Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.generic.ml.32161

Overview

General Information

Sample Name:	SecuriteInfo.com.generic.ml.32161 (renamed file extension from 32161 to exe)
Analysis ID:	337336
MD5:	0640f43c412f8f2c3bf6e1b9139db1d0
SHA1:	f07e9e5e618b14b0dd5478cb2a26f42096a10e1d
SHA256:	1664c6a330c5b318458518ea71b2a9995a91c79281a050278c3aa2388663a986
Tags:	GuLoader
Most interesting Screenshot:

Detection

Remcos GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential malicious icon found

Sigma detected: Remcos

Yara detected GuLoader

Connects to many ports of the same IP (likely port scanning)

Contains functionality to hide a thread from the debugger

Hides threads from debuggers

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

SecuriteInfo.com.generic.ml.exe (PID: 908 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: 0640F43C412F8F2C3BF6E1B9139DB1D0)

ieinstal.exe (PID: 6588 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 6612 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 6640 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 6680 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 6724 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 6776 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 6848 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 6908 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 6988 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 7012 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 7056 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ielowutil.exe (PID: 7084 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe' MD5: D1F5C3244A69511CAC88009B71884A71)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000016.00000002.570071221.0000000002AD1000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
00000000.00000002.313168282.0000000000409000.00000020.00020000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0xce8:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000000.00000000.205779909.0000000000409000.00000020.00020000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0xce8:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Process Memory Space: ielowutil.exe PID: 7084	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: SecuriteInfo.com.generic.ml.exe PID: 908	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security

Sigma Overview

System Summary:

Sigma detected: Remcos

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files (x86)\Internet Explorer\ielowutil.exe, ProcessId: 7084, TargetFilename: C:\Users\user\AppData\Roaming\remcos\logs.dat

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.generic.ml.exe

Virustotal: Detection: 11%

Perma Link

Source: SecuriteInfo.com.generic.ml.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown

HTTPS traffic detected: 142.250.180.97:443 -> 192.168.2.3:49732 version: TLS 1.2

Networking:

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 185.157.161.61 ports 0,2,52360,3,5,6

Source: global traffic

TCP traffic: 192.168.2.3:49733 -> 185.157.161.61:52360

Source: Joe Sandbox View

IP Address: 142.250.180.97 142.250.180.97

Source: Joe Sandbox View

ASN Name: OBE-EUROPEObenetworkEuropeSE OBE-EUROPEObenetworkEuropeSE

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: doc-0c-8c-docs.googleusercontent.com

Source: ielowutil.exe, 00000016.00000002.571131966.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ielowutil.exe, 00000016.00000002.571131966.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: ielowutil.exe, 00000016.00000002.571131966.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/gsr2
Source: ielowutil.exe, 00000016.00000003.540935394.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: ielowutil.exe, 00000016.00000003.540935394.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: ielowutil.exe, 00000016.00000002.571131966.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: ielowutil.exe, 00000016.00000002.571131966.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: ielowutil.exe	String found in binary or memory: https://drive.google.com/uc?export=download&id=1LZsqqMCLui4uAjpAqMIbGbmi-9F8VM3f
Source: ielowutil.exe, 00000016.00000002.571131966.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: https://pki.goog/r
Source: ielowutil.exe, 00000016.00000003.540935394.0000000002FAE000.00000004.00000001.sdmp	String found in binary or memory: https://pki.goog/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 142.250.180.97:443 -> 192.168.2.3:49732 version: TLS 1.2

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.313168282.0000000000409000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000000.205779909.0000000000409000.00000020.00020000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F536B NtSetInformationThread,	0_2_021F536B
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F0399 EnumWindows,NtSetInformationThread,	0_2_021F0399
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F58B4 NtProtectVirtualMemory,	0_2_021F58B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F20D3 NtWriteVirtualMemory,Sleep,	0_2_021F20D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F22D5 NtWriteVirtualMemory,	0_2_021F22D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F2315 NtWriteVirtualMemory,	0_2_021F2315
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F4B05 NtSetInformationThread,	0_2_021F4B05
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F2385 NtWriteVirtualMemory,	0_2_021F2385
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F23C1 NtWriteVirtualMemory,	0_2_021F23C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F48EE NtSetInformationThread,	0_2_021F48EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F20E1 NtWriteVirtualMemory,	0_2_021F20E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F2119 NtWriteVirtualMemory,	0_2_021F2119
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F216D NtWriteVirtualMemory,	0_2_021F216D
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F2189 NtWriteVirtualMemory,	0_2_021F2189
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F21C5 NtWriteVirtualMemory,	0_2_021F21C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F21F1 NtWriteVirtualMemory,	0_2_021F21F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F1F98 NtSetInformationThread,	0_2_021F1F98
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F2415 NtWriteVirtualMemory,	0_2_021F2415
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F042D NtSetInformationThread,	0_2_021F042D
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F2445 NtWriteVirtualMemory,	0_2_021F2445
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F2495 NtWriteVirtualMemory,	0_2_021F2495
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F0485 NtSetInformationThread,	0_2_021F0485
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F04AD NtSetInformationThread,	0_2_021F04AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F24CD NtWriteVirtualMemory,	0_2_021F24CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F24ED NtWriteVirtualMemory,	0_2_021F24ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F0D39 NtSetInformationThread,NtWriteVirtualMemory,	0_2_021F0D39
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5D3D NtSetInformationThread,	22_2_02AD5D3D
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD602D NtSetInformationThread,	22_2_02AD602D
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD601D NtSetInformationThread,	22_2_02AD601D
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5E8D NtSetInformationThread,	22_2_02AD5E8D
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5EE2 NtSetInformationThread,	22_2_02AD5EE2
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5E39 NtSetInformationThread,	22_2_02AD5E39
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5E19 NtSetInformationThread,	22_2_02AD5E19
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5E71 NtSetInformationThread,	22_2_02AD5E71
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5FB9 NtSetInformationThread,	22_2_02AD5FB9
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5F89 NtSetInformationThread,	22_2_02AD5F89
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5F2D NtSetInformationThread,	22_2_02AD5F2D
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5DA9 NtSetInformationThread,	22_2_02AD5DA9
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5D81 NtSetInformationThread,	22_2_02AD5D81
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5D95 NtSetInformationThread,	22_2_02AD5D95
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5DDD NtSetInformationThread,	22_2_02AD5DDD
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD5D69 NtSetInformationThread,	22_2_02AD5D69

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Code function: 0_2_004012D4

0_2_004012D4

Source: SecuriteInfo.com.generic.ml.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: SecuriteInfo.com.generic.ml.exe, 00000000.00000000.205786428.0000000000411000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIndk.exe vs SecuriteInfo.com.generic.ml.exe
Source: SecuriteInfo.com.generic.ml.exe	Binary or memory string: OriginalFilenameIndk.exe vs SecuriteInfo.com.generic.ml.exe

Source: SecuriteInfo.com.generic.ml.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 00000000.00000002.313168282.0000000000409000.00000020.00020000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000000.205779909.0000000000409000.00000020.00020000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@25/1@3/2

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

File created: C:\Users\user\AppData\Roaming\remcos

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Mutant created: \Sessions\1\BaseNamedObjects\Remcos-DPTVOE

Source: SecuriteInfo.com.generic.ml.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: SecuriteInfo.com.generic.ml.exe

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000016.00000002.570071221.0000000002AD1000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ielowutil.exe PID: 7084, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.generic.ml.exe PID: 908, type: MEMORY

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_004069D1 push ss; retf	0_2_00406A0D
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_004066E0 push ss; retf	0_2_00406A0D
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_004043BD push ebp; iretd	0_2_004043C1

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SecuriteInfo.com.generic.ml.exe, 00000000.00000002.313492179.00000000021F0000.00000040.00000001.sdmp, ielowutil.exe, 00000016.00000002.570071221.0000000002AD1000.00000040.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEU
Source: SecuriteInfo.com.generic.ml.exe, ielowutil.exe	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Code function: 0_2_021F536B rdtsc

0_2_021F536B

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Window / User API: threadDelayed 700

Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe TID: 1376	Thread sleep count: 700 > 30			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe TID: 1376	Thread sleep time: -7000000s >= -30000s			Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe

Last function: Thread delayed

Source: SecuriteInfo.com.generic.ml.exe, ielowutil.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SecuriteInfo.com.generic.ml.exe, 00000000.00000002.313492179.00000000021F0000.00000040.00000001.sdmp, ielowutil.exe, 00000016.00000002.570071221.0000000002AD1000.00000040.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exeU

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Code function: 0_2_021F536B NtSetInformationThread 000000FE,00000011,00000000,00000000,00000040,021F0479,00000000,00000000,00000000,00000000,?,00000000,00000000,021F4A9F,?,021F4489

0_2_021F536B

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Code function: 0_2_021F536B rdtsc

0_2_021F536B

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Code function: 0_2_021F362C LdrInitializeThunk,

0_2_021F362C

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_004012D4 mov ebx, dword ptr fs:[00000030h]	0_2_004012D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F536B mov eax, dword ptr fs:[00000030h]	0_2_021F536B
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F4A29 mov eax, dword ptr fs:[00000030h]	0_2_021F4A29
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F1AA5 mov eax, dword ptr fs:[00000030h]	0_2_021F1AA5
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F4358 mov eax, dword ptr fs:[00000030h]	0_2_021F4358
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F53B5 mov eax, dword ptr fs:[00000030h]	0_2_021F53B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F291E mov eax, dword ptr fs:[00000030h]	0_2_021F291E
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F1C59 mov eax, dword ptr fs:[00000030h]	0_2_021F1C59
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F1C71 mov eax, dword ptr fs:[00000030h]	0_2_021F1C71
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Code function: 0_2_021F15CB mov eax, dword ptr fs:[00000030h]	0_2_021F15CB
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD4A29 mov eax, dword ptr fs:[00000030h]	22_2_02AD4A29
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD53B5 mov eax, dword ptr fs:[00000030h]	22_2_02AD53B5
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD536B mov eax, dword ptr fs:[00000030h]	22_2_02AD536B
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD4358 mov eax, dword ptr fs:[00000030h]	22_2_02AD4358
Source: C:\Program Files (x86)\Internet Explorer\ielowutil.exe	Code function: 22_2_02AD2917 mov eax, dword ptr fs:[00000030h]	22_2_02AD2917

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe

Memory written: C:\Program Files (x86)\Internet Explorer\ielowutil.exe base: 2AD0000

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe	Process created: C:\Program Files (x86)\Internet Explorer\ielowutil.exe 'C:\Users\user\Desktop\SecuriteInfo.com.generic.ml.exe'	Jump to behavior

Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: Program Manager
Source: ielowutil.exe, 00000016.00000002.571262654.0000000003490000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: ielowutil.exe, 00000016.00000002.571262654.0000000003490000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: Program Manageranager
Source: logs.dat.22.dr	Binary or memory string: [ Program Manager ]
Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: Program Manager0\|
Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: Program Managerr\|
Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: \|Program Manager
Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: Program ManageryO
Source: ielowutil.exe, 00000016.00000002.571262654.0000000003490000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: Program ManageranagerH
Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: Program Managerr
Source: ielowutil.exe, 00000016.00000002.571662057.0000000004A80000.00000004.00000040.sdmp	Binary or memory string: \|Program Manager\|
Source: ielowutil.exe, 00000016.00000002.571697419.0000000004A87000.00000004.00000040.sdmp	Binary or memory string: Program Manager\|

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping	Security Software Discovery421	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion22	LSASS Memory	Virtualization/Sandbox Evasion22	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection112	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.generic.ml.32161

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails