guloader | eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe
Size 377KB
Sample260910-ml8nfavwds
SHA256 eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494
MD5 68314300282538b57e579cf46c86f04d
SHA1 d6cb264d67c62fe9c09881cd5ce9ce2272524f30
SHA512 ca3d2f90c7d82a25118c13adb7324b805f41969d9f36346098d8c7c531b4fe373145636b6516388d519b5f709d510b382cbd8c228a87c337eb9dd70ea652d59a
SSDEEP 6144:aXFKo5ClMKn912RmsFhHAJJlPNzOPTLTlEn2pVoCb19cLWVVXuwWp:aXE2dHAJJlVzKvC24CbrcLqgwWp
TLSH
T131849E14A795C81DC69016BA5A739FD805ACAE027A5CCDA362D03DBD24F4EF198CE1CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4308	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe
4308	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4308	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	2740	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4308	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3528	4308	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe	89
PID 4308 wrote to memory of 2740	4308	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe	90
PID 4308 wrote to memory of 2740	4308	eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe	90

C:\Users\Admin\AppData\Local\Temp\eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe
"C:\Users\Admin\AppData\Local\Temp\eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe
  "C:\Users\Admin\AppData\Local\Temp\eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe"
  2⤵
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe
  "C:\Users\Admin\AppData\Local\Temp\eb5017dae273276b1f5b0ee19b3adaa510227597115d8075a86147e71f28a494.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 452
    3⤵
    - Program crash
    PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2740 -ip 2740
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb38DB.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsb3A17.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsb3A17.tmp
Size 30B
SHA256 c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
MD5 f15bfdebb2df02d02c8491bde1b4e9bd
SHA1 93bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA512 1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
MD5 SHA1 SHA512

Submit Download

nsg394A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg394A.tmp
Size 60B
SHA256 a9481e404d99b46449444815dbea595573009523361f64b448ddd0f9b125a107
MD5 8091f3bddbd64901d7f248214ae81a31
SHA1 c18871d9d3f8db1cec48d4e3f13bdb19c284eaf3
SHA512 730442f65f2cd7a7e00ab91de09272ebd005dadc7b06a08bd8d4efa0913301e97a2f22124b4622728a678abb62d119704199dd7336ceb320d50a0d68acfa4590
TLSH
T166A02208828008F02203E0220F32A020030C3E000C3202020BAC0000B00308B8203008
MD5 SHA1 SHA512 TLSH

Submit Download

nsg3999.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg3999.tmp
Size 56B
SHA256 5bea36deda22eba06a5b715fe7c737a35af91b8ab077a25ec3383088be453bcf
MD5 d3a0dff6766608c6a21b354b33c11fb9
SHA1 7a4083c23582e41409aa8d848f23adef1bba9353
SHA512 68975d7fdf8b1b22b5bf5504d4ad0a2d2a3f02cc069ce9fcb9f5a06966f2bcbbd55c78f3100376146288c5c65f73b8fd7170f3337270c6d76955f49636dfb802
TLSH
T13B900234165579B4A18AE9D64C1689C5910C7A05981A4202466980607046847840A980
MD5 SHA1 SHA512 TLSH

Submit Download

nsl391A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl391A.tmp
Size 34B
SHA256 ba493b1e2704c417662224230bffa2effae24f9fbf8c56a7bcb93ac02bc2abd9
MD5 2a9c98ea1aa7a05604ab51073fcd45c7
SHA1 3f970ebeb4f5ef40f8bb1e16d64ab410c3af3962
SHA512 fe999f6186c4bb20113cfdddba193cf777941a9ce223f0c6d8f85dc5e2668df6f820922d7b75f255ec2d5355f1881f3867686363f4c5f630ffa8b48b079d7647
MD5 SHA1 SHA512

Submit Download

nsl391A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl391A.tmp
Size 50B
SHA256 6a3fde98ef05ef8b76bb66538de3e3e14b6d9928176532293645b0cb27325c9d
MD5 66232700b45a0cd2fca0b0ab4c15cf1d
SHA1 5b63ae813636c07f4de62f88425d23c3c75e024b
SHA512 f97a2e4779c99d335f4118b94dfb004c65efe5342c6fc75632bfa6f96ac14c5c35cd1adc11a7e5472dc22553e6151e109e2cca5694139eea6fa32e620c0c5054
TLSH
T19A90022306115E6978C7859348695555520A645599510495159409452542056CA8B285
MD5 SHA1 SHA512 TLSH

Submit Download

nsl391A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl391A.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsv386C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv386C.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsv386C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv386C.tmp
Size 45B
SHA256 8d563467c54bb057b01f2366722a14e9416510bf4955afa746cbeb2f221312fc
MD5 5bc80a3e025e6d7c0ff9536d7af1c8b1
SHA1 c7dca5ef716161e30829bcfe28b59ec430fdbec0
SHA512 cca0649c6cc7a92de2c46bf64084bce5e0ce44ef5acbdcb7527231d5372d74b0a1b3d0856ecfa0d32a5a0fbf5219df8117b14bec29d513fb55da0d1f25a6ad8b
MD5 SHA1 SHA512

Submit Download

nsv386C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv386C.tmp
Size 6B
SHA256 6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c
MD5 50484c19f1afdaf3841a0d821ed393d2
SHA1 c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b
SHA512 d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b
MD5 SHA1 SHA512

Submit Download

nsv386C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv386C.tmp
Size 58B
SHA256 9b9b769252e232ac369f61922b79f5656a4f4d744e39114bd389d0a56469ce3f
MD5 0b29799f668498e44f469590f92136a6
SHA1 477022e40d3b1f1f06f5e6c0404450af702db6eb
SHA512 d987b05f4085bc9d3640e496f002e068649a2859f0aa6c538de03ffac0f766dc0009a6f532809e579655ad5677a150834447670fb2774d1bdd33b70542ff3ef9
TLSH
T18AA0025635814654FD82C4711B657008E59D302600C544031A4D44485D05067CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2740-561-0x0000000000400000-0x00000000016E6000-memory.dmp

Download

memory/2740-562-0x00000000016F0000-0x0000000002F93000-memory.dmp

Download

memory/4308-559-0x0000000005950000-0x00000000071F3000-memory.dmp

Download

memory/4308-560-0x0000000074A65000-0x0000000074A66000-memory.dmp

Download

memory/4308-563-0x0000000005950000-0x00000000071F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads