Loading ...

Play interactive tourEdit tour

Analysis Report order.exe

Overview

General Information

Sample Name:order.exe
Analysis ID:378054
MD5:d3a6bd4762c0c4a6f0c0fdf2d1f47915
SHA1:2ec4b075252892291620c389c1b5803d7d89e8d6
SHA256:521fe877cf3543f9f967c17fa046ca186cd931624d6c5c2f61c0363b29e750e7
Tags:GuLoader
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • order.exe (PID: 6496 cmdline: 'C:\Users\user\Desktop\order.exe' MD5: D3A6BD4762C0C4A6F0C0FDF2D1F47915)
    • RegAsm.exe (PID: 6512 cmdline: 'C:\Users\user\Desktop\order.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)
      • conhost.exe (PID: 6528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: RegAsm.exe PID: 6512JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: order.exeVirustotal: Detection: 57%Perma Link
    Source: order.exeMetadefender: Detection: 35%Perma Link
    Source: order.exeReversingLabs: Detection: 39%
    Source: order.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    System Summary:

    barindex
    Initial sample is a PE file and has a suspicious nameShow sources
    Source: initial sampleStatic PE information: Filename: order.exe
    Source: C:\Users\user\Desktop\order.exeProcess Stats: CPU usage > 98%
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess Stats: CPU usage > 98%
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B001AE8_2_00B001AE
    Source: order.exe, 00000000.00000000.317526946.000000000041C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameREVISIONSARBEJDET.exe vs order.exe
    Source: order.exeBinary or memory string: OriginalFilenameREVISIONSARBEJDET.exe vs order.exe
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
    Source: order.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: classification engineClassification label: mal92.troj.evad.winEXE@4/0@0/0
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_01
    Source: C:\Users\user\Desktop\order.exeFile created: C:\Users\user\AppData\Local\Temp\~DF9AF78BB154A6012A.TMPJump to behavior
    Source: order.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\order.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: C:\Users\user\Desktop\order.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: order.exeVirustotal: Detection: 57%
    Source: order.exeMetadefender: Detection: 35%
    Source: order.exeReversingLabs: Detection: 39%
    Source: unknownProcess created: C:\Users\user\Desktop\order.exe 'C:\Users\user\Desktop\order.exe'
    Source: C:\Users\user\Desktop\order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\order.exe'
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\order.exe' Jump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 6512, type: MEMORY
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0569F push edi; retf 8_2_00B0569E
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B078F5 push ds; ret 8_2_00B078F6
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B052EB push edi; retf 8_2_00B05359
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B05617 push edi; retf 8_2_00B05679
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0567A push edi; retf 8_2_00B05679
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0567A push edi; retf 8_2_00B0569E
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0537F push edi; retf 8_2_00B0537E
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0535A push edi; retf 8_2_00B05359
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0535A push edi; retf 8_2_00B0537E
    Source: C:\Users\user\Desktop\order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

    Malware Analysis System Evasion:

    barindex
    Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B030B4 8_2_00B030B4
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B032BE 8_2_00B032BE
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02C83 8_2_00B02C83
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02C85 8_2_00B02C85
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02CE6 8_2_00B02CE6
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02ED9 8_2_00B02ED9
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0300D 8_2_00B0300D
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02E7C 8_2_00B02E7C
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03050 8_2_00B03050
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03657 8_2_00B03657
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03640 8_2_00B03640
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03248 8_2_00B03248
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02FB6 8_2_00B02FB6
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02DA6 8_2_00B02DA6
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B035F7 8_2_00B035F7
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02DFD 8_2_00B02DFD
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B031DB 8_2_00B031DB
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0373B 8_2_00B0373B
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0372A 8_2_00B0372A
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02910 8_2_00B02910
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0311A 8_2_00B0311A
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03176 8_2_00B03176
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03752 8_2_00B03752
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02D42 8_2_00B02D42
    Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 0000000002115779 second address: 0000000002115779 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FAC50D99578h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test dx, 0BE2h 0x00000022 pop ecx 0x00000023 test bl, cl 0x00000025 add edi, edx 0x00000027 cmp cx, DF6Fh 0x0000002c dec ecx 0x0000002d jmp 00007FAC50D995BAh 0x0000002f test bh, dh 0x00000031 cmp ecx, 00000000h 0x00000034 jne 00007FAC50D994C2h 0x0000003a jmp 00007FAC50D995B2h 0x0000003c test dx, ax 0x0000003f cmp eax, ebx 0x00000041 push ecx 0x00000042 cmp ebx, ebx 0x00000044 call 00007FAC50D995ECh 0x00000049 call 00007FAC50D99588h 0x0000004e lfence 0x00000051 mov edx, dword ptr [7FFE0014h] 0x00000057 lfence 0x0000005a ret 0x0000005b mov esi, edx 0x0000005d pushad 0x0000005e rdtsc
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 0000000002110F1E second address: 0000000002110F1E instructions:
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 0000000002114FD8 second address: 0000000002114FD8 instructions:
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 000000000211501A second address: 000000000211501A instructions:
    Tries to detect Any.runShow sources
    Source: C:\Users\user\Desktop\order.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
    Source: C:\Users\user\Desktop\order.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
    Source: RegAsm.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
    Tries to detect virtualization through RDTSC time measurementsShow sources
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 0000000002115779 second address: 0000000002115779 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FAC50D99578h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test dx, 0BE2h 0x00000022 pop ecx 0x00000023 test bl, cl 0x00000025 add edi, edx 0x00000027 cmp cx, DF6Fh 0x0000002c dec ecx 0x0000002d jmp 00007FAC50D995BAh 0x0000002f test bh, dh 0x00000031 cmp ecx, 00000000h 0x00000034 jne 00007FAC50D994C2h 0x0000003a jmp 00007FAC50D995B2h 0x0000003c test dx, ax 0x0000003f cmp eax, ebx 0x00000041 push ecx 0x00000042 cmp ebx, ebx 0x00000044 call 00007FAC50D995ECh 0x00000049 call 00007FAC50D99588h 0x0000004e lfence 0x00000051 mov edx, dword ptr [7FFE0014h] 0x00000057 lfence 0x0000005a ret 0x0000005b mov esi, edx 0x0000005d pushad 0x0000005e rdtsc
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 0000000002115B71 second address: 0000000002115B71 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FAC50D9BD0Bh 0x0000001d popad 0x0000001e jmp 00007FAC50D96A66h 0x00000020 test ecx, ecx 0x00000022 call 00007FAC50D96A6Eh 0x00000027 lfence 0x0000002a rdtsc
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 0000000002110F1E second address: 0000000002110F1E instructions:
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 0000000002114FD8 second address: 0000000002114FD8 instructions:
    Source: C:\Users\user\Desktop\order.exeRDTSC instruction interceptor: First address: 000000000211501A second address: 000000000211501A instructions:
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B030B4 rdtsc 8_2_00B030B4
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: RegAsm.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess Stats: CPU usage > 90% for more than 60s
    Hides threads from debuggersShow sources
    Source: C:\Users\user\Desktop\order.exeThread information set: HideFromDebuggerJump to behavior
    Source: C:\Users\user\Desktop\order.exeProcess queried: DebugPortJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B030B4 rdtsc 8_2_00B030B4
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B02C83 mov eax, dword ptr fs:[00000030h]8_2_00B02C83
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03AC5 mov eax, dword ptr fs:[00000030h]8_2_00B03AC5
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03AC7 mov eax, dword ptr fs:[00000030h]8_2_00B03AC7
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03640 mov eax, dword ptr fs:[00000030h]8_2_00B03640
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0A5BF mov eax, dword ptr fs:[00000030h]8_2_00B0A5BF
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B053F5 mov eax, dword ptr fs:[00000030h]8_2_00B053F5
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B053F7 mov eax, dword ptr fs:[00000030h]8_2_00B053F7
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B03B2A mov eax, dword ptr fs:[00000030h]8_2_00B03B2A
    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 8_2_00B0910E mov eax, dword ptr fs:[00000030h]8_2_00B0910E
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

    HIPS / PFW / Operating System Protection Evasion:

    barindex
    Writes to foreign memory regionsShow sources
    Source: C:\Users\user\Desktop\order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B00000Jump to behavior
    Source: C:\Users\user\Desktop\order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\order.exe' Jump to behavior
    Source: RegAsm.exe, 00000008.00000002.582948928.0000000001340000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
    Source: RegAsm.exe, 00000008.00000002.582948928.0000000001340000.00000002.00000001.sdmpBinary or memory string: Progman
    Source: RegAsm.exe, 00000008.00000002.582948928.0000000001340000.00000002.00000001.sdmpBinary or memory string: &Program Manager
    Source: RegAsm.exe, 00000008.00000002.582948928.0000000001340000.00000002.00000001.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationDLL Side-Loading1Process Injection112Virtualization/Sandbox Evasion311OS Credential DumpingSecurity Software Discovery721Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsDLL Side-Loading1Process Injection112LSASS MemoryVirtualization/Sandbox Evasion311Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)DLL Side-Loading1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information1NTDSSystem Information Discovery31Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.