6ed4c8e3a51a51155e98fed80809182a6e4eaa50e56cb837ca3a
TLSH
T1D5A0025D42816ED0364794266E35A128572D68494C7604121BED7591B96354E430755D
MD5 SHA1 SHA512 TLSH

Submit Download

nszB33F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nszB33F.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

memory/4956-563-0x0000000001770000-0x000000000426D000-memory.dmp

Download

memory/4956-576-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/4956-577-0x0000000001770000-0x000000000426D000-memory.dmp

Download

memory/5336-561-0x0000000005800000-0x00000000082FD000-memory.dmp

Download

memory/5336-562-0x00000000741F5000-0x00000000741F6000-memory.dmp

Download

memory/5336-564-0x0000000005800000-0x00000000082FD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads