guloader | 764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe
Size 902KB
Sample260831-lefhms1xes
SHA256 764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9
MD5 7dbd18b2a990191dd8236f130f51ce02
SHA1 74bda1fcc348468755f64a8d08d4ee101429d993
SHA512 a09c728f40e9dc9bc14952e47b1ecb3375fb33fb2acc69ee0eeeba7d24e3c7b6c3ee46f9a6613b47bcd1da75ce3872eb10e9858388b35c128fa225638dfd4ed5
SSDEEP 24576:zA7FU3luueOOLdPmlMeBEFmNZpJGSqQc3DKtbPik+G:zDJeOOLZmrDHVSKtTik+G
TLSH
T104152398F335831FE866D7B088694660DB74EEAC358A630F334971563CA32DA85253FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4856	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe
4856	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
9	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4856	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe
5776	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\slagterknive\kofferdammens.ini	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4856	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4264	4856	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe	89
PID 4856 wrote to memory of 5776	4856	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe	90
PID 4856 wrote to memory of 5776	4856	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe	90
PID 5776 wrote to memory of 1964	5776	764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe	91

C:\Users\Admin\AppData\Local\Temp\764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe
"C:\Users\Admin\AppData\Local\Temp\764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe
  "C:\Users\Admin\AppData\Local\Temp\764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe"
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe
  "C:\Users\Admin\AppData\Local\Temp\764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Users\Admin\AppData\Local\Temp\764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe
    "C:\Users\Admin\AppData\Local\Temp\764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9.exe"
    3⤵
    PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsp4156.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsp4156.tmp
Size 16B
SHA256 ccaabed14663822955f3eed5f5ebac067cbb8c0ff9734a67d30fb94a14826237
MD5 433fcfa8e075cbbb3370cb2f6c4658da
SHA1 c7926411bd50f5556bfbea60e7d81931e1aad868
SHA512 1306f8e4430ed4e981b775409e14d7f927aa630c2bf89b42949fd9ba11b6aceaba61d2bebc925ebc4a7fb4ac2f9add8677f2f579b591639c0b5950fa68f64ee0
MD5 SHA1 SHA512

Submit Download

nsp4156.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsp4156.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp4157.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsp4292.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsp4292.tmp
Size 56B
SHA256 6e9d95ca09af1a66c51f1e0c9082bcd6df2c5fbab8e88a2aad01794c4b40e3d7
MD5 016ec52e71fa0415ca6124dd0729ca10
SHA1 80525fd16bdf190cae4063fd99dc9e7cbfd7ba48
SHA512 30cd8cbc604a6ed4d9d1cd1b0ba29aa600a608bf59b1473e804bdee4e88209f511b6c9f501b4f3953cfc741c95b70e970f7232e96b0684737e9afc1333e632af
TLSH
T1BF9002241545A964E246F9E94D214945D50A7524A82F00020669419072415CBD456A45
MD5 SHA1 SHA512 TLSH

Submit Download

nsp42E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsp42E1.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nsu4213.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu4213.tmp
Size 30B
SHA256 35dad955ee2ccfe66eb80d670721acf7f83915f1204f07d449aace9c9ca1f2e3
MD5 f7bcbbddb5cb20fdfce72f842cacabe1
SHA1 031c00c0eb114ed2234679c39cb34fdbb9debfb3
SHA512 2bdb271d96cece4289dec71c02b30a64e509e1e93f25168fd78c72b8197937cc398df0ece30dabc2253129621b8108ed38fa9b2ced12e70ff3f9c5f8ae7b0b29
MD5 SHA1 SHA512

Submit Download

nsu4213.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu4213.tmp
Size 41B
SHA256 7938b90dbe50e63bd3bc2b7ae77d43ba7c01c15354ab01f9a0b63ebac56b796d
MD5 088d509592627d226179707a88a1f4ee
SHA1 8c03f8a469d4dc4e7f65da8daa8c0e9cdebbe9f4
SHA512 f36c70cbb4dbb09a8081b472ceb712b983a676d5a34dc19ec4d0d95126c4e6b80cdd66640e304eb35445503255c9aac22edf386bf6782151844e8df4e1874d5f
MD5 SHA1 SHA512

Submit Download

nsu4213.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu4213.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsu4262.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu4262.tmp
Size 60B
SHA256 2091f81f87e16454a79d4388c140795e8a6a103e66024309cd0ea4ec5577e206
MD5 6a4d45c91429ecedc3f2def07df17075
SHA1 9c2eaf0e6f7da17c41391e3be4d135be9b5fc9cf
SHA512 250d3c78c985b548787d8fc89bbc6a711aebffa18c34ffdde259a4af4ac5a9f5baae51f3080b365136e04d76155e040c77f8ef02bd124ea4d5aaf92db42a68e3
TLSH
T19BA0022A418589D0A747952A5F31A128572A78549C7A04131BAC5A41B51328ED34365A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4856-572-0x0000000005120000-0x0000000007D5E000-memory.dmp

Download

memory/4856-573-0x00000000741F5000-0x00000000741F6000-memory.dmp

Download

memory/5776-574-0x0000000001770000-0x00000000043AE000-memory.dmp

Download

memory/5776-581-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/5776-582-0x0000000001770000-0x00000000043AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads