guloader | c2c92d04719006818e5ddddece2df924dfbd1b8441ec4a43aca487c876538d19

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Salary_Increase_Sheet-Pdf.exe
Size 291KB
Sample260910-pssa5scl7w
SHA256 c2c92d04719006818e5ddddece2df924dfbd1b8441ec4a43aca487c876538d19
MD5 65e130eb9ca48fb34ac8acf2fddaf451
SHA1 7dd9b6ec16bfe16eeb48a829f3339ab7e488b2ac
SHA512 dcaaabe3f131c75a9a89b02504482103939d9062f090db70b65a43170163da39877de3d2bff2bf7349eaadad5df236c751910931085e9cdd1e97397da828fa54
SSDEEP 6144:F+MvoJXYsbLSYYdtqcVnTUyA/2BE2nFXue22YWyblRDsJgTDKg:F+FHbLSftVQr+F32/WybvDsJgTWg
TLSH
T14C5401117BC4DA2BCA661631AC73D7322BB9B936875B570B77847F0C7CA22C19D1D282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader guloader

Malware Config

Signatures

Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Loads dropped DLL 2 IoCs

pid	Process
4204	Salary_Increase_Sheet-Pdf.exe
4204	Salary_Increase_Sheet-Pdf.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	drive.google.com
20	drive.google.com
53	drive.google.com
57	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4204	Salary_Increase_Sheet-Pdf.exe
1212	Salary_Increase_Sheet-Pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Salary_Increase_Sheet-Pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Salary_Increase_Sheet-Pdf.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4204	Salary_Increase_Sheet-Pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3188	4204	Salary_Increase_Sheet-Pdf.exe	86
PID 4204 wrote to memory of 1212	4204	Salary_Increase_Sheet-Pdf.exe	87
PID 4204 wrote to memory of 1212	4204	Salary_Increase_Sheet-Pdf.exe	87
PID 1212 wrote to memory of 2132	1212	Salary_Increase_Sheet-Pdf.exe	93

C:\Users\Admin\AppData\Local\Temp\Salary_Increase_Sheet-Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Salary_Increase_Sheet-Pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\Salary_Increase_Sheet-Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Salary_Increase_Sheet-Pdf.exe"
  2⤵
  PID:3188
- C:\Users\Admin\AppData\Local\Temp\Salary_Increase_Sheet-Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Salary_Increase_Sheet-Pdf.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Users\Admin\AppData\Local\Temp\Salary_Increase_Sheet-Pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Salary_Increase_Sheet-Pdf.exe"
    3⤵
    PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsj4FB5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsj4FB5.tmp
Size 17B
SHA256 54dc16ada6e12dd1bb2ade6f6c3b9d0e51ebc00568d8022e19cd542620ca8752
MD5 26b5d572c05bd48008d83ec69a9fe7d8
SHA1 f030b576e69f6071fffee62f3d4447a4ae004812
SHA512 1a78242b3184d3316b53c8e329c2878c2eefb821aff0363b620ed906e7fa745375160015e9c6639a616a5767be6ba0829faf0332404bec85f412720cdb7a6f57
MD5 SHA1 SHA512

Submit Download

nsj4FB5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsj4FB5.tmp
Size 58B
SHA256 3db34bd8af62fad04f91b6fa13583b0f112dafa79c70567a7515a814d93ba1f1
MD5 a1c4e1b90b2bb9c346a73e7ce16a9fa7
SHA1 53a9814209b97f24bed6a3895a699e15c79a4bd6
SHA512 2753e87d4dc34d6daf8638fb20009c9dae9a288846e8d5df7520b54f0cc5c37c076a2a92f8d895bdf0b9dc00836393e1b56b83d707b9db060471828415ba9e7e
TLSH
T102A00219418559E4674794AA6F35E125532D7D454C7604122BAD5681B82314A4703509
MD5 SHA1 SHA512 TLSH

Submit Download

nsj4FB5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsj4FB5.tmp
Size 60B
SHA256 afdb5ce46e1259d79752ba9bbd20befb1280299954ebcd5e7445bebfd1800e78
MD5 7f5ca425f8a0c0c658dfc10424dcfd25
SHA1 55c51ca6c7f739df8ef830988c0e34ef9961b5b5
SHA512 f9569210dfe61410865f5b0d520a7fd9b0574f68ccdd0abdc5e8b4c0d32ecac9975308ce3162f9113c65768d7b53ca0c23748e395f3dce338050cb6df528f55a
TLSH
T1FBA00219858559E4674794AA6F35E125532D7D454C7604122BAD5681B82314A4703549
MD5 SHA1 SHA512 TLSH

Submit Download

nso4E4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso4E4B.tmp
Size 67B
SHA256 6c9d5f35bd11e1d670553bca8b7ff96bfd5c555f09ac6f7a3ce8b97d3a02b133
MD5 0a3f0a6958444bbe60be42110a33bb30
SHA1 2350bbdacf80483b634671b7877166fcaacbec7b
SHA512 dc58c80053bef25009a7603ed785690c7fb097e44e91f7fb5ea0ad931f3a28111d87f1a3072ce728eecc23fe3c91452b40c787e07a8562a0f901a98bb25cb8b3
TLSH
T14AA00256358156A4FEC2C4711F65700CE59D303700C544032A4D48889D45067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nso4E4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso4E4B.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nso4E4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso4E4B.tmp
Size 29B
SHA256 3f1b5b4bbb2d866c8c62ef732346f0dd6843cbdb2aed403f041509d0657c8b77
MD5 7bcf80ed4b7586485d227a08e4b7686b
SHA1 75f83d3b2fd6fc16fe54abf43839bc0512ca0046
SHA512 1bc1e78b73c49ffb095dbcced9b53a1403b253a22517441ab9db1aa720ffab2a2d36222c83c1773934157324201e769fa3b109fa620c3992a6488e9a79486bb2
MD5 SHA1 SHA512

Submit Download

nso4E4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso4E4B.tmp
Size 55B
SHA256 08643cfe1a514214ae4175809b7eadbc0bff209e07adf091e91748dccf9ca874
MD5 2598d3e10bec5798f73f49de505a8514
SHA1 4431b20a112e277250649a917f846a6627870a60
SHA512 83687d6fb3238184b92f04cc70e54ede282d56e34f67781db6c4dfd9529cab30ba15d9ca3059b68f9d82eb87a8d6432e80ba0779d1438c1df861b0bb30905f24
TLSH
T16F90025624814654F582C4711B557008E59D302600C544031A4D44485C05053CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nso4F37.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso4F37.tmp
Size 37B
SHA256 9c719d5b57ba39eeac8bb3dc66e5e4116e6df0d13708c46dbb0df2a89b50467d
MD5 19bb0d4e0dbbeec8ba11676faf173020
SHA1 803ec505ddf82c03af6de9ea9bc483d709f01b08
SHA512 5c10165a0160b4ae90ffb637971daa4086d6fbe2c4cb771050c6736ece6332cee843629ae2ce98139543e099cd439a730696e5c6c2fdbcca449ac9803a6e4df3
MD5 SHA1 SHA512

Submit Download

nso4F37.tmp

Path C:\Users\Admin\AppData\Local\Temp\nso4F37.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsu5043.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu5043.tmp
Size 44B
SHA256 6dd433aeaa548d75bde9026840689eedbcfc2c098d59903d22acf77dd28aa315
MD5 c98dcafda91c4cc96b4b05b9416dbb97
SHA1 b179f08f45a2480c4053e9dfe6af404801b75413
SHA512 2909d2098d7e55ff12023a1c241a2fb8c02af7811d1917459cdc006b4cbae3b9dd621b946d00739e1143a502c08fc6079aa49790b2c86d6f4fc242f1fb608ba5
MD5 SHA1 SHA512

Submit Download

nsu5043.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsu5043.tmp
Size 56B
SHA256 45c722ca7c89e749c1222c1a7b5110a95db8ae2161c04e474a13cc515c4c75f7
MD5 d2a83d3050bcbb02598c973323232950
SHA1 215a82d43d80c04bf7467500738cf1ed100a17b1
SHA512 781eba68b0604f8613f68a32ab699642375e47b4a2e8e9cbc481385f302bf9f61099da3c31781160255e7b580c0e575fe6a41ea9910166fd6054f350f1b2b3bb
TLSH
T1F7900234154979F4E34BE8D95C698985910C7605581740012669419071514878D06944
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz4ED9.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsz50FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsz50FF.tmp
Size 13B
SHA256 38e0646749072dd0bfa54e9cc2884b454d7ea22b08d816599d86f7f162e1c7e8
MD5 f6dd1b23c7a68545a2c2dbf678cf8683
SHA1 43eeed66236b1b5868671abdc138051daa64fd16
SHA512 a23ad3fc2ca9259a0641bc445eb71848c5e824694f844dea4d35d985aa65fa6a882af3d4f873042df9da564e0ec4afd0ad2bc6911c00a70f9e82171d53fb76d2
MD5 SHA1 SHA512

Submit Download

nsz50FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsz50FF.tmp
Size 30B
SHA256 1d41c63746052d97c9c35d167d50555630076dd85a19b594d01fca87eb44fbac
MD5 8d16f4a0e64fbb231ab90640a57f5f75
SHA1 182c65e9c1019be43b6fccd994f5eb6131946064
SHA512 6909f7329b9296c4179305e5dd4e06ad7260cf393ea26db56a46acdc1c8456287062e1264e49d5e8a471277b506236e54396ab496bd76bd6220acab407569c07
MD5 SHA1 SHA512

Submit Download

memory/1212-566-0x00000000777A5000-0x00000000777A6000-memory.dmp

Download

memory/1212-564-0x0000000077788000-0x0000000077789000-memory.dmp

Download

memory/1212-565-0x0000000077829000-0x000000007782A000-memory.dmp

Download

memory/1212-570-0x00000000016D0000-0x0000000002A19000-memory.dmp

Download

memory/1212-571-0x0000000000470000-0x00000000016C4000-memory.dmp

Download

memory/1212-572-0x0000000077829000-0x000000007782A000-memory.dmp

Download

memory/4204-562-0x00000000743E5000-0x00000000743E6000-memory.dmp

Download

memory/4204-563-0x0000000004DF0000-0x0000000006139000-memory.dmp

Download

memory/4204-561-0x0000000004DF0000-0x0000000006139000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads