Analysis Report EM_B43454933_7621780_573.exe

ID:	356208
Product:	CloudBasic
Start time:	18:59:17
Start date:	22.02.2021
Sample:	EM_B43454933_7621780_573.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	b679e85b64a7b5851f0abc9d69740978
SHA1:	7c103c70859b5d708ae5ff82a65a67b71272df4d
SHA256:	a1677b7e54a0d67b9b16d0a0835187b889db434d77d8a8f3f7714a86b01a27db
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Multi AV Scanner detection for submitted file

Source: EM_B43454933_7621780_573.exe	Virustotal: Detection: 28%			Perma Link
Source: EM_B43454933_7621780_573.exe	ReversingLabs: Detection: 44%

Compliance:

Uses 32bit PE files

Source: EM_B43454933_7621780_573.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155885249.00000000007BA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

Process Stats: CPU usage > 98%

Detected potential crypto function

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

Code function: 0_2_004013B0

0_2_004013B0

PE file contains strange resources

Source: EM_B43454933_7621780_573.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155816119.0000000000750000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs EM_B43454933_7621780_573.exe
Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155651737.0000000000410000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameNaticahartko.exe vs EM_B43454933_7621780_573.exe
Source: EM_B43454933_7621780_573.exe	Binary or memory string: OriginalFilenameNaticahartko.exe vs EM_B43454933_7621780_573.exe

Uses 32bit PE files

Source: EM_B43454933_7621780_573.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal84.rans.troj.evad.winEXE@1/0@0/0

PE file has an executable .text section and no other executable section

Source: EM_B43454933_7621780_573.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: EM_B43454933_7621780_573.exe	Virustotal: Detection: 28%
Source: EM_B43454933_7621780_573.exe	ReversingLabs: Detection: 44%

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: Process Memory Space: EM_B43454933_7621780_573.exe PID: 6412, type: MEMORY

Yara detected VB6 Downloader Generic

Source: Yara match

File source: Process Memory Space: EM_B43454933_7621780_573.exe PID: 6412, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe	Code function: 0_2_00408621 push ss; retf		0_2_0040862C
Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe	Code function: 0_2_007A1473 push FFFFFF84h; retf		0_2_007A1480
Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe	Code function: 0_2_007A526C push eax; ret		0_2_007A526D
Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe	Code function: 0_2_007A3B44 push edi; retf		0_2_007A3B48

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

Code function: 0_2_007A4F0A

0_2_007A4F0A

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

RDTSC instruction interceptor: First address: 00000000007A4768 second address: 00000000007A4768 instructions:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: EM_B43454933_7621780_573.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

RDTSC instruction interceptor: First address: 00000000007A4768 second address: 00000000007A4768 instructions:

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

RDTSC instruction interceptor: First address: 00000000007A2966 second address: 00000000007A2966 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F9EBCBCABB9h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp ax, 000027F4h 0x00000021 cmp ch, ah 0x00000023 pop ecx 0x00000024 cmp ah, dh 0x00000026 add edi, edx 0x00000028 dec ecx 0x00000029 test cl, dl 0x0000002b cmp ecx, 00000000h 0x0000002e jne 00007F9EBCBCAB74h 0x00000030 cmp ah, 00000010h 0x00000033 push ecx 0x00000034 cmp ch, ah 0x00000036 call 00007F9EBCBCABBEh 0x0000003b call 00007F9EBCBCABC9h 0x00000040 lfence 0x00000043 mov edx, dword ptr [7FFE0014h] 0x00000049 lfence 0x0000004c ret 0x0000004d mov esi, edx 0x0000004f pushad 0x00000050 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

Code function: 0_2_007A2057 rdtsc

0_2_007A2057

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: EM_B43454933_7621780_573.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe

Code function: 0_2_007A2057 rdtsc

0_2_007A2057

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe	Code function: 0_2_007A2805 mov eax, dword ptr fs:[00000030h]		0_2_007A2805
Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe	Code function: 0_2_007A45BD mov eax, dword ptr fs:[00000030h]		0_2_007A45BD
Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exe	Code function: 0_2_007A49A3 mov eax, dword ptr fs:[00000030h]		0_2_007A49A3

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155960835.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155960835.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155960835.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155960835.0000000000E40000.00000002.00000001.sdmp	Binary or memory string: Progmanlock