Analysis Report EDITORIALIST.exe

Overview

General Information

Sample Name: EDITORIALIST.exe
Analysis ID: 357302
MD5: ea23d3d88f6e6084d4f52d02d261323c
SHA1: 27e0de4101e73e0df337c6dc0311d959dbf52416
SHA256: 9ac2741f888eefffdc8085798f5e381536f67dcebfbf5dac2e9e5bf580c03f9a
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Hides threads from debuggers
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: EDITORIALIST.exe Virustotal: Detection: 64% Perma Link
Source: EDITORIALIST.exe Metadefender: Detection: 18% Perma Link
Source: EDITORIALIST.exe ReversingLabs: Detection: 53%

Compliance:

barindex
Uses 32bit PE files
Source: EDITORIALIST.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: RegAsm.exe, 00000003.00000002.901440850.000000000138A000.00000004.00000001.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=12mRKdfuIjRgrBa6
Source: RegAsm.exe, 00000003.00000002.901451594.00000000013C0000.00000040.00000001.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=12mRKdfuIjRgrBa6hq_a5ZmYgCYE2UePZ
Source: RegAsm.exe, 00000003.00000002.901451594.00000000013C0000.00000040.00000001.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=12mRKdfuIjRgrBa6hq_a5ZmYgCYE2UePZVRQ

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: EDITORIALIST.exe, 00000000.00000002.832810382.000000000073A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

barindex
Contains functionality to call native functions
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A8066D NtSetInformationThread, 0_2_02A8066D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C4F19 NtSetInformationThread, 3_2_013C4F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C5398 NtProtectVirtualMemory, 3_2_013C5398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C57D9 NtQueryInformationProcess, 3_2_013C57D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C04F2 EnumWindows,NtSetInformationThread, 3_2_013C04F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C5736 NtProtectVirtualMemory, 3_2_013C5736
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C595C NtQueryInformationProcess, 3_2_013C595C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C05B2 NtSetInformationThread, 3_2_013C05B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C05A5 NtSetInformationThread, 3_2_013C05A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C59A3 NtQueryInformationProcess, 3_2_013C59A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C57F5 NtQueryInformationProcess, 3_2_013C57F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C59D3 NtQueryInformationProcess, 3_2_013C59D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C0616 NtSetInformationThread, 3_2_013C0616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C1275 NtSetInformationThread, 3_2_013C1275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C5843 NtQueryInformationProcess, 3_2_013C5843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C58A2 NtQueryInformationProcess, 3_2_013C58A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C58F8 NtQueryInformationProcess, 3_2_013C58F8
Detected potential crypto function
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_00401869 0_2_00401869
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_0040181C 0_2_0040181C
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_0040162D 0_2_0040162D
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A844EC 0_2_02A844EC
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A8503C 0_2_02A8503C
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A82834 0_2_02A82834
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A84BF6 0_2_02A84BF6
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A83B28 0_2_02A83B28
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A83938 0_2_02A83938
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A84568 0_2_02A84568
Tries to load missing DLLs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Uses 32bit PE files
Source: EDITORIALIST.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal88.troj.evad.winEXE@4/0@0/1
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:120:WilError_01
Source: C:\Users\user\Desktop\EDITORIALIST.exe File created: C:\Users\user\AppData\Local\Temp\~DF540D32BF41CC60EC.TMP Jump to behavior
Source: EDITORIALIST.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\EDITORIALIST.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\EDITORIALIST.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: EDITORIALIST.exe Virustotal: Detection: 64%
Source: EDITORIALIST.exe Metadefender: Detection: 18%
Source: EDITORIALIST.exe ReversingLabs: Detection: 53%
Source: unknown Process created: C:\Users\user\Desktop\EDITORIALIST.exe 'C:\Users\user\Desktop\EDITORIALIST.exe'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\EDITORIALIST.exe'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\EDITORIALIST.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\EDITORIALIST.exe' Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 00000003.00000002.901451594.00000000013C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 3480, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_00404A09 push FFFFFFF6h; ret 0_2_00404A0B
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_00407088 push ds; iretd 0_2_004070C3
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_004070B3 push ds; iretd 0_2_004070C3
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_00404744 push ds; iretd 0_2_0040474B
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_004029FF push ss; retn 00EAh 0_2_00402AFB
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A854EF push ecx; iretd 0_2_02A85511
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A82016 push AA40AF08h; retf 0_2_02A820F4
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A82B9A push edi; retf 0_2_02A82B9B
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A817F2 push cs; iretd 0_2_02A817F5
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A8552C push ecx; iretd 0_2_02A85511
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A85520 push ecx; iretd 0_2_02A85511
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A80D08 push ds; ret 0_2_02A80D0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C3900 push ebp; iretd 3_2_013C3901
Source: C:\Users\user\Desktop\EDITORIALIST.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Source: C:\Users\user\Desktop\EDITORIALIST.exe RDTSC instruction interceptor: First address: 0000000002A82737 second address: 0000000002A82737 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FBB34455758h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d nop 0x0000001e cmp dx, dx 0x00000021 pop ecx 0x00000022 add edi, edx 0x00000024 dec ecx 0x00000025 cmp ecx, 00000000h 0x00000028 jne 00007FBB3445573Bh 0x0000002a test ebx, edx 0x0000002c cmp dh, bh 0x0000002e push ecx 0x0000002f call 00007FBB3445576Bh 0x00000034 call 00007FBB34455768h 0x00000039 lfence 0x0000003c mov edx, dword ptr [7FFE0014h] 0x00000042 lfence 0x00000045 ret 0x00000046 mov esi, edx 0x00000048 pushad 0x00000049 rdtsc
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Evasive API call chain: GetPEB, DecisionNodes, Sleep
Tries to detect Any.run
Source: C:\Users\user\Desktop\EDITORIALIST.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\EDITORIALIST.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: EDITORIALIST.exe, 00000000.00000002.832822433.0000000000751000.00000004.00000020.sdmp Binary or memory string: VC:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEAH
Source: EDITORIALIST.exe, 00000000.00000002.832822433.0000000000751000.00000004.00000020.sdmp Binary or memory string: U-GA\QEMU-GA.EXE-
Source: RegAsm.exe Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\EDITORIALIST.exe RDTSC instruction interceptor: First address: 0000000002A82737 second address: 0000000002A82737 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FBB34455758h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d nop 0x0000001e cmp dx, dx 0x00000021 pop ecx 0x00000022 add edi, edx 0x00000024 dec ecx 0x00000025 cmp ecx, 00000000h 0x00000028 jne 00007FBB3445573Bh 0x0000002a test ebx, edx 0x0000002c cmp dh, bh 0x0000002e push ecx 0x0000002f call 00007FBB3445576Bh 0x00000034 call 00007FBB34455768h 0x00000039 lfence 0x0000003c mov edx, dword ptr [7FFE0014h] 0x00000042 lfence 0x00000045 ret 0x00000046 mov esi, edx 0x00000048 pushad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\EDITORIALIST.exe RDTSC instruction interceptor: First address: 0000000002A828D0 second address: 0000000002A828D0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FBB34B4F258h 0x0000001d popad 0x0000001e call 00007FBB34B4CFCBh 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RDTSC instruction interceptor: First address: 00000000013C28D0 second address: 00000000013C28D0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FBB34457A68h 0x0000001d popad 0x0000001e call 00007FBB344557DBh 0x00000023 lfence 0x00000026 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A857D9 rdtsc 0_2_02A857D9
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6304 Thread sleep time: -2330000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: EDITORIALIST.exe, 00000000.00000002.832822433.0000000000751000.00000004.00000020.sdmp Binary or memory string: vC:\Program Files\Qemu-ga\qemu-ga.exeAh
Source: RegAsm.exe Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: EDITORIALIST.exe, 00000000.00000002.832822433.0000000000751000.00000004.00000020.sdmp Binary or memory string: u-ga\qemu-ga.exe-

Anti Debugging:

barindex
Contains functionality to hide a thread from the debugger
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C4F19 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000020,00000040,013C064E,00000000,00000000,00000000 3_2_013C4F19
Hides threads from debuggers
Source: C:\Users\user\Desktop\EDITORIALIST.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\EDITORIALIST.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\EDITORIALIST.exe Code function: 0_2_02A857D9 rdtsc 0_2_02A857D9
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C2C7B LdrInitializeThunk, 3_2_013C2C7B
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C4F19 mov eax, dword ptr fs:[00000030h] 3_2_013C4F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C490B mov eax, dword ptr fs:[00000030h] 3_2_013C490B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C13A2 mov eax, dword ptr fs:[00000030h] 3_2_013C13A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C41C4 mov eax, dword ptr fs:[00000030h] 3_2_013C41C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C1A3F mov eax, dword ptr fs:[00000030h] 3_2_013C1A3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C1A39 mov eax, dword ptr fs:[00000030h] 3_2_013C1A39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_013C260C mov eax, dword ptr fs:[00000030h] 3_2_013C260C

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\EDITORIALIST.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 13C0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\EDITORIALIST.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\EDITORIALIST.exe' Jump to behavior
Source: RegAsm.exe, 00000003.00000002.904217090.0000000001D00000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: RegAsm.exe, 00000003.00000002.904217090.0000000001D00000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000003.00000002.904217090.0000000001D00000.00000002.00000001.sdmp Binary or memory string: Progman
Source: RegAsm.exe, 00000003.00000002.904217090.0000000001D00000.00000002.00000001.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 357302 Sample: EDITORIALIST.exe Startdate: 24/02/2021 Architecture: WINDOWS Score: 88 18 Multi AV Scanner detection for submitted file 2->18 20 Yara detected GuLoader 2->20 22 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->22 7 EDITORIALIST.exe 1 1 2->7         started        process3 signatures4 24 Writes to foreign memory regions 7->24 26 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 7->26 28 Tries to detect Any.run 7->28 30 2 other signatures 7->30 10 RegAsm.exe 13 7->10         started        process5 dnsIp6 16 192.168.2.1 unknown unknown 10->16 32 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 10->32 34 Tries to detect Any.run 10->34 36 Tries to detect virtualization through RDTSC time measurements 10->36 38 2 other signatures 10->38 14 conhost.exe 10->14         started        signatures7 process8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private
IP
192.168.2.1