Analysis Report SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe

Overview

General Information

Sample Name: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe
Analysis ID: 339384
MD5: 276d1a6d58cc96bec4ccf5f19d395170
SHA1: c918ee3a14f5fe894ae66322a8c577b4cf5a90b3
SHA256: ef89d342ca08bb27526ec176d4a359bb99e406ccccfc16a9f704d706574e215f
Tags: exeGuLoader

Most interesting Screenshot:

Detection

GuLoader
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Potential time zone aware malware
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Compliance:

barindex
Uses 32bit PE files
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274016968.000000000079A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Process Stats: CPU usage > 98%
PE file contains strange resources
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1272656837.0000000000410000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameIranske.exe vs SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1273773993.0000000000740000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Binary or memory string: OriginalFilenameIranske.exe vs SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe
Uses 32bit PE files
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal76.troj.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe File created: C:\Users\user\AppData\Local\Temp\~DF0ED9CA4C86CF4DE5.TMP Jump to behavior
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: Process Memory Space: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe PID: 6072, type: MEMORY
Yara detected VB6 Downloader Generic
Source: Yara match File source: Process Memory Space: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe PID: 6072, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00407820 push ds; retf 0_2_00407891
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00406E33 push ebp; retf 0_2_00406E38
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_004048E0 push ebp; ret 0_2_004048E4
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00406A8F push ebp; retf 0_2_00406A90
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00406C95 push ecx; retf 0_2_00406D35
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00405568 push esp; retf 0_2_0040556C
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00406B0C push ds; retf 0_2_00406B31
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_004077D4 push es; ret 0_2_004077F7
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_004077D4 push ds; retf 0_2_00407891
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00404DDB push ecx; retf 0_2_00404DE1
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00406BF1 push cs; ret 0_2_00406C0A
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_004047B2 push ebp; retf 0_2_004047B8
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00784A33 push esp; iretd 0_2_00784A34
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00780005 push esp; ret 0_2_0078009A
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00780007 push esp; ret 0_2_0078009A
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007800AD push esp; ret 0_2_0078009A
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007800AD push esp; ret 0_2_00780101
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_0078009B push esp; ret 0_2_0078009A
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_0078009B push edx; retf 0_2_007800A9
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00784A90 push eax; retf 0_2_00784A9F
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00780102 push esp; ret 0_2_00780101
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00780102 push edx; retf 0_2_00780110
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00784049 0_2_00784049
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007840FD 0_2_007840FD
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00784094 0_2_00784094
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007825F7 0_2_007825F7
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00781BD9 0_2_00781BD9
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe RDTSC instruction interceptor: First address: 00000000007866BA second address: 00000000007866BA instructions:
Potential time zone aware malware
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe System information queried: CurrentTimeZoneInformation Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1273943775.0000000000780000.00000040.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE8
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe RDTSC instruction interceptor: First address: 00000000007866BA second address: 00000000007866BA instructions:
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe RDTSC instruction interceptor: First address: 000000000078628D second address: 000000000078628D instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FA4E4759B24h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f jmp 00007FA4E4759B1Ah 0x00000021 test bl, bl 0x00000023 dec dword ptr [ebp+000000F8h] 0x00000029 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000030 jne 00007FA4E4759A6Eh 0x00000032 fnop 0x00000034 call 00007FA4E4759B53h 0x00000039 call 00007FA4E4759B34h 0x0000003e lfence 0x00000041 mov edx, dword ptr [7FFE0014h] 0x00000047 lfence 0x0000004a ret 0x0000004b mov esi, edx 0x0000004d pushad 0x0000004e rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00782870 rdtsc 0_2_00782870
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1273943775.0000000000780000.00000040.00000001.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe8
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

barindex
Found potential dummy code loops (likely to delay analysis)
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Process Stats: CPU usage > 90% for more than 60s
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00782870 rdtsc 0_2_00782870
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_0078346F mov eax, dword ptr fs:[00000030h] 0_2_0078346F
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00786A35 mov eax, dword ptr fs:[00000030h] 0_2_00786A35
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00786A19 mov eax, dword ptr fs:[00000030h] 0_2_00786A19
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007838D0 mov eax, dword ptr fs:[00000030h] 0_2_007838D0
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00782368 mov eax, dword ptr fs:[00000030h] 0_2_00782368
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_0078232A mov eax, dword ptr fs:[00000030h] 0_2_0078232A
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00785F14 mov eax, dword ptr fs:[00000030h] 0_2_00785F14
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007825FF mov eax, dword ptr fs:[00000030h] 0_2_007825FF
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007825F7 mov eax, dword ptr fs:[00000030h] 0_2_007825F7
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00781BD9 mov eax, dword ptr fs:[00000030h] 0_2_00781BD9
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007859D7 mov eax, dword ptr fs:[00000030h] 0_2_007859D7
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007867C1 mov eax, dword ptr fs:[00000030h] 0_2_007867C1
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_007823AE mov eax, dword ptr fs:[00000030h] 0_2_007823AE
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274157084.0000000000E20000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274157084.0000000000E20000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274157084.0000000000E20000.00000002.00000001.sdmp Binary or memory string: Progman
Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274157084.0000000000E20000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe Code function: 0_2_00784E29 cpuid 0_2_00784E29
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 339384 Sample: SPPG contract 9200355_Acma ... Startdate: 13/01/2021 Architecture: WINDOWS Score: 76 8 Yara detected GuLoader 2->8 10 Contains functionality to detect hardware virtualization (CPUID execution measurement) 2->10 12 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->12 14 4 other signatures 2->14 5 SPPG contract 9200355_Acma Engineers SP Power_Contract No  9200355.exe 1 2->5         started        process3 signatures4 16 Potential time zone aware malware 5->16
No contacted IP infos