Loading ...

Play interactive tourEdit tour

Analysis Report URGENT MEDICAL REQUIREMENT.exe

Overview

General Information

Sample Name:URGENT MEDICAL REQUIREMENT.exe
Analysis ID:339333
MD5:8272ecc1672ecb390cdedb27df85b20d
SHA1:a77c9fc2b255398f53d28f6e67633c62a0143fa5
SHA256:1a4407fd45881091495f927612c7be23ab6de71949e4192cdc58154986d2c827
Tags:exeGuLoader

Most interesting Screenshot:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Potential time zone aware malware
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: URGENT MEDICAL REQUIREMENT.exe PID: 6388JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: URGENT MEDICAL REQUIREMENT.exe PID: 6388JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: URGENT MEDICAL REQUIREMENT.exeVirustotal: Detection: 24%Perma Link
      Source: URGENT MEDICAL REQUIREMENT.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeProcess Stats: CPU usage > 98%
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422C4B0_2_00422C4B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042206B0_2_0042206B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042526F0_2_0042526F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004216770_2_00421677
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042287B0_2_0042287B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004226000_2_00422600
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004266130_2_00426613
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004252170_2_00425217
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00427A2B0_2_00427A2B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004224370_2_00422437
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004276340_2_00427634
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004252C00_2_004252C0
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004276D70_2_004276D7
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004222F70_2_004222F7
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00425AFF0_2_00425AFF
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422E830_2_00422E83
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004276880_2_00427688
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004254A30_2_004254A3
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042274B0_2_0042274B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422F5F0_2_00422F5F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042335D0_2_0042335D
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004229670_2_00422967
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042797F0_2_0042797F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004233030_2_00423303
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00425D080_2_00425D08
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004275120_2_00427512
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042191B0_2_0042191B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042611F0_2_0042611F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004259370_2_00425937
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004259D30_2_004259D3
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004221D70_2_004221D7
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004275EB0_2_004275EB
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422B830_2_00422B83
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004213AB0_2_004213AB
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004227AF0_2_004227AF
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004253AF0_2_004253AF
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422DB30_2_00422DB3
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00421FBB0_2_00421FBB
      Source: URGENT MEDICAL REQUIREMENT.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258460847.0000000002090000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs URGENT MEDICAL REQUIREMENT.exe
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1257535826.0000000000410000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameHybridizers5.exe vs URGENT MEDICAL REQUIREMENT.exe
      Source: URGENT MEDICAL REQUIREMENT.exeBinary or memory string: OriginalFilenameHybridizers5.exe vs URGENT MEDICAL REQUIREMENT.exe
      Source: URGENT MEDICAL REQUIREMENT.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal84.troj.evad.winEXE@1/0@0/0
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeFile created: C:\Users\user\AppData\Local\Temp\~DFE70F2CB0D79118EF.TMPJump to behavior
      Source: URGENT MEDICAL REQUIREMENT.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: URGENT MEDICAL REQUIREMENT.exeVirustotal: Detection: 24%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: URGENT MEDICAL REQUIREMENT.exe PID: 6388, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: URGENT MEDICAL REQUIREMENT.exe PID: 6388, type: MEMORY
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00405063 pushfd ; iretd 0_2_00405064
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00406863 pushfd ; iretd 0_2_0040686C
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00405E7C push esp; iretd 0_2_00405E84
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004048F3 pushfd ; iretd 0_2_00404998
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004070B3 pushfd ; iretd 0_2_004070B4
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00426CBE push eax; ret 0_2_00426CBF
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00423BD6 push esp; retf 0_2_00423BD7
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00423BF8 push esp; retf 0_2_00423BFE
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042181B 0_2_0042181B
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeRDTSC instruction interceptor: First address: 00000000004265EB second address: 00000000004265EB instructions:
      Potential time zone aware malwareShow sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeSystem information queried: CurrentTimeZoneInformationJump to behavior
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: URGENT MEDICAL REQUIREMENT.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeRDTSC instruction interceptor: First address: 00000000004265EB second address: 00000000004265EB instructions:
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeRDTSC instruction interceptor: First address: 0000000000426348 second address: 0000000000426348 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F9854B64FA8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp ch, dh 0x0000001f add edi, edx 0x00000021 cmp ah, 00000069h 0x00000024 dec dword ptr [ebp+000000F8h] 0x0000002a cmp bl, bl 0x0000002c cmp dword ptr [ebp+000000F8h], 00000000h 0x00000033 jne 00007F9854B64F85h 0x00000035 call 00007F9854B64FD8h 0x0000003a call 00007F9854B64FB8h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00421847 rdtsc 0_2_00421847
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: URGENT MEDICAL REQUIREMENT.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

      Anti Debugging:

      barindex
      Found potential dummy code loops (likely to delay analysis)Show sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeProcess Stats: CPU usage > 90% for more than 60s
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00421847 rdtsc 0_2_00421847
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00426031 mov eax, dword ptr fs:[00000030h]0_2_00426031
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422437 mov eax, dword ptr fs:[00000030h]0_2_00422437
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00425A39 mov eax, dword ptr fs:[00000030h]0_2_00425A39
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042223C mov eax, dword ptr fs:[00000030h]0_2_0042223C
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004232E6 mov eax, dword ptr fs:[00000030h]0_2_004232E6
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042249A mov eax, dword ptr fs:[00000030h]0_2_0042249A
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00421F4F mov eax, dword ptr fs:[00000030h]0_2_00421F4F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00423303 mov eax, dword ptr fs:[00000030h]0_2_00423303
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Progmanlock
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422E83 cpuid 0_2_00422E83

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemorySecurity Software Discovery511Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerVirtualization/Sandbox Evasion11SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSProcess Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsSystem Information Discovery311SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.