{"Payload URL": "https://drive.google.com/uc?export=download&id=14HidX9PYpF9MdDuU2Alpazy_Sg8A9xmd", "Injection Process": ["RegAsm.exe", "RegSvcs.exe", "MSBuild.exe"]}
Source: 00000000.00000002.742722854.0000000000500000.00000040.00000001.sdmp | Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=14HidX9PYpF9MdDuU2Alpazy_Sg8A9xmd", "Injection Process": ["RegAsm.exe", "RegSvcs.exe", "MSBuild.exe"]} |
Source: samtidshistoriker.exe | Virustotal: Detection: 23% | Perma Link |
Source: samtidshistoriker.exe | Metadefender: Detection: 14% | Perma Link |
Source: samtidshistoriker.exe | ReversingLabs: Detection: 48% |
Source: samtidshistoriker.exe | Joe Sandbox ML: detected |
Source: samtidshistoriker.exe | Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: Malware configuration extractor | URLs: https://drive.google.com/uc?export=download&id=14HidX9PYpF9MdDuU2Alpazy_Sg8A9xmd |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process Stats: CPU usage > 98% |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: String function: 004022AC appears 361 times |
Source: samtidshistoriker.exe | Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST |
Source: samtidshistoriker.exe | Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED |
Source: classification engine | Classification label: mal92.troj.evad.winEXE@1/0@0/0 |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | File created: C:\Users\user\AppData\Local\Temp\~DFAFD63AE078E58750.TMP | Jump to behavior |
Source: samtidshistoriker.exe | Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Section loaded: C:\Windows\SysWOW64\msvbvm60.dll |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Source: samtidshistoriker.exe | Virustotal: Detection: 23% |
Source: samtidshistoriker.exe | Metadefender: Detection: 14% |
Source: samtidshistoriker.exe | ReversingLabs: Detection: 48% |
Source: Yara match | File source: 00000000.00000002.742722854.0000000000500000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: samtidshistoriker.exe PID: 5740, type: MEMORY |
Source: Yara match | File source: Process Memory Space: samtidshistoriker.exe PID: 5740, type: MEMORY |
Source: samtidshistoriker.exe | Static PE information: real checksum: 0x322ea should be: 0x39700 |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_00408066 push edi; ret |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_0040947C push ebx; retf |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_00407618 push ecx; retf |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_004050CC push esp; iretd |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_004096D6 push eax; ret |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_00404EAC push ds; retf |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_00403AAD push ecx; iretd |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_004062BB push FFFFFF81h; ret |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_0040791D push ebx; iretd |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_0040611E push ebp; retf |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_0040552E push ebp; ret |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_00409138 push ds; iretd |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_00409BC5 push 3975AA4Dh; ret |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_004099D4 push ds; retf |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_00409BDA push edx; ret |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_004091E1 pushad ; iretd |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_004099ED pushad ; iretd |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_00409BF3 push ebx; iretd |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Code function: 0_2_004071F6 push edx; ret |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | RDTSC instruction interceptor: First address: 0000000000505A0C second address: 0000000000505A0C instructions: |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | RDTSC instruction interceptor: First address: 0000000000505983 second address: 0000000000505983 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a add edx, ebx 0x0000000c movzx ebx, byte ptr [esi] 0x0000000f cmp ch, 00000060h 0x00000012 add edx, ebx 0x00000014 add esi, 02h 0x00000017 cmp word ptr [esi], 0000h 0x0000001b jne 00007F92B4948732h 0x0000001d jmp 00007F92B494879Ah 0x0000001f pushad 0x00000020 mov bx, 9C89h 0x00000024 cmp bx, 9C89h 0x00000029 jne 00007F92B4943511h 0x0000002f popad 0x00000030 mov ebx, edx 0x00000032 test ch, bh 0x00000034 shl edx, 05h 0x00000037 pushad 0x00000038 rdtsc |
Source: samtidshistoriker.exe, 00000000.00000002.742722854.0000000000500000.00000040.00000001.sdmp | Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | RDTSC instruction interceptor: First address: 000000000040A5EF second address: 000000000040A5EF instructions: 0x00000000 rdtsc 0x00000002 cmp eax, 0000009Ah 0x00000007 cmp ebx, 000000BDh 0x0000000d cmp eax, 65h 0x00000010 cmp ebx, 000000B6h 0x00000016 cmp ebx, 37h 0x00000019 cmp eax, 000000C2h 0x0000001e pandn mm5, mm0 0x00000021 punpckhdq xmm3, xmm2 0x00000025 fyl2x 0x00000027 psubsw xmm7, xmm7 0x0000002b fninit 0x0000002d psubusb xmm2, xmm6 0x00000031 punpckhbw xmm5, xmm7 0x00000035 pcmpeqb xmm7, xmm0 0x00000039 fnclex 0x0000003b fpatan 0x0000003d jmp 00007F92B45C8A1Eh 0x0000003f cmp eax, 7Dh 0x00000042 cmp edi, 02EAFF40h 0x00000048 movd mm1, ebx 0x0000004b movd mm1, ebx 0x0000004e movd mm1, ebx 0x00000051 movd mm1, ebx 0x00000054 jne 00007F92B45C887Ah 0x0000005a inc edi 0x0000005b cmp eax, 000000D1h 0x00000060 cmp ebx, 000000D6h 0x00000066 cmp ebx, 49h 0x00000069 cmp eax, 1Eh 0x0000006c cmp ebx, 000000E0h 0x00000072 cmp ebx, 2Ah 0x00000075 psrlq xmm2, 46h 0x0000007a psrld mm2, B8h 0x0000007e fnop 0x00000080 fld1 0x00000082 fmulp st(6), st(0) 0x00000084 fldz 0x00000086 fldl2t 0x00000088 paddusw mm3, mm6 0x0000008b nop 0x0000008c pmullw xmm7, xmm3 0x00000090 jmp 00007F92B45C8A17h 0x00000092 cmp ebx, 58h 0x00000095 cmp ebx, 000000BDh 0x0000009b rdtsc |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | RDTSC instruction interceptor: First address: 00000000005059CA second address: 0000000000505A0C instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b test al, dl 0x0000000d cmp dh, ah 0x0000000f cmp cl, al 0x00000011 test ch, 00000032h 0x00000014 jmp 00007F92B494879Ah 0x00000016 pushad 0x00000017 mov bx, 5EFCh 0x0000001b cmp bx, 5EFCh 0x00000020 jne 00007F92B4943483h 0x00000026 popad 0x00000027 test ch, bh 0x00000029 pushad 0x0000002a rdtsc |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | RDTSC instruction interceptor: First address: 0000000000505A0C second address: 0000000000505A0C instructions: |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | RDTSC instruction interceptor: First address: 0000000000505983 second address: 0000000000505983 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a add edx, ebx 0x0000000c movzx ebx, byte ptr [esi] 0x0000000f cmp ch, 00000060h 0x00000012 add edx, ebx 0x00000014 add esi, 02h 0x00000017 cmp word ptr [esi], 0000h 0x0000001b jne 00007F92B4948732h 0x0000001d jmp 00007F92B494879Ah 0x0000001f pushad 0x00000020 mov bx, 9C89h 0x00000024 cmp bx, 9C89h 0x00000029 jne 00007F92B4943511h 0x0000002f popad 0x00000030 mov ebx, edx 0x00000032 test ch, bh 0x00000034 shl edx, 05h 0x00000037 pushad 0x00000038 rdtsc |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | RDTSC instruction interceptor: First address: 00000000005030BA second address: 00000000005030BA instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F92B45C89E4h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d jmp 00007F92B45C89DAh 0x0000001f test dh, ah 0x00000021 pop ecx 0x00000022 test bh, FFFFFFF5h 0x00000025 test eax, ecx 0x00000027 add edi, edx 0x00000029 test ax, ax 0x0000002c dec ecx 0x0000002d cmp bh, ch 0x0000002f cmp ecx, 00000000h 0x00000032 jne 00007F92B45C898Dh 0x00000034 push ecx 0x00000035 call 00007F92B45C8A20h 0x0000003a call 00007F92B45C89F4h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc |
Source: all processes | Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected |
Source: samtidshistoriker.exe, 00000000.00000002.742722854.0000000000500000.00000040.00000001.sdmp | Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe |
Source: C:\Users\user\Desktop\samtidshistoriker.exe | Process Stats: CPU usage > 90% for more than 60s |
Source: all processes | Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected |
Source: samtidshistoriker.exe, 00000000.00000002.743136162.0000000000D00000.00000002.00000001.sdmp | Binary or memory string: Shell_TrayWnd |
Source: samtidshistoriker.exe, 00000000.00000002.743136162.0000000000D00000.00000002.00000001.sdmp | Binary or memory string: Progman |
Source: samtidshistoriker.exe, 00000000.00000002.743136162.0000000000D00000.00000002.00000001.sdmp | Binary or memory string: SProgram Managerl |
Source: samtidshistoriker.exe, 00000000.00000002.743136162.0000000000D00000.00000002.00000001.sdmp | Binary or memory string: Shell_TrayWnd, |
Source: samtidshistoriker.exe, 00000000.00000002.743136162.0000000000D00000.00000002.00000001.sdmp | Binary or memory string: Progmanlock |
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.