guloader | 5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3

Analysis

max time kernel
164s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
Size 870KB
Sample260727-gaptashm7v
SHA256 5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3
MD5 cc4fb917fe90ef34c9dcf83a2cde79b6
SHA1 246040d62d917037865d3576fa71081d44448d89
SHA512 edb738ab7e0a5b16b4c6b2444053b3aefe66dec077a5deab90468a0ec20c56c8034e7900332338a4fdfe5e174436bd0758e11e9b46a84d98eaa11087d582f0b8
SSDEEP 24576:zA7FRBJNy4YDnYYlMeBEFmNZpJGSqQc3DKtbPik+k:zKwNnYYrDHVSKtTik+k
TLSH
T14F152369F334431FD866D371C87A4750CBBCAD58754AA20F7349B2A53CA32DA46203EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
1520	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
1520	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
11	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1520	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
6100	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\slagterknive\kofferdammens.ini	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1520	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 5692	1520	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	88
PID 1520 wrote to memory of 6100	1520	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	89
PID 1520 wrote to memory of 6100	1520	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	89
PID 6100 wrote to memory of 2756	6100	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	90

C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
"C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
  2⤵
  PID:5692
- C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
    "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
    3⤵
    PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsd1716.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd1716.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nse17B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nse17B5.tmp
Size 29B
SHA256 bc36be7d14b14449488cca7eba4d4cc436151549024e79840b8fbf1fc0a9bedd
MD5 6eb2e5f62010394f3d4f027d13697ae2
SHA1 e4a3db3848e1559cda44b8ecd6de89c4c0ac45a5
SHA512 c7f6f73e5b169579f2985b24f761ce3d5204e0cb178739c901c4aa45e18e4efe8e639e94d20f1ed3a817a7be54bf732c9138131ad5d6937e69375f2dbbeda02f
MD5 SHA1 SHA512

Submit Download

nse17B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nse17B5.tmp
Size 56B
SHA256 7cad29d65ae87af0c0a39e44dac126deb031b527afc48189ca77cd3d645e4e03
MD5 999289eb620046a9c67a3815f38dcb10
SHA1 c32398c7b17cbb564db5b2a17ed6e6cac85ca623
SHA512 d99ab8abac7257e89a41102928dc9798cb6b46d2449bbbd91063f9a15fe6d40b160976b78fe16b29e23c1351493b3d4aede97aad681c8b6fe001cc7151fffd62
TLSH
T14690022855456978E156ECE64C514985910975045C2B0415066548907EA14878456555
MD5 SHA1 SHA512 TLSH

Submit Download

nsj1737.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsj1737.tmp
Size 60B
SHA256 ae831a08a89f3b9fe28364d313a864d7b39a4132d7baa2579d024316defcab2e
MD5 1c6ad31a182818c434e3e4b571870fa0
SHA1 5ba018d9cb74eea5b903f0883c9d99d21d782bdd
SHA512 c7ac0af5a6d40248dc69acf3eb51fe69df96340dd173f5bbfca2f83f65b7ccf3eace21c8843b66cca089c9dfe14b6a4c27fce99e28645f23ea9bd5693b005298
TLSH
T130A00219818149E4A65788275E71A164531978454C7708261BAC5D41BD5314E429316A
MD5 SHA1 SHA512 TLSH

Submit Download

nsj1737.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsj1737.tmp
Size 46B
SHA256 8c526955a636954fd606cc8f2810782d132100b34e058cd195af7e3e7bad09e9
MD5 6b750347f8d3944c4d315e0c74539bb2
SHA1 a8cb18ecfc5ff23d2a657973694f8433ea149d33
SHA512 61e201100d36b8bbf189bbf97a74ccbbad35e58fc9d5e201ea077aa95901f8d2850d08c5ff9170522b30b0d7791c3acc1572a4003b20b95df625a20e340f59e9
MD5 SHA1 SHA512

Submit Download

nsj1823.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsj1823.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nst1688.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1688.tmp
Size 58B
SHA256 9b9b769252e232ac369f61922b79f5656a4f4d744e39114bd389d0a56469ce3f
MD5 0b29799f668498e44f469590f92136a6
SHA1 477022e40d3b1f1f06f5e6c0404450af702db6eb
SHA512 d987b05f4085bc9d3640e496f002e068649a2859f0aa6c538de03ffac0f766dc0009a6f532809e579655ad5677a150834447670fb2774d1bdd33b70542ff3ef9
TLSH
T18AA0025635814654FD82C4711B657008E59D302600C544031A4D44485D05067CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nst1688.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1688.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nst1688.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1688.tmp
Size 29B
SHA256 3f1b5b4bbb2d866c8c62ef732346f0dd6843cbdb2aed403f041509d0657c8b77
MD5 7bcf80ed4b7586485d227a08e4b7686b
SHA1 75f83d3b2fd6fc16fe54abf43839bc0512ca0046
SHA512 1bc1e78b73c49ffb095dbcced9b53a1403b253a22517441ab9db1aa720ffab2a2d36222c83c1773934157324201e769fa3b109fa620c3992a6488e9a79486bb2
MD5 SHA1 SHA512

Submit Download

nst1688.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1688.tmp
Size 18B
SHA256 b271abd85535886a3753ee0a5e8957a1bf2e502c4a275d1d8f7f5ddf3b7de292
MD5 1a42166fa1e8a360271d4fb25c78fbda
SHA1 f4d1ad6ecdc1202a2c08c03514ec814072b818d2
SHA512 ee3342a9a407bfe56e7c65c1f1c0b15624fbffc60c88ff9e404a1dbebcfd606f42de8cb61624f992f57fca2e05d75a64611a78e508c7772ffaeb9c5924c87c0c
MD5 SHA1 SHA512

Submit Download

nst1688.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1688.tmp
Size 31B
SHA256 d12006a59b2bcda77dc8bb9ffb174cdfc818c355a30c8a42fb16d13c0558ad63
MD5 5e884655c8f5685c77e96ab751afcc46
SHA1 438e7927bcb8633ab39b9e3b7dd7511e5806a93b
SHA512 85c0174ee0d2bddc85d60fe340e409730825fd7b7d15a4456de500f8befcfbc6f47e6c84333f4649eef97d2ced0cc132d1395de744999117125b92abbf42b51b
MD5 SHA1 SHA512

Submit Download

nst1688.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1688.tmp
Size 57B
SHA256 80eb66b392cf670bb4afede5a57488fc9e9166f9a8c492f290d150c834e1e6aa
MD5 0b66f70a086797e3c9d810089c376755
SHA1 aa9a99dcae2c50513922413999a555bc89af69b1
SHA512 83461cf2e760708cbdf9a083594c63f55e4b2d90166d5ba3b3f06e1e35e3b9be2c6d1a97da5b7ac04a444d4c6ab04da11adf8a0a1a268597c1e6f3022c8445f1
TLSH
T11F90025635814654F982C4711B657008E59D302600C544031A4D44485D05067CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst1689.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-572-0x0000000005150000-0x00000000073FE000-memory.dmp

Download

memory/1520-573-0x00000000745C5000-0x00000000745C6000-memory.dmp

Download

memory/6100-574-0x0000000001770000-0x0000000003A1E000-memory.dmp

Download

memory/6100-584-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/6100-585-0x0000000001770000-0x0000000003A1E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads