guloader | 5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
Size 870KB
Sample260831-lapkragk9s
SHA256 5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3
MD5 cc4fb917fe90ef34c9dcf83a2cde79b6
SHA1 246040d62d917037865d3576fa71081d44448d89
SHA512 edb738ab7e0a5b16b4c6b2444053b3aefe66dec077a5deab90468a0ec20c56c8034e7900332338a4fdfe5e174436bd0758e11e9b46a84d98eaa11087d582f0b8
SSDEEP 24576:zA7FRBJNy4YDnYYlMeBEFmNZpJGSqQc3DKtbPik+k:zKwNnYYrDHVSKtTik+k
TLSH
T14F152369F334431FD866D371C87A4750CBBCAD58754AA20F7349B2A53CA32DA46203EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
1284	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
1284	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
9	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1284	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
4720	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\slagterknive\kofferdammens.ini	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1284	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 5296	1284	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	90
PID 1284 wrote to memory of 4720	1284	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	91
PID 1284 wrote to memory of 4720	1284	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	91
PID 4720 wrote to memory of 4652	4720	5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe	92

C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
"C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
  2⤵
  PID:5296
- C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
  "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe
    "C:\Users\Admin\AppData\Local\Temp\5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3.exe"
    3⤵
    PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc86DC.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsi88D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi88D4.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nsm86CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm86CB.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsm86CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm86CB.tmp
Size 44B
SHA256 d02310dee3ced92a0be280296fb733c94858c06d62a6eb7fe22cdd38f3fe8ae5
MD5 a11292439456c3877dd223273f88ce2f
SHA1 cbde8e81b850762530c0d960a82eda5ca399e538
SHA512 e4cc180decc607ff549be52de094226d8f2080124fe2e3391a371ab5293294373d910a17f8578dce50ab5e8b20061913f6c378b7258f599a6d9d8ff968f61e7d
MD5 SHA1 SHA512

Submit Download

nsm8806.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm8806.tmp
Size 60B
SHA256 ae831a08a89f3b9fe28364d313a864d7b39a4132d7baa2579d024316defcab2e
MD5 1c6ad31a182818c434e3e4b571870fa0
SHA1 5ba018d9cb74eea5b903f0883c9d99d21d782bdd
SHA512 c7ac0af5a6d40248dc69acf3eb51fe69df96340dd173f5bbfca2f83f65b7ccf3eace21c8843b66cca089c9dfe14b6a4c27fce99e28645f23ea9bd5693b005298
TLSH
T130A00219818149E4A65788275E71A164531978454C7708261BAC5D41BD5314E429316A
MD5 SHA1 SHA512 TLSH

Submit Download

nsr8788.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr8788.tmp
Size 23B
SHA256 6f470f6196119f505cd2d1b132c50c06fd6522bbd6ffc95b992212093221b637
MD5 8c367f7037d83ec5fc0be4bcd16dba9d
SHA1 0efc8b29b482afae9aaceef0d80a138ab9b527a9
SHA512 356e4ee6b5572b174084957b61e2aaea850486e2c087b87019bcb7565013d86aadffdc1f3e70ec4c77be108519ce312a2db1896584a738d631c190c03f5fec56
MD5 SHA1 SHA512

Submit Download

nsr8788.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr8788.tmp
Size 30B
SHA256 35dad955ee2ccfe66eb80d670721acf7f83915f1204f07d449aace9c9ca1f2e3
MD5 f7bcbbddb5cb20fdfce72f842cacabe1
SHA1 031c00c0eb114ed2234679c39cb34fdbb9debfb3
SHA512 2bdb271d96cece4289dec71c02b30a64e509e1e93f25168fd78c72b8197937cc398df0ece30dabc2253129621b8108ed38fa9b2ced12e70ff3f9c5f8ae7b0b29
MD5 SHA1 SHA512

Submit Download

nsr8788.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr8788.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsx8846.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx8846.tmp
Size 56B
SHA256 7cad29d65ae87af0c0a39e44dac126deb031b527afc48189ca77cd3d645e4e03
MD5 999289eb620046a9c67a3815f38dcb10
SHA1 c32398c7b17cbb564db5b2a17ed6e6cac85ca623
SHA512 d99ab8abac7257e89a41102928dc9798cb6b46d2449bbbd91063f9a15fe6d40b160976b78fe16b29e23c1351493b3d4aede97aad681c8b6fe001cc7151fffd62
TLSH
T14690022855456978E156ECE64C514985910975045C2B0415066548907EA14878456555
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1284-572-0x0000000005000000-0x00000000072AE000-memory.dmp

Download

memory/1284-573-0x0000000073B85000-0x0000000073B86000-memory.dmp

Download

memory/1284-575-0x0000000005000000-0x00000000072AE000-memory.dmp

Download

memory/4720-574-0x0000000001770000-0x0000000003A1E000-memory.dmp

Download

memory/4720-582-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/4720-583-0x0000000001770000-0x0000000003A1E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads