guloader | ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
Size 366KB
Sample260801-qs1syszydv
SHA256 ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5
MD5 454d4e3e306cb450d303ad19ea19ddbc
SHA1 1c5e03fff10c126f51687c2aa5378e2033047782
SHA512 bf776e757a4d89407126d117174e50f55202bb5120f628f0f1cf37260206dc2f2b9fcc91b6b69176230e5b98ae811f9efdd68f850a6c0b9a3bb080fd2bfe4b20
SSDEEP 6144:a4t6LsCB7fXyMBDmJrmUdLvm/nM/BJM0AqkPLkX4WlpmEgihaA8aVr0Sq5y9GrVm:akCBLXy8mKAS/niM/PLaoi8I0STAtEX
TLSH
T1578412023E90C59BD4754271CAA5E5F679884EF4F72E8F4F0F503FADB872A064B0925A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
1756	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
1756	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
7	drive.google.com
12	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\hetaerocracy\Andenklasseskupes.gif	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1756	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
1560	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\bistre.lnk	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
File opened for modification	C:\Windows\resources\0409\amphirhine.ini	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1756	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1604	1756	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe	89
PID 1756 wrote to memory of 1560	1756	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe	90
PID 1756 wrote to memory of 1560	1756	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe	90
PID 1560 wrote to memory of 2628	1560	ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe	91

C:\Users\Admin\AppData\Local\Temp\ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
"C:\Users\Admin\AppData\Local\Temp\ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
  "C:\Users\Admin\AppData\Local\Temp\ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe"
  2⤵
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
  "C:\Users\Admin\AppData\Local\Temp\ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe
    "C:\Users\Admin\AppData\Local\Temp\ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5.exe"
    3⤵
    PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsi16DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi16DB.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi172A.tmp\System.dll
Size 11KB
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsi18B3.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi18B3.tmp
Size 56B
SHA256 5595cc8a0958a0b9f6dea067c987dcb785cf6307f3ad621647c8f0d14b90b719
MD5 bd07d39b7e8c12b89333375245c68b1d
SHA1 bbe2bd4a61f32a12e2bbe95e127e78e1d389ec11
SHA512 4a4384d27214b27339e3a6342dfbd17a878ae4c24bff95a6fd512888a16e68e106e29bd874d7ec51e1ee99fe082dab39ef8ede48d6e192af54dbe47fbadbf3e1
TLSH
T1A190022825456964E54EE9E54C154956910D6504595B40010669859071D58878456A44
MD5 SHA1 SHA512 TLSH

Submit Download

nsj1903.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsj1903.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nso1884.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso1884.tmp
Size 60B
SHA256 a74447d2e4554b8ea226a2f566d36258a6bbd8e282d662efbec206d70cc65205
MD5 de2d97cfc13c78657dc3d16a0c0b5995
SHA1 1b13e38241208cad806b168688daf8d33791cf86
SHA512 60055879c24166884b59e5c74650455049f4e3595b8fa20e50012a11c256ca1db501a82290c47eefae18345acc329cb40a78b9513ec40ced0a6654df0d9019b6
TLSH
T1D4A00219518149E02A4795265E31A126535D78444DB604125BAC9A41B49714E4243659
MD5 SHA1 SHA512 TLSH

Submit Download

nst1854.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst1854.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1560-564-0x0000000001770000-0x0000000003590000-memory.dmp

Download

memory/1560-569-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/1560-570-0x0000000001770000-0x0000000003590000-memory.dmp

Download

memory/1756-562-0x0000000005880000-0x00000000076A0000-memory.dmp

Download

memory/1756-563-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/1756-565-0x0000000005880000-0x00000000076A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads