Analysis Report FACTURA Y ALBARANES.exe

ID:	358414
Product:	CloudBasic
Start time:	15:36:09
Start date:	25.02.2021
Sample:	FACTURA Y ALBARANES.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	0495f304201fbe589c3826bb8e8ab5cd
SHA1:	14dd46d175d5b04c105794c4b41cc5a6fb1fca3f
SHA256:	31970d5ad477b508e0b677485fa10a588b0ece66dbf8eaddee7973977ead6c07
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

Compliance:

Uses 32bit PE files

Source: FACTURA Y ALBARANES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Abnormal high CPU Usage

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Process Stats: CPU usage > 98%

Detected potential crypto function

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_00401A39		0_2_00401A39
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_004019EC		0_2_004019EC
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_004017F9		0_2_004017F9

Sample file is different than original file name gathered from version info

Source: FACTURA Y ALBARANES.exe, 00000000.00000002.916929682.0000000000412000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameXanthophane.exe vs FACTURA Y ALBARANES.exe
Source: FACTURA Y ALBARANES.exe	Binary or memory string: OriginalFilenameXanthophane.exe vs FACTURA Y ALBARANES.exe

Tries to load missing DLLs

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Uses 32bit PE files

Source: FACTURA Y ALBARANES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal80.troj.evad.winEXE@4/0@0/0

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1324:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

File created: C:\Users\user\AppData\Local\Temp\~DFCDCE4BCF2D89DFDA.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: FACTURA Y ALBARANES.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe 'C:\Users\user\Desktop\FACTURA Y ALBARANES.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FACTURA Y ALBARANES.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FACTURA Y ALBARANES.exe'			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7052, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_00409202 push cs; ret		0_2_00409205
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_0040400A pushad ; ret		0_2_0040400B
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_0040BC24 push edi; retn 0004h		0_2_0040C111
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_004026DF pushad ; retf		0_2_004026E1
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_0040AEA9 push edi; retn 0004h		0_2_0040C111
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_00404D33 push FFFFFFBFh; ret		0_2_00404D35
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_004083E6 push FFFFFFAAh; iretd		0_2_004083F1
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_02212828 push ecx; ret		0_2_02212829
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Code function: 0_2_0221458D push edi; iretd		0_2_0221458E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B057AB push ebx; retf		13_2_00B057AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B03963 push 00000013h; iretd		13_2_00B0397F

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B017E4		13_2_00B017E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B017C7		13_2_00B017C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B01338		13_2_00B01338

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

RDTSC instruction interceptor: First address: 00000000022126E7 second address: 00000000022126E7 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FE598A58588h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e test dl, cl 0x00000020 add edi, edx 0x00000022 dec ecx 0x00000023 jmp 00007FE598A585AEh 0x00000025 clc 0x00000026 cmp ecx, 00000000h 0x00000029 jne 00007FE598A58542h 0x0000002b push ecx 0x0000002c call 00007FE598A585CEh 0x00000031 call 00007FE598A58598h 0x00000036 lfence 0x00000039 mov edx, dword ptr [7FFE0014h] 0x0000003f lfence 0x00000042 ret 0x00000043 mov esi, edx 0x00000045 pushad 0x00000046 rdtsc

Tries to detect Any.run

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

RDTSC instruction interceptor: First address: 00000000022126E7 second address: 00000000022126E7 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FE598A58588h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e test dl, cl 0x00000020 add edi, edx 0x00000022 dec ecx 0x00000023 jmp 00007FE598A585AEh 0x00000025 clc 0x00000026 cmp ecx, 00000000h 0x00000029 jne 00007FE598A58542h 0x0000002b push ecx 0x0000002c call 00007FE598A585CEh 0x00000031 call 00007FE598A58598h 0x00000036 lfence 0x00000039 mov edx, dword ptr [7FFE0014h] 0x0000003f lfence 0x00000042 ret 0x00000043 mov esi, edx 0x00000045 pushad 0x00000046 rdtsc

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

RDTSC instruction interceptor: First address: 0000000002212842 second address: 0000000002212842 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FE598A5A90Ah 0x0000001d popad 0x0000001e call 00007FE598A5849Dh 0x00000023 lfence 0x00000026 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_00B02AAE rdtsc

13_2_00B02AAE

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: RegAsm.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 90% for more than 60s

Hides threads from debuggers

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

Process queried: DebugPort

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_00B02AAE rdtsc

13_2_00B02AAE

Contains functionality to read the PEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B0440E mov eax, dword ptr fs:[00000030h]		13_2_00B0440E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B05046 mov eax, dword ptr fs:[00000030h]		13_2_00B05046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B0259E mov eax, dword ptr fs:[00000030h]		13_2_00B0259E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B01338 mov eax, dword ptr fs:[00000030h]		13_2_00B01338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B01959 mov eax, dword ptr fs:[00000030h]		13_2_00B01959
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00B0195C mov eax, dword ptr fs:[00000030h]		13_2_00B0195C

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B00000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\FACTURA Y ALBARANES.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FACTURA Y ALBARANES.exe'

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: FACTURA Y ALBARANES.exe, 00000000.00000002.917130832.0000000000D90000.00000002.00000001.sdmp, RegAsm.exe, 0000000D.00000002.916933582.0000000001380000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: FACTURA Y ALBARANES.exe, 00000000.00000002.917130832.0000000000D90000.00000002.00000001.sdmp, RegAsm.exe, 0000000D.00000002.916933582.0000000001380000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: FACTURA Y ALBARANES.exe, 00000000.00000002.917130832.0000000000D90000.00000002.00000001.sdmp, RegAsm.exe, 0000000D.00000002.916933582.0000000001380000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: FACTURA Y ALBARANES.exe, 00000000.00000002.917130832.0000000000D90000.00000002.00000001.sdmp, RegAsm.exe, 0000000D.00000002.916933582.0000000001380000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_00B02AAE cpuid

13_2_00B02AAE