Loading ...

Play interactive tourEdit tour

Analysis Report SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe

Overview

General Information

Sample Name:SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe
Analysis ID:339384
MD5:276d1a6d58cc96bec4ccf5f19d395170
SHA1:c918ee3a14f5fe894ae66322a8c577b4cf5a90b3
SHA256:ef89d342ca08bb27526ec176d4a359bb99e406ccccfc16a9f704d706574e215f
Tags:exeGuLoader

Most interesting Screenshot:

Detection

GuLoader
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Potential time zone aware malware
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe PID: 6072JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe PID: 6072JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274016968.000000000079A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeProcess Stats: CPU usage > 98%
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1272656837.0000000000410000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameIranske.exe vs SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1273773993.0000000000740000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeBinary or memory string: OriginalFilenameIranske.exe vs SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal76.troj.evad.winEXE@1/0@0/0
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeFile created: C:\Users\user\AppData\Local\Temp\~DF0ED9CA4C86CF4DE5.TMPJump to behavior
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe PID: 6072, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe PID: 6072, type: MEMORY
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00407820 push ds; retf 0_2_00407891
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00406E33 push ebp; retf 0_2_00406E38
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_004048E0 push ebp; ret 0_2_004048E4
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00406A8F push ebp; retf 0_2_00406A90
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00406C95 push ecx; retf 0_2_00406D35
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00405568 push esp; retf 0_2_0040556C
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00406B0C push ds; retf 0_2_00406B31
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_004077D4 push es; ret 0_2_004077F7
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_004077D4 push ds; retf 0_2_00407891
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00404DDB push ecx; retf 0_2_00404DE1
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00406BF1 push cs; ret 0_2_00406C0A
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_004047B2 push ebp; retf 0_2_004047B8
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00784A33 push esp; iretd 0_2_00784A34
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00780005 push esp; ret 0_2_0078009A
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00780007 push esp; ret 0_2_0078009A
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007800AD push esp; ret 0_2_0078009A
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007800AD push esp; ret 0_2_00780101
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_0078009B push esp; ret 0_2_0078009A
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_0078009B push edx; retf 0_2_007800A9
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00784A90 push eax; retf 0_2_00784A9F
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00780102 push esp; ret 0_2_00780101
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00780102 push edx; retf 0_2_00780110
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00784049 0_2_00784049
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007840FD 0_2_007840FD
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00784094 0_2_00784094
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007825F7 0_2_007825F7
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00781BD9 0_2_00781BD9
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeRDTSC instruction interceptor: First address: 00000000007866BA second address: 00000000007866BA instructions:
      Potential time zone aware malwareShow sources
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeSystem information queried: CurrentTimeZoneInformationJump to behavior
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1273943775.0000000000780000.00000040.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE8
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeRDTSC instruction interceptor: First address: 00000000007866BA second address: 00000000007866BA instructions:
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeRDTSC instruction interceptor: First address: 000000000078628D second address: 000000000078628D instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FA4E4759B24h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f jmp 00007FA4E4759B1Ah 0x00000021 test bl, bl 0x00000023 dec dword ptr [ebp+000000F8h] 0x00000029 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000030 jne 00007FA4E4759A6Eh 0x00000032 fnop 0x00000034 call 00007FA4E4759B53h 0x00000039 call 00007FA4E4759B34h 0x0000003e lfence 0x00000041 mov edx, dword ptr [7FFE0014h] 0x00000047 lfence 0x0000004a ret 0x0000004b mov esi, edx 0x0000004d pushad 0x0000004e rdtsc
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00782870 rdtsc 0_2_00782870
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1273943775.0000000000780000.00000040.00000001.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe8
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

      Anti Debugging:

      barindex
      Found potential dummy code loops (likely to delay analysis)Show sources
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeProcess Stats: CPU usage > 90% for more than 60s
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00782870 rdtsc 0_2_00782870
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_0078346F mov eax, dword ptr fs:[00000030h]0_2_0078346F
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00786A35 mov eax, dword ptr fs:[00000030h]0_2_00786A35
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00786A19 mov eax, dword ptr fs:[00000030h]0_2_00786A19
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007838D0 mov eax, dword ptr fs:[00000030h]0_2_007838D0
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00782368 mov eax, dword ptr fs:[00000030h]0_2_00782368
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_0078232A mov eax, dword ptr fs:[00000030h]0_2_0078232A
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00785F14 mov eax, dword ptr fs:[00000030h]0_2_00785F14
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007825FF mov eax, dword ptr fs:[00000030h]0_2_007825FF
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007825F7 mov eax, dword ptr fs:[00000030h]0_2_007825F7
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00781BD9 mov eax, dword ptr fs:[00000030h]0_2_00781BD9
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007859D7 mov eax, dword ptr fs:[00000030h]0_2_007859D7
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007867C1 mov eax, dword ptr fs:[00000030h]0_2_007867C1
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_007823AE mov eax, dword ptr fs:[00000030h]0_2_007823AE
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274157084.0000000000E20000.00000002.00000001.sdmpBinary or memory string: Program Manager
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274157084.0000000000E20000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274157084.0000000000E20000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exe, 00000000.00000002.1274157084.0000000000E20000.00000002.00000001.sdmpBinary or memory string: Progmanlock
      Source: C:\Users\user\Desktop\SPPG contract 9200355_Acma Engineers SP Power_Contract No 9200355.exeCode function: 0_2_00784E29 cpuid 0_2_00784E29

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11Input Capture1System Time Discovery1Remote ServicesInput Capture1Exfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemorySecurity Software Discovery511Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerVirtualization/Sandbox Evasion11SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSProcess Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsSystem Information Discovery311SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.