Edit tour

Windows Analysis Report
Calyciform.exe

Overview

General Information

Sample name:	Calyciform.exe
Analysis ID:	1554165
MD5:	0b813c3349387a69277d7f8a0d20fe3d
SHA1:	d0c4aa5fffba33d1f7c9c184cd3acb90f6a75650
SHA256:	d2473f318c1386699bdd8442cfe5455d44e18ec23d4b2482ffc82c7c227ab9ad
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Switches to a custom stack to bypass stack traces

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

Calyciform.exe (PID: 1676 cmdline: "C:\Users\user\Desktop\Calyciform.exe" MD5: 0B813C3349387A69277D7F8A0D20FE3D)

Calyciform.exe (PID: 6632 cmdline: "C:\Users\user\Desktop\Calyciform.exe" MD5: 0B813C3349387A69277D7F8A0D20FE3D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.130225753929.0000000002FAF000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000002.00000002.134606321221.000000000174F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Calyciform.exe	ReversingLabs: Detection: 45%
Source: Calyciform.exe	Virustotal: Detection: 37%			Perma Link

Source: Calyciform.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Calyciform.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Calyciform.exe, 00000002.00000001.129567935037.0000000000649000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: mshtml.pdbUGP source: Calyciform.exe, 00000002.00000001.129567935037.0000000000649000.00000020.00000001.01000000.00000005.sdmp

Source: C:\Users\user\Desktop\Calyciform.exe	Code function: 0_2_00405745 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405745
Source: C:\Users\user\Desktop\Calyciform.exe	Code function: 0_2_00406280 FindFirstFileA,FindClose,	0_2_00406280
Source: C:\Users\user\Desktop\Calyciform.exe	Code function: 0_2_004026FE FindFirstFileA,	0_2_004026FE

Source: global traffic

TCP traffic: 192.168.11.20:49771 -> 45.137.22.248:80

Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.248

Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.bin
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.bin#?_v
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.bin/?Kv
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.bin7?Sv
Source: Calyciform.exe, 00000002.00000002.134609519488.0000000002897000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.binJ
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.binK?
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.binM
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.binS?
Source: Calyciform.exe, 00000002.00000002.134609519488.0000000002897000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.bin_
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.bin_?
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.binedvmbusRFCOMM
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.binh
Source: Calyciform.exe, 00000002.00000002.134609519488.0000000002897000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.248/nSTbXfnKEyKbZuJcrDaW99.binl
Source: Calyciform.exe, 00000002.00000001.129567935037.0000000000649000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: Calyciform.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Calyciform.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Calyciform.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Calyciform.exe	String found in binary or memory: http://s.symcd.com06
Source: Calyciform.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Calyciform.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Calyciform.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Calyciform.exe, 00000002.00000001.129567935037.0000000000649000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: Calyciform.exe, 00000002.00000001.129567935037.0000000000626000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: Calyciform.exe, 00000002.00000001.129567935037.00000000005F2000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: Calyciform.exe, 00000002.00000001.129567935037.00000000005F2000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: Calyciform.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: Calyciform.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: Calyciform.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: Calyciform.exe, 00000002.00000001.129567935037.0000000000649000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214

Source: C:\Users\user\Desktop\Calyciform.exe

Code function: 0_2_004051E2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004051E2

Source: C:\Users\user\Desktop\Calyciform.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\vmmouse.cat

Jump to dropped file

Source: C:\Users\user\Desktop\Calyciform.exe

Code function: 0_2_004031E9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004031E9

Source: C:\Users\user\Desktop\Calyciform.exe	Code function: 0_2_00404A21		0_2_00404A21
Source: C:\Users\user\Desktop\Calyciform.exe	Code function: 0_2_6D6A1A9C		0_2_6D6A1A9C

Source: Calyciform.exe

Static PE information: invalid certificate

Source: Calyciform.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.evad.winEXE@3/8@0/1

Source: C:\Users\user\Desktop\Calyciform.exe

0_2_004031E9

Source: C:\Users\user\Desktop\Calyciform.exe

Code function: 0_2_004044AE GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004044AE

Source: C:\Users\user\Desktop\Calyciform.exe

Code function: 0_2_004020D1 CoCreateInstance,MultiByteToWideChar,

0_2_004020D1

Source: C:\Users\user\Desktop\Calyciform.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant

Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe

File created: C:\Users\user\AppData\Local\Temp\nse9AF4.tmp

Jump to behavior

Source: Calyciform.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Calyciform.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Calyciform.exe	ReversingLabs: Detection: 45%
Source: Calyciform.exe	Virustotal: Detection: 37%

Source: C:\Users\user\Desktop\Calyciform.exe

File read: C:\Users\user\Desktop\Calyciform.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Calyciform.exe "C:\Users\user\Desktop\Calyciform.exe"
Source: C:\Users\user\Desktop\Calyciform.exe	Process created: C:\Users\user\Desktop\Calyciform.exe "C:\Users\user\Desktop\Calyciform.exe"
Source: C:\Users\user\Desktop\Calyciform.exe	Process created: C:\Users\user\Desktop\Calyciform.exe "C:\Users\user\Desktop\Calyciform.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Section loaded: srvcli.dll	Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Calyciform.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Calyciform.exe, 00000002.00000001.129567935037.0000000000649000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: mshtml.pdbUGP source: Calyciform.exe, 00000002.00000001.129567935037.0000000000649000.00000020.00000001.01000000.00000005.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.130225753929.0000000002FAF000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.134606321221.000000000174F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Calyciform.exe

Code function: 0_2_6D6A1A9C GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6D6A1A9C

Source: C:\Users\user\Desktop\Calyciform.exe

Code function: 0_2_6D6A2F20 push eax; ret

0_2_6D6A2F4E

Source: C:\Users\user\Desktop\Calyciform.exe

File created: C:\Users\user\AppData\Local\Temp\nsf9BE0.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Calyciform.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\Scrivano.Sek	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\Bluetooth Suite help_HUN.chm	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\Grundkoncept.Feh	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\anycollseq.c	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\list-drag-handle-symbolic.svg	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\user-idle.png	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\vmmouse.cat	Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Calyciform.exe	API/Special instruction interceptor: Address: 37DE4BA
Source: C:\Users\user\Desktop\Calyciform.exe	API/Special instruction interceptor: Address: 1F7E4BA

Tries to detect Any.run

Source: C:\Users\user\Desktop\Calyciform.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Calyciform.exe, 00000000.00000002.130224651433.0000000000A38000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE0

Source: C:\Users\user\Desktop\Calyciform.exe

File opened / queried: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\vmmouse.cat

Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsf9BE0.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Calyciform.exe TID: 5572	Thread sleep count: 106 > 30			Jump to behavior
Source: C:\Users\user\Desktop\Calyciform.exe TID: 5572	Thread sleep time: -106000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Calyciform.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Calyciform.exe	Code function: 0_2_00405745 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405745
Source: C:\Users\user\Desktop\Calyciform.exe	Code function: 0_2_00406280 FindFirstFileA,FindClose,	0_2_00406280
Source: C:\Users\user\Desktop\Calyciform.exe	Code function: 0_2_004026FE FindFirstFileA,	0_2_004026FE

Source: Calyciform.exe, 00000000.00000002.130229388804.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: Calyciform.exe, 00000002.00000002.134609519488.0000000002897000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Calyciform.exe, 00000000.00000002.130229388804.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: Calyciform.exe, 00000000.00000002.130224651433.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmmouse.cat
Source: vmmouse.cat.0.dr	Binary or memory string: VMware, Inc.
Source: Calyciform.exe, 00000000.00000002.130229388804.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: vmmouse.cat.0.dr	Binary or memory string: vmmouse.inf0E
Source: Calyciform.exe, 00000000.00000002.130229388804.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: Calyciform.exe, 00000000.00000002.130224651433.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Scrivano.SekBluetooth Suite help_HUN.chmGrundkoncept.Fehanycollseq.clist-drag-handle-symbolic.svguser-idle.pngvmmouse.cat%Omkomne52%\TheologicallySoftware\Energizingfireetageshusets
Source: Calyciform.exe, 00000000.00000002.130229388804.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Calyciform.exe, 00000000.00000002.130224651433.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Puerperant\vmmouse.catK$9
Source: Calyciform.exe, 00000000.00000002.130229388804.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: Calyciform.exe, 00000000.00000002.130224651433.0000000000A38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe0
Source: vmmouse.cat.0.dr	Binary or memory string: vmmouse.sys0M
Source: Calyciform.exe, 00000000.00000002.130229388804.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: Calyciform.exe, 00000000.00000002.130229388804.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: Calyciform.exe, 00000002.00000002.134610018366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: Calyciform.exe, 00000002.00000002.134609519488.00000000028D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc

Source: C:\Users\user\Desktop\Calyciform.exe	API call chain: ExitProcess graph end node			graph_0-4450
Source: C:\Users\user\Desktop\Calyciform.exe	API call chain: ExitProcess graph end node			graph_0-4616

Source: C:\Users\user\Desktop\Calyciform.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe

Code function: 0_2_0040643A LdrInitializeThunk,

0_2_0040643A

Source: C:\Users\user\Desktop\Calyciform.exe

Code function: 0_2_6D6A1A9C GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6D6A1A9C

Source: C:\Users\user\Desktop\Calyciform.exe

Process created: C:\Users\user\Desktop\Calyciform.exe "C:\Users\user\Desktop\Calyciform.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Calyciform.exe

0_2_004031E9

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	311 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	12 Virtualization/Sandbox Evasion	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Calyciform.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Calyciform.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Calyciform.exe