Analysis Report gedanken.exe

Overview

General Information

Sample Name: gedanken.exe
Analysis ID: 384219
MD5: e2342da4c7a6ff102679cd487954dc5f
SHA1: a5aec8579ab17e7378c5cff51eb321d55f2e3532
SHA256: dc51b75c62afc72ad319d361366d01901a237343fe8dafc568fc0f38d9bc7f3a
Tags: exeGuLoader
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Detected potential crypto function
PE file contains an invalid checksum
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: gedanken.exe Virustotal: Detection: 52% Perma Link
Source: gedanken.exe ReversingLabs: Detection: 50%
Machine Learning detection for sample
Source: gedanken.exe Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: gedanken.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\gedanken.exe Process Stats: CPU usage > 98%
Detected potential crypto function
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00465802 0_2_00465802
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00461A9C 0_2_00461A9C
PE file contains strange resources
Source: gedanken.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gedanken.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: gedanken.exe, 00000000.00000002.1169390599.0000000002260000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs gedanken.exe
Uses 32bit PE files
Source: gedanken.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal80.troj.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\gedanken.exe File created: C:\Users\user\AppData\Local\Temp\~DFBBC711B87778BA89.TMP Jump to behavior
Source: gedanken.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\gedanken.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\gedanken.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: gedanken.exe Virustotal: Detection: 52%
Source: gedanken.exe ReversingLabs: Detection: 50%

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.1168805441.0000000000460000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: gedanken.exe PID: 6880, type: MEMORY
Yara detected VB6 Downloader Generic
Source: Yara match File source: Process Memory Space: gedanken.exe PID: 6880, type: MEMORY
PE file contains an invalid checksum
Source: gedanken.exe Static PE information: real checksum: 0x29cba should be: 0x275ed
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0040BE5C push 7600FFCEh; iretd 0_2_0040BE61
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_004030E1 push ss; iretd 0_2_0040314C
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0040249C push edi; retf 0_2_0040249D
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0040314D push ss; iretd 0_2_0040314C
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0040475D push ss; retf 0_2_004047C4
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_004047C8 push ss; retf 0_2_004047C4
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00464CDA push ecx; retf 0_2_00464CEA
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462CA0 push ecx; retf 0_2_00462CA1
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00466554 pushfd ; iretd 0_2_00466555
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00466A14 push edi; ret 0_2_00466A23
Source: C:\Users\user\Desktop\gedanken.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462C4F 0_2_00462C4F
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0046581C 0_2_0046581C
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462CFC 0_2_00462CFC
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462CBE 0_2_00462CBE
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462D3F 0_2_00462D3F
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462DD6 0_2_00462DD6
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462D80 0_2_00462D80
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462A65 0_2_00462A65
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00461670 0_2_00461670
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462E13 0_2_00462E13
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462ACB 0_2_00462ACB
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462B08 0_2_00462B08
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462B88 0_2_00462B88
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462BB6 0_2_00462BB6
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: gedanken.exe Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\gedanken.exe RDTSC instruction interceptor: First address: 0000000000463681 second address: 0000000000463681 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FDEBC8E5224h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test bl, bl 0x0000001f cmp bl, al 0x00000021 pop ecx 0x00000022 cmp edx, ecx 0x00000024 test al, dl 0x00000026 add edi, edx 0x00000028 jmp 00007FDEBC8E521Ah 0x0000002a cmp al, B6h 0x0000002c dec ecx 0x0000002d cmp dx, 0C52h 0x00000032 cmp ecx, 00000000h 0x00000035 jne 00007FDEBC8E51CAh 0x00000037 push ecx 0x00000038 call 00007FDEBC8E525Eh 0x0000003d call 00007FDEBC8E5234h 0x00000042 lfence 0x00000045 mov edx, dword ptr [7FFE0014h] 0x0000004b lfence 0x0000004e ret 0x0000004f mov esi, edx 0x00000051 pushad 0x00000052 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0040946F rdtsc 0_2_0040946F
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: gedanken.exe Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

barindex
Found potential dummy code loops (likely to delay analysis)
Source: C:\Users\user\Desktop\gedanken.exe Process Stats: CPU usage > 90% for more than 60s
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0040946F rdtsc 0_2_0040946F
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_004620C0 mov eax, dword ptr fs:[00000030h] 0_2_004620C0
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_004634DA mov eax, dword ptr fs:[00000030h] 0_2_004634DA
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_004620BE mov eax, dword ptr fs:[00000030h] 0_2_004620BE
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00465A03 mov eax, dword ptr fs:[00000030h] 0_2_00465A03
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00461A8E mov eax, dword ptr fs:[00000030h] 0_2_00461A8E
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00466356 mov eax, dword ptr fs:[00000030h] 0_2_00466356
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0046635B mov eax, dword ptr fs:[00000030h] 0_2_0046635B
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462358 mov eax, dword ptr fs:[00000030h] 0_2_00462358
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_0046233D mov eax, dword ptr fs:[00000030h] 0_2_0046233D
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_00462396 mov eax, dword ptr fs:[00000030h] 0_2_00462396
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_004623B7 mov eax, dword ptr fs:[00000030h] 0_2_004623B7
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: gedanken.exe, 00000000.00000002.1169278487.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: gedanken.exe, 00000000.00000002.1169278487.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: gedanken.exe, 00000000.00000002.1169278487.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: gedanken.exe, 00000000.00000002.1169278487.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\gedanken.exe Code function: 0_2_004612AC cpuid 0_2_004612AC
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 384219 Sample: gedanken.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 80 8 Multi AV Scanner detection for submitted file 2->8 10 Yara detected GuLoader 2->10 12 Machine Learning detection for sample 2->12 14 2 other signatures 2->14 5 gedanken.exe 1 2->5         started        process3 signatures4 16 Contains functionality to detect hardware virtualization (CPUID execution measurement) 5->16 18 Found potential dummy code loops (likely to delay analysis) 5->18 20 Tries to detect virtualization through RDTSC time measurements 5->20
No contacted IP infos