Loading ...

Play interactive tourEdit tour

Analysis Report JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe

Overview

General Information

Sample Name:JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe
Analysis ID:337903
MD5:2fd73e6bfea5941b83a7f88159f0e3ae
SHA1:348d0ec7b5d5957a41585f5f670f90282e6ce75e
SHA256:550830c3012af3f38e4b3a4fbd7c5f34762d1176d4618977a4e0c148bab08bd7
Tags:exeGuLoader

Most interesting Screenshot:

Errors
  • Sigma syntax error: Has an empty selector, Rule: Abusing Azure Browser SSO

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found potential dummy code loops (likely to delay analysis)
Initial sample is a PE file and has a suspicious name
Potential time zone aware malware
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe PID: 5136JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe PID: 5136JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeVirustotal: Detection: 12%Perma Link
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

      System Summary:

      barindex
      Initial sample is a PE file and has a suspicious nameShow sources
      Source: initial sampleStatic PE information: Filename: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeProcess Stats: CPU usage > 98%
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_00402F880_2_00402F88
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02295E330_2_02295E33
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0229626A0_2_0229626A
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022902520_2_02290252
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02295ECB0_2_02295ECB
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02295AD90_2_02295AD9
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02295F310_2_02295F31
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022967050_2_02296705
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022957BD0_2_022957BD
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022963950_2_02296395
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0229841D0_2_0229841D
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0229244E0_2_0229244E
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02295C810_2_02295C81
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02295D2A0_2_02295D2A
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0229613B0_2_0229613B
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022965090_2_02296509
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022935190_2_02293519
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022901620_2_02290162
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022935670_2_02293567
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022959BC0_2_022959BC
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022935890_2_02293589
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0229358D0_2_0229358D
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe, 00000000.00000002.1737310362.0000000000416000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameFricandelle1.exe vs JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe, 00000000.00000002.1738227034.00000000021D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeBinary or memory string: OriginalFilenameFricandelle1.exe vs JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal84.troj.evad.winEXE@1/0@0/0
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeFile created: C:\Users\user\AppData\Local\Temp\~DFA618075B7A804723.TMPJump to behavior
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeVirustotal: Detection: 12%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe PID: 5136, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe PID: 5136, type: MEMORY
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0040787B push C3C31A0Bh; ret 0_2_00407880
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0040A14E push ss; iretd 0_2_0040A14F
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0040AA56 push 4E927E2Fh; ret 0_2_0040AA5C
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0040C333 push edi; retf 0_2_0040C334
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_00408F90 push FFFFFFABh; iretd 0_2_00408F9F
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022950AC push ss; retf 0_2_022950AE
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02294546 push esi; ret 0_2_02294575
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0229519D push eax; iretd 0_2_022951A6
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02297644 0_2_02297644
      Potential time zone aware malwareShow sources
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeSystem information queried: CurrentTimeZoneInformationJump to behavior
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeRDTSC instruction interceptor: First address: 0000000002293853 second address: 0000000002293853 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FC5C8C91CE8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e push di 0x00000020 mov di, FE52h 0x00000024 pop di 0x00000026 add edi, edx 0x00000028 jmp 00007FC5C8C91CDEh 0x0000002a cmp ebx, 8E3A430Eh 0x00000030 dec ecx 0x00000031 cmp ecx, 00000000h 0x00000034 jne 00007FC5C8C91C65h 0x00000036 push ecx 0x00000037 cmp eax, ecx 0x00000039 call 00007FC5C8C91D07h 0x0000003e call 00007FC5C8C91CF8h 0x00000043 lfence 0x00000046 mov edx, dword ptr [7FFE0014h] 0x0000004c lfence 0x0000004f ret 0x00000050 mov esi, edx 0x00000052 pushad 0x00000053 rdtsc
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0229322E rdtsc 0_2_0229322E
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

      Anti Debugging:

      barindex
      Found potential dummy code loops (likely to delay analysis)Show sources
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeProcess Stats: CPU usage > 90% for more than 60s
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_0229322E rdtsc 0_2_0229322E
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02293653 mov eax, dword ptr fs:[00000030h]0_2_02293653
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02296AA6 mov eax, dword ptr fs:[00000030h]0_2_02296AA6
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022922CB mov eax, dword ptr fs:[00000030h]0_2_022922CB
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022922D7 mov eax, dword ptr fs:[00000030h]0_2_022922D7
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_02291C0A mov eax, dword ptr fs:[00000030h]0_2_02291C0A
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022960A4 mov eax, dword ptr fs:[00000030h]0_2_022960A4
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022960A6 mov eax, dword ptr fs:[00000030h]0_2_022960A6
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022925AB mov eax, dword ptr fs:[00000030h]0_2_022925AB
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022925BD mov eax, dword ptr fs:[00000030h]0_2_022925BD
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe, 00000000.00000002.1738036580.0000000000D60000.00000002.00000001.sdmpBinary or memory string: Program Manager
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe, 00000000.00000002.1738036580.0000000000D60000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe, 00000000.00000002.1738036580.0000000000D60000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exe, 00000000.00000002.1738036580.0000000000D60000.00000002.00000001.sdmpBinary or memory string: Progmanlock
      Source: C:\Users\user\Desktop\JAN_QUOTATION_RFQ#38787_A_Bich_Thien_Trading_Co_Ltd.exeCode function: 0_2_022928F4 cpuid 0_2_022928F4

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemorySecurity Software Discovery411Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerVirtualization/Sandbox Evasion11SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSProcess Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsSystem Information Discovery211SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.