Loading ...

Play interactive tourEdit tour

Analysis Report EM_B43454933_7621780_573.exe

Overview

General Information

Sample Name:EM_B43454933_7621780_573.exe
Analysis ID:356208
MD5:b679e85b64a7b5851f0abc9d69740978
SHA1:7c103c70859b5d708ae5ff82a65a67b71272df4d
SHA256:a1677b7e54a0d67b9b16d0a0835187b889db434d77d8a8f3f7714a86b01a27db

Most interesting Screenshot:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Potential malicious icon found
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • EM_B43454933_7621780_573.exe (PID: 6412 cmdline: 'C:\Users\user\Desktop\EM_B43454933_7621780_573.exe' MD5: B679E85B64A7B5851F0ABC9D69740978)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: EM_B43454933_7621780_573.exe PID: 6412JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: EM_B43454933_7621780_573.exe PID: 6412JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: EM_B43454933_7621780_573.exeVirustotal: Detection: 28%Perma Link
      Source: EM_B43454933_7621780_573.exeReversingLabs: Detection: 44%

      Compliance:

      barindex
      Uses 32bit PE filesShow sources
      Source: EM_B43454933_7621780_573.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155885249.00000000007BA000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

      System Summary:

      barindex
      Potential malicious icon foundShow sources
      Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeProcess Stats: CPU usage > 98%
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_004013B00_2_004013B0
      Source: EM_B43454933_7621780_573.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155816119.0000000000750000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs EM_B43454933_7621780_573.exe
      Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155651737.0000000000410000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameNaticahartko.exe vs EM_B43454933_7621780_573.exe
      Source: EM_B43454933_7621780_573.exeBinary or memory string: OriginalFilenameNaticahartko.exe vs EM_B43454933_7621780_573.exe
      Source: EM_B43454933_7621780_573.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal84.rans.troj.evad.winEXE@1/0@0/0
      Source: EM_B43454933_7621780_573.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: EM_B43454933_7621780_573.exeVirustotal: Detection: 28%
      Source: EM_B43454933_7621780_573.exeReversingLabs: Detection: 44%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: EM_B43454933_7621780_573.exe PID: 6412, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: EM_B43454933_7621780_573.exe PID: 6412, type: MEMORY
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_00408621 push ss; retf 0_2_0040862C
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A1473 push FFFFFF84h; retf 0_2_007A1480
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A526C push eax; ret 0_2_007A526D
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A3B44 push edi; retf 0_2_007A3B48
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A4F0A 0_2_007A4F0A
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeRDTSC instruction interceptor: First address: 00000000007A4768 second address: 00000000007A4768 instructions:
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: EM_B43454933_7621780_573.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeRDTSC instruction interceptor: First address: 00000000007A4768 second address: 00000000007A4768 instructions:
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeRDTSC instruction interceptor: First address: 00000000007A2966 second address: 00000000007A2966 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F9EBCBCABB9h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp ax, 000027F4h 0x00000021 cmp ch, ah 0x00000023 pop ecx 0x00000024 cmp ah, dh 0x00000026 add edi, edx 0x00000028 dec ecx 0x00000029 test cl, dl 0x0000002b cmp ecx, 00000000h 0x0000002e jne 00007F9EBCBCAB74h 0x00000030 cmp ah, 00000010h 0x00000033 push ecx 0x00000034 cmp ch, ah 0x00000036 call 00007F9EBCBCABBEh 0x0000003b call 00007F9EBCBCABC9h 0x00000040 lfence 0x00000043 mov edx, dword ptr [7FFE0014h] 0x00000049 lfence 0x0000004c ret 0x0000004d mov esi, edx 0x0000004f pushad 0x00000050 rdtsc
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A2057 rdtsc 0_2_007A2057
      Source: EM_B43454933_7621780_573.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A2057 rdtsc 0_2_007A2057
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A2805 mov eax, dword ptr fs:[00000030h]0_2_007A2805
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A45BD mov eax, dword ptr fs:[00000030h]0_2_007A45BD
      Source: C:\Users\user\Desktop\EM_B43454933_7621780_573.exeCode function: 0_2_007A49A3 mov eax, dword ptr fs:[00000030h]0_2_007A49A3
      Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155960835.0000000000E40000.00000002.00000001.sdmpBinary or memory string: Program Manager
      Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155960835.0000000000E40000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155960835.0000000000E40000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: EM_B43454933_7621780_573.exe, 00000000.00000002.1155960835.0000000000E40000.00000002.00000001.sdmpBinary or memory string: Progmanlock

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Process Injection1Input Capture1Security Software Discovery411Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsObfuscated Files or Information1LSASS MemoryProcess Discovery1Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerSystem Information Discovery31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.