Edit tour

Windows Analysis Report
word.exe

Overview

General Information

Sample name:	word.exe
Analysis ID:	1497467
MD5:	0ea4553778672b58bbd711fb039552c8
SHA1:	8487f359428f19444696ce610ed81c6b4dd56a6a
SHA256:	910ae266eb8177aa46e2a2c77029e57b30d7aaa819c3b8451514bf1b1ae26f8d
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected GuLoader

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

PE file contains an invalid checksum

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

word.exe (PID: 6308 cmdline: "C:\Users\user\Desktop\word.exe" MD5: 0EA4553778672B58BBD711FB039552C8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\spherosome\preadoption\preembodiment\Unending.die	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
C:\Users\user\AppData\Local\Temp\nsbD910.tmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.4568994288.0000000003000000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000000.00000002.4568696784.00000000027FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000000.00000002.4568994288.0000000006D40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Code function: 0_2_0040511A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040511A

Source: C:\Users\user\Desktop\word.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\word.exe

Code function: 0_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_00403217

Source: C:\Users\user\Desktop\word.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_00404959		0_2_00404959
Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_004062CB		0_2_004062CB

Source: word.exe, 00000000.00000000.2108364899.0000000000447000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametrichinization.exe4 vs word.exe
Source: word.exe	Binary or memory string: OriginalFilenametrichinization.exe4 vs word.exe

Source: word.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/9@0/0

Source: C:\Users\user\Desktop\word.exe

Code function: 0_2_0040442A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040442A

Source: C:\Users\user\Desktop\word.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Source: C:\Users\user\Desktop\word.exe

File created: C:\Users\user\spherosome

Jump to behavior

Source: C:\Users\user\Desktop\word.exe

File created: C:\Users\user\AppData\Local\Temp\nsbD90F.tmp

Jump to behavior

Source: word.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\word.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\word.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\word.exe

File read: C:\Users\user\Desktop\word.exe

Jump to behavior

Source: C:\Users\user\Desktop\word.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\word.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\word.exe

File written: C:\Users\user\AppData\Local\Temp\Setup.ini

Jump to behavior

Source: word.exe

Static PE information: certificate valid

Source: word.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.4568994288.0000000006D40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4568994288.0000000003000000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4568696784.00000000027FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\spherosome\preadoption\preembodiment\Unending.die, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsbD910.tmp, type: DROPPED

Source: C:\Users\user\Desktop\word.exe

Code function: 0_2_0040601C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040601C

Source: System.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1014f
Source: word.exe	Static PE information: real checksum: 0xb3966 should be: 0xb47c4

Source: C:\Users\user\Desktop\word.exe

Code function: 0_2_10002D30 push eax; ret

0_2_10002D5E

Source: C:\Users\user\Desktop\word.exe

File created: C:\Users\user\AppData\Local\Temp\nsmDB24.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\word.exe

RDTSC instruction interceptor: First address: 71C5171 second address: 71C5171 instructions: 0x00000000 rdtsc 0x00000002 cmp dx, C9B0h 0x00000007 cmp ax, cx 0x0000000a cmp ebx, ecx 0x0000000c jc 00007FCC747EDA8Ah 0x0000000e cmp dx, bx 0x00000011 test cx, dx 0x00000014 inc ebp 0x00000015 test edx, ebx 0x00000017 inc ebx 0x00000018 rdtsc

Source: C:\Users\user\Desktop\word.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmDB24.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_00405FF5 FindFirstFileA,FindClose,	0_2_00405FF5
Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_004055B1 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055B1
Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645

Source: C:\Users\user\Desktop\word.exe	API call chain: ExitProcess graph end node			graph_0-4275
Source: C:\Users\user\Desktop\word.exe	API call chain: ExitProcess graph end node			graph_0-4438

Source: C:\Users\user\Desktop\word.exe

Code function: 0_2_0040601C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040601C

Source: C:\Users\user\Desktop\word.exe

Code function: 0_2_00405D13 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D13

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
word.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Source: word.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: word.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: word.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: word.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: word.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: word.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: word.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: word.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: word.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: word.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: word.exe	String found in binary or memory: http://ocsps.ssl.com0_
Source: word.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: word.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: word.exe	String found in binary or memory: https://www.ssl.com/repository0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report word.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
word.exe