Analysis Report Orden de Compra.exe

Overview

General Information

Sample Name: Orden de Compra.exe
Analysis ID: 383316
MD5: e6dcf6b66b611ffb7d2bc1a8045bf41f
SHA1: 7b3871b1b077f764175c6d387e846372128a89ee
SHA256: 280e118484090c0a9788dcad52f37995822757f44d230c9ff042c3507d8e20a3
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Hides threads from debuggers
Machine Learning detection for sample
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains strange resources
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: Orden de Compra.exe ReversingLabs: Detection: 10%
Machine Learning detection for sample
Source: Orden de Compra.exe Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: Orden de Compra.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp, RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp, RegAsm.exe, 00000017.00000002.849793142.00000000013EF000.00000004.00000020.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/drive-explorer/
Source: RegAsm.exe, 00000017.00000002.849793142.00000000013EF000.00000004.00000020.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/drive-explorer/TeA
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/.
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/=
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/A
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/_
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/b
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/c
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/user
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/j
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/r
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp, RegAsm.exe, 00000017.00000002.849793142.00000000013EF000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm#
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm$
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm/
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm2#:
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm4.8
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm:
Source: RegAsm.exe, 00000017.00000002.849757830.00000000013D8000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMm=
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmB_AXxsO7DxxXTMm
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmB_AXxsO7DxxXTMm5
Source: RegAsm.exe, 00000017.00000002.849757830.00000000013D8000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmCR
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmH.
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmK
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmN
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmV-&
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmW
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmb
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmd
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmd/
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmg
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmj-
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmr.
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMms
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmx
Source: RegAsm.exe, 00000017.00000002.849852280.0000000001439000.00000004.00000020.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=10rK4wk5oFGyPK_N03B_AXxsO7DxxXTMmz/
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp String found in binary or memory: https://pki.goog/repository/0

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\Orden de Compra.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011071B1 NtQueryInformationProcess, 23_2_011071B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01106C57 NtProtectVirtualMemory, 23_2_01106C57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01100898 NtSetInformationThread,LoadLibraryA, 23_2_01100898
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01100631 EnumWindows,NtSetInformationThread, 23_2_01100631
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011066BF NtSetInformationThread, 23_2_011066BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110751D NtQueryInformationProcess, 23_2_0110751D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110754B NtQueryInformationProcess, 23_2_0110754B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011075C1 NtQueryInformationProcess, 23_2_011075C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011071C9 NtQueryInformationProcess, 23_2_011071C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011071E9 NtQueryInformationProcess, 23_2_011071E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011075ED NtQueryInformationProcess, 23_2_011075ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01107416 NtQueryInformationProcess, 23_2_01107416
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01107435 NtQueryInformationProcess, 23_2_01107435
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01107455 NtQueryInformationProcess, 23_2_01107455
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110749D NtQueryInformationProcess, 23_2_0110749D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01106C81 NtProtectVirtualMemory, 23_2_01106C81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011014BF NtSetInformationThread, 23_2_011014BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011074C6 NtQueryInformationProcess, 23_2_011074C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011074F5 NtQueryInformationProcess, 23_2_011074F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01107316 NtQueryInformationProcess, 23_2_01107316
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110070D NtSetInformationThread, 23_2_0110070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01107353 NtQueryInformationProcess, 23_2_01107353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01105F5B NtSetInformationThread, 23_2_01105F5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110074A NtSetInformationThread, 23_2_0110074A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110736E NtQueryInformationProcess, 23_2_0110736E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011073B1 NtQueryInformationProcess, 23_2_011073B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011007AD NtSetInformationThread, 23_2_011007AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011073F1 NtQueryInformationProcess, 23_2_011073F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01105E17 NtSetInformationThread, 23_2_01105E17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01107209 NtQueryInformationProcess, 23_2_01107209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110722A NtQueryInformationProcess, 23_2_0110722A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01105E4F NtSetInformationThread, 23_2_01105E4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01107267 NtQueryInformationProcess, 23_2_01107267
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110728B NtQueryInformationProcess, 23_2_0110728B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011006B1 NtSetInformationThread, 23_2_011006B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011072A9 NtQueryInformationProcess, 23_2_011072A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011006CD NtSetInformationThread, 23_2_011006CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011072CE NtQueryInformationProcess, 23_2_011072CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011072EF NtQueryInformationProcess, 23_2_011072EF
Detected potential crypto function
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00408F7E 1_2_00408F7E
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040904E 1_2_0040904E
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040942F 1_2_0040942F
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_004090D1 1_2_004090D1
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00409158 1_2_00409158
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040D5E2 1_2_0040D5E2
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_004095E7 1_2_004095E7
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040959E 1_2_0040959E
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00409672 1_2_00409672
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_004092D3 1_2_004092D3
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_004096FD 1_2_004096FD
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040931B 1_2_0040931B
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00409796 1_2_00409796
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_004093A0 1_2_004093A0
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00408FBB 1_2_00408FBB
PE file contains strange resources
Source: Orden de Compra.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Orden de Compra.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Orden de Compra.exe, 00000001.00000002.797833511.0000000000416000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameGulvhoejde9.exe vs Orden de Compra.exe
Source: Orden de Compra.exe, 00000001.00000002.798116754.00000000020C0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs Orden de Compra.exe
Source: Orden de Compra.exe Binary or memory string: OriginalFilenameGulvhoejde9.exe vs Orden de Compra.exe
Tries to load missing DLLs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Uses 32bit PE files
Source: Orden de Compra.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal96.troj.evad.winEXE@10/0@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5980:120:WilError_01
Source: C:\Users\user\Desktop\Orden de Compra.exe File created: C:\Users\user\AppData\Local\Temp\~DF2E7F733036C9C82D.TMP Jump to behavior
Source: Orden de Compra.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Orden de Compra.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Orden de Compra.exe ReversingLabs: Detection: 10%
Source: unknown Process created: C:\Users\user\Desktop\Orden de Compra.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 00000017.00000002.849537125.0000000001100000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6128, type: MEMORY
PE file contains an invalid checksum
Source: Orden de Compra.exe Static PE information: real checksum: 0x267f4 should be: 0x2673a
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00402027 push ss; ret 1_2_0040204C
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00404569 push FFFFFFCDh; ret 1_2_004046DC
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040753C push ebx; ret 1_2_0040753E
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040D5E2 pushfd ; iretd 1_2_0040D812
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00404671 push FFFFFFCDh; ret 1_2_004046DC
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040BA18 push 7600FFCEh; iretd 1_2_0040BA1D
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_0040DAC0 push ss; ret 1_2_0040DAC7
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00407AF1 push FFFFFF85h; ret 1_2_00407AF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011049EE push ss; iretd 23_2_01104A1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011050D6 push ss; retn 0008h 23_2_0110510E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011048E9 push ss; iretd 23_2_01104A1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01103A85 push esi; ret 23_2_01103AA9
Source: C:\Users\user\Desktop\Orden de Compra.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01103C14 InternetOpenA,InternetOpenUrlA,LoadLibraryA, 23_2_01103C14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01100898 NtSetInformationThread,LoadLibraryA, 23_2_01100898
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110171E 23_2_0110171E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01101746 23_2_01101746
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01101783 23_2_01101783
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000545B81 second address: 0000000000545B81 instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000543395 second address: 0000000000543395 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007EFEA8B88F58h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cld 0x0000001e pop ecx 0x0000001f add edi, edx 0x00000021 jmp 00007EFEA8B88F6Ah 0x00000023 cmp bx, dx 0x00000026 dec ecx 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007EFEA8B88F20h 0x0000002c test al, cl 0x0000002e push ecx 0x0000002f test bl, FFFFFFB4h 0x00000032 call 00007EFEA8B88FADh 0x00000037 call 00007EFEA8B88F68h 0x0000003c lfence 0x0000003f mov edx, dword ptr [7FFE0014h] 0x00000045 lfence 0x00000048 ret 0x00000049 mov esi, edx 0x0000004b pushad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000543468 second address: 00000000005435BF instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test ch, dh 0x0000000c xor edi, edi 0x0000000e cmp cl, cl 0x00000010 cld 0x00000011 mov ecx, 000186A0h 0x00000016 push ecx 0x00000017 jmp 00007EFEA8B88F6Ah 0x00000019 cmp bx, 495Bh 0x0000001e cmp eax, eax 0x00000020 call 00007EFEA8B88FE6h 0x00000025 call 00007EFEA8B88FD6h 0x0000002a lfence 0x0000002d rdtsc
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000540D95 second address: 0000000000540D95 instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000542F2A second address: 0000000000542F2A instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000544CFB second address: 0000000000544CFB instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000542E25 second address: 0000000000542E25 instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000542EEB second address: 0000000000542EEB instructions:
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RDTSC instruction interceptor: First address: 0000000001103DF6 second address: 0000000001103DF6 instructions:
Tries to detect Any.run
Source: C:\Users\user\Desktop\Orden de Compra.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: RegAsm.exe Binary or memory string: ROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: RegAsm.exe, 00000017.00000002.849537125.0000000001100000.00000040.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 000000000054054A second address: 0000000000545F85 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b push 2D9CC76Ch 0x00000010 test dl, dl 0x00000012 test bl, cl 0x00000014 test eax, eax 0x00000016 call 00007EFEA8B8E94Bh 0x0000001b cmp edi, 0DCBE3ACh 0x00000021 cmp ecx, edx 0x00000023 cmp edx, edx 0x00000025 jmp 00007EFEA8B88F6Ah 0x00000027 pushad 0x00000028 mov ebx, 000000C5h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000545B81 second address: 0000000000545B81 instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000543395 second address: 0000000000543395 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007EFEA8B88F58h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cld 0x0000001e pop ecx 0x0000001f add edi, edx 0x00000021 jmp 00007EFEA8B88F6Ah 0x00000023 cmp bx, dx 0x00000026 dec ecx 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007EFEA8B88F20h 0x0000002c test al, cl 0x0000002e push ecx 0x0000002f test bl, FFFFFFB4h 0x00000032 call 00007EFEA8B88FADh 0x00000037 call 00007EFEA8B88F68h 0x0000003c lfence 0x0000003f mov edx, dword ptr [7FFE0014h] 0x00000045 lfence 0x00000048 ret 0x00000049 mov esi, edx 0x0000004b pushad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000543437 second address: 0000000000543468 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 jmp 00007EFEA8B88D9Ah 0x00000005 test cx, dx 0x00000008 mov dword ptr [ebp+0000009Ch], 00000000h 0x00000012 test esi, 206C76DAh 0x00000018 pushad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000543468 second address: 00000000005435BF instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test ch, dh 0x0000000c xor edi, edi 0x0000000e cmp cl, cl 0x00000010 cld 0x00000011 mov ecx, 000186A0h 0x00000016 push ecx 0x00000017 jmp 00007EFEA8B88F6Ah 0x00000019 cmp bx, 495Bh 0x0000001e cmp eax, eax 0x00000020 call 00007EFEA8B88FE6h 0x00000025 call 00007EFEA8B88FD6h 0x0000002a lfence 0x0000002d rdtsc
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 00000000005435BF second address: 00000000005435BF instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007EFEA8B8BA06h 0x0000001d popad 0x0000001e jmp 00007EFEA8B88D9Ah 0x00000020 cmp bx, ax 0x00000023 call 00007EFEA8B88DD1h 0x00000028 lfence 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000540D95 second address: 0000000000540D95 instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000542F2A second address: 0000000000542F2A instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000544CFB second address: 0000000000544CFB instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000542E25 second address: 0000000000542E25 instructions:
Source: C:\Users\user\Desktop\Orden de Compra.exe RDTSC instruction interceptor: First address: 0000000000542EEB second address: 0000000000542EEB instructions:
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RDTSC instruction interceptor: First address: 000000000110054A second address: 0000000001105F85 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b push 2D9CC76Ch 0x00000010 test dl, dl 0x00000012 test bl, cl 0x00000014 test eax, eax 0x00000016 call 00007EFEA8B8E77Bh 0x0000001b cmp edi, 0DCBE3ACh 0x00000021 cmp ecx, edx 0x00000023 cmp edx, edx 0x00000025 jmp 00007EFEA8B88D9Ah 0x00000027 pushad 0x00000028 mov ebx, 000000C5h 0x0000002d rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RDTSC instruction interceptor: First address: 0000000001103437 second address: 00000000011035BF instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 jmp 00007EFEA8B88F6Ah 0x00000005 test cx, dx 0x00000008 mov dword ptr [ebp+0000009Ch], 00000000h 0x00000012 test esi, 206C76DAh 0x00000018 pushad 0x00000019 nop 0x0000001a nop 0x0000001b mov eax, 00000001h 0x00000020 cpuid 0x00000022 popad 0x00000023 test ch, dh 0x00000025 xor edi, edi 0x00000027 cmp cl, cl 0x00000029 cld 0x0000002a mov ecx, 000186A0h 0x0000002f push ecx 0x00000030 jmp 00007EFEA8B88F6Ah 0x00000032 cmp bx, 495Bh 0x00000037 cmp eax, eax 0x00000039 call 00007EFEA8B88FE6h 0x0000003e call 00007EFEA8B88FD6h 0x00000043 lfence 0x00000046 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RDTSC instruction interceptor: First address: 00000000011035BF second address: 00000000011035BF instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007EFEA8B8BA06h 0x0000001d popad 0x0000001e jmp 00007EFEA8B88D9Ah 0x00000020 cmp bx, ax 0x00000023 call 00007EFEA8B88DD1h 0x00000028 lfence 0x0000002b rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RDTSC instruction interceptor: First address: 0000000001103DF6 second address: 0000000001103DF6 instructions:
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00408F7E rdtsc 1_2_00408F7E
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Orden de Compra.exe API coverage: 9.3 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API coverage: 6.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6380 Thread sleep time: -2580000s >= -30000s Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: RegAsm.exe Binary or memory string: rogram Files\Qemu-ga\qemu-ga.exe
Source: RegAsm.exe, 00000017.00000002.849793142.00000000013EF000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAWpZB
Source: RegAsm.exe, 00000017.00000002.849831122.000000000141B000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000017.00000002.849537125.0000000001100000.00000040.00000001.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

barindex
Contains functionality to hide a thread from the debugger
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01100898 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000040,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,01105823 23_2_01100898
Found potential dummy code loops (likely to delay analysis)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process Stats: CPU usage > 90% for more than 60s
Hides threads from debuggers
Source: C:\Users\user\Desktop\Orden de Compra.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Orden de Compra.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Orden de Compra.exe Code function: 1_2_00408F7E rdtsc 1_2_00408F7E
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011066BF mov eax, dword ptr fs:[00000030h] 23_2_011066BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01102161 mov eax, dword ptr fs:[00000030h] 23_2_01102161
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01102165 mov eax, dword ptr fs:[00000030h] 23_2_01102165
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_0110219E mov eax, dword ptr fs:[00000030h] 23_2_0110219E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011031C9 mov eax, dword ptr fs:[00000030h] 23_2_011031C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011054C7 mov eax, dword ptr fs:[00000030h] 23_2_011054C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011018C8 mov eax, dword ptr fs:[00000030h] 23_2_011018C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011054C9 mov eax, dword ptr fs:[00000030h] 23_2_011054C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01101F07 mov eax, dword ptr fs:[00000030h] 23_2_01101F07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_01105E4F mov eax, dword ptr fs:[00000030h] 23_2_01105E4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011066CD mov eax, dword ptr fs:[00000030h] 23_2_011066CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 23_2_011066E8 mov eax, dword ptr fs:[00000030h] 23_2_011066E8
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Orden de Compra.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1100000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
Source: C:\Users\user\Desktop\Orden de Compra.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\Orden de Compra.exe' Jump to behavior
Source: RegAsm.exe, 00000017.00000002.849941377.0000000001990000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000017.00000002.849941377.0000000001990000.00000002.00000001.sdmp Binary or memory string: Progman
Source: RegAsm.exe, 00000017.00000002.849941377.0000000001990000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: RegAsm.exe, 00000017.00000002.849941377.0000000001990000.00000002.00000001.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 383316 Sample: Orden de Compra.exe Startdate: 07/04/2021 Architecture: WINDOWS Score: 96 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected GuLoader 2->23 25 Machine Learning detection for sample 2->25 27 3 other signatures 2->27 7 Orden de Compra.exe 1 2->7         started        process3 signatures4 29 Writes to foreign memory regions 7->29 31 Tries to detect Any.run 7->31 33 Hides threads from debuggers 7->33 10 RegAsm.exe 7->10         started        13 RegAsm.exe 13 7->13         started        15 RegAsm.exe 7->15         started        17 RegAsm.exe 7->17         started        process5 signatures6 35 Contains functionality to detect hardware virtualization (CPUID execution measurement) 10->35 37 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 10->37 39 Found potential dummy code loops (likely to delay analysis) 10->39 45 2 other signatures 10->45 41 Tries to detect Any.run 13->41 43 Hides threads from debuggers 13->43 19 conhost.exe 13->19         started        process7
No contacted IP infos