Analysis Report Odeme_310521657_876007850.exe

Overview

General Information

Sample Name: Odeme_310521657_876007850.exe
Analysis ID: 431163
MD5: 391ca3cf343a25bfd2b452478e54591b
SHA1: 07392a3e453fbf57a85190e0342e15c83e4eaffb
SHA256: 6abdca229afbc8050590a71d0a4be6dcaeaa44725e19d4eab23df6152465116d
Tags: exeGuLoader
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Potential malicious icon found
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: Odeme_310521657_876007850.exe ReversingLabs: Detection: 31%

Compliance:

barindex
Uses 32bit PE files
Source: Odeme_310521657_876007850.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: Odeme_310521657_876007850.exe, 00000000.00000002.1165436070.000000000066A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

barindex
Potential malicious icon found
Source: initial sample Icon embedded in PE file: bad icon match: 20047c7c70f0e004
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A488 NtAllocateVirtualMemory, 0_2_0226A488
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A692 NtAllocateVirtualMemory, 0_2_0226A692
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A736 NtAllocateVirtualMemory, 0_2_0226A736
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A7D5 NtAllocateVirtualMemory, 0_2_0226A7D5
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A86E NtAllocateVirtualMemory, 0_2_0226A86E
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A56A NtAllocateVirtualMemory, 0_2_0226A56A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A5F6 NtAllocateVirtualMemory, 0_2_0226A5F6
Detected potential crypto function
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A488 0_2_0226A488
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268228 0_2_02268228
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262A06 0_2_02262A06
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261204 0_2_02261204
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02270605 0_2_02270605
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226B200 0_2_0226B200
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261A08 0_2_02261A08
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02260E15 0_2_02260E15
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268A12 0_2_02268A12
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226864A 0_2_0226864A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261AA6 0_2_02261AA6
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022612A0 0_2_022612A0
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268EBC 0_2_02268EBC
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262285 0_2_02262285
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226828A 0_2_0226828A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267E94 0_2_02267E94
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262A98 0_2_02262A98
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02265AEC 0_2_02265AEC
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022686C4 0_2_022686C4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266ACD 0_2_02266ACD
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261ED2 0_2_02261ED2
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226AED1 0_2_0226AED1
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022656DC 0_2_022656DC
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226B2DA 0_2_0226B2DA
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02265724 0_2_02265724
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02264F25 0_2_02264F25
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266B22 0_2_02266B22
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261B20 0_2_02261B20
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226830C 0_2_0226830C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226230A 0_2_0226230A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226B378 0_2_0226B378
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262F54 0_2_02262F54
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226AF52 0_2_0226AF52
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022683A0 0_2_022683A0
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268B80 0_2_02268B80
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261F80 0_2_02261F80
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02265788 0_2_02265788
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261B94 0_2_02261B94
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262F9B 0_2_02262F9B
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02264F98 0_2_02264F98
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262799 0_2_02262799
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022673E4 0_2_022673E4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261BEE 0_2_02261BEE
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262BEE 0_2_02262BEE
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022627FA 0_2_022627FA
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262FC6 0_2_02262FC6
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267FC0 0_2_02267FC0
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02264BCD 0_2_02264BCD
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022617CB 0_2_022617CB
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268FD8 0_2_02268FD8
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02260823 0_2_02260823
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226082E 0_2_0226082E
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226882E 0_2_0226882E
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226502C 0_2_0226502C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226843C 0_2_0226843C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266C3A 0_2_02266C3A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226200C 0_2_0226200C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268C0C 0_2_02268C0C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226B418 0_2_0226B418
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261850 0_2_02261850
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267C5A 0_2_02267C5A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268058 0_2_02268058
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022610A3 0_2_022610A3
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022638BD 0_2_022638BD
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02260884 0_2_02260884
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261C88 0_2_02261C88
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262090 0_2_02262090
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022698E6 0_2_022698E6
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022684E6 0_2_022684E6
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022618EE 0_2_022618EE
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022688E8 0_2_022688E8
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022610F4 0_2_022610F4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226ECC2 0_2_0226ECC2
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267CD4 0_2_02267CD4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226592E 0_2_0226592E
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226293C 0_2_0226293C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262114 0_2_02262114
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268119 0_2_02268119
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268164 0_2_02268164
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267D6C 0_2_02267D6C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226B16C 0_2_0226B16C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A56A 0_2_0226A56A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226116B 0_2_0226116B
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261974 0_2_02261974
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02263174 0_2_02263174
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266D50 0_2_02266D50
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022621A4 0_2_022621A4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022639AD 0_2_022639AD
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022659AB 0_2_022659AB
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261DB2 0_2_02261DB2
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022629B8 0_2_022629B8
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226A5F6 0_2_0226A5F6
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022659F5 0_2_022659F5
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022651FC 0_2_022651FC
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268DC9 0_2_02268DC9
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266DD8 0_2_02266DD8
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022639D8 0_2_022639D8
PE file contains strange resources
Source: Odeme_310521657_876007850.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Odeme_310521657_876007850.exe, 00000000.00000002.1165584382.00000000021F0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs Odeme_310521657_876007850.exe
Source: Odeme_310521657_876007850.exe, 00000000.00000000.639617040.0000000000424000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameForconceit7.exe vs Odeme_310521657_876007850.exe
Source: Odeme_310521657_876007850.exe Binary or memory string: OriginalFilenameForconceit7.exe vs Odeme_310521657_876007850.exe
Uses 32bit PE files
Source: Odeme_310521657_876007850.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal80.rans.troj.evad.winEXE@1/0@0/0
Source: Odeme_310521657_876007850.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Odeme_310521657_876007850.exe ReversingLabs: Detection: 31%

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: Odeme_310521657_876007850.exe, type: SAMPLE
Source: Yara match File source: 0.0.Odeme_310521657_876007850.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Odeme_310521657_876007850.exe.400000.0.unpack, type: UNPACKEDPE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0040CF5C push ebp; iretd 0_2_0040CF5D
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02269120 push 39C8A12Dh; retf 0_2_0226912C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226AA23 0_2_0226AA23
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268228 0_2_02268228
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261A08 0_2_02261A08
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226864A 0_2_0226864A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261AA6 0_2_02261AA6
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262285 0_2_02262285
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226828A 0_2_0226828A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267E94 0_2_02267E94
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022686C4 0_2_022686C4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266ACD 0_2_02266ACD
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261ED2 0_2_02261ED2
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226AED1 0_2_0226AED1
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022656DC 0_2_022656DC
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261B20 0_2_02261B20
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02264700 0_2_02264700
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226830C 0_2_0226830C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226230A 0_2_0226230A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226470A 0_2_0226470A
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226475C 0_2_0226475C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022683A0 0_2_022683A0
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261F80 0_2_02261F80
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261B94 0_2_02261B94
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022673E4 0_2_022673E4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261BEE 0_2_02261BEE
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022647F0 0_2_022647F0
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267FC0 0_2_02267FC0
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022617CB 0_2_022617CB
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267420 0_2_02267420
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226843C 0_2_0226843C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226200C 0_2_0226200C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266453 0_2_02266453
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261850 0_2_02261850
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266451 0_2_02266451
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268058 0_2_02268058
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261C88 0_2_02261C88
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262090 0_2_02262090
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02264890 0_2_02264890
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022698E6 0_2_022698E6
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022684E6 0_2_022684E6
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022618EE 0_2_022618EE
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267CD4 0_2_02267CD4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022674D8 0_2_022674D8
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02264924 0_2_02264924
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02262114 0_2_02262114
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268119 0_2_02268119
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02268164 0_2_02268164
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02267D6C 0_2_02267D6C
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261974 0_2_02261974
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022621A4 0_2_022621A4
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022639AD 0_2_022639AD
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02261DB2 0_2_02261DB2
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226A8D3 second address: 000000000226A8D3 instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226A973 second address: 000000000226A973 instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226AA14 second address: 000000000226AA6A instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a jmp 00007FA1809A4D2Ch 0x0000000f call 00007FA1809A4A99h 0x00000014 mov dword ptr [ebp+000001DDh], ecx 0x0000001a test ax, 00006196h 0x0000001e mov ecx, 744B4324h 0x00000023 cmp ebx, edx 0x00000025 xor ecx, 3F893887h 0x0000002b xor ecx, 86A7B7DBh 0x00000031 test bl, bl 0x00000033 sub ecx, CD65CC3Ch 0x00000039 pushad 0x0000003a mov cx, 6E0Fh 0x0000003e cmp cx, 6E0Fh 0x00000043 jne 00007FA1809A870Fh 0x00000049 popad 0x0000004a push ecx 0x0000004b mov ecx, dword ptr [ebp+000001DDh] 0x00000051 cmp dx, bx 0x00000054 push dword ptr [ebp+00000140h] 0x0000005a pushad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226AA6A second address: 000000000226AA6A instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226F981 second address: 000000000226F981 instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 0000000002272352 second address: 0000000002272352 instructions:
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226E6B7 second address: 000000000226E7D9 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b push E16449FBh 0x00000010 jmp 00007FA1809BA75Eh 0x00000012 cmp cl, bl 0x00000014 call 00007FA1809BA744h 0x00000019 cmp ah, ch 0x0000001b mov dword ptr [ebp+04h], eax 0x0000001e mov ebx, dword ptr [eax+3Ch] 0x00000021 add eax, ebx 0x00000023 mov ebx, dword ptr [eax+78h] 0x00000026 mov eax, dword ptr [ebp+04h] 0x00000029 jmp 00007FA1809BA75Eh 0x0000002b test dl, dl 0x0000002d add eax, ebx 0x0000002f mov ecx, dword ptr [eax+18h] 0x00000032 test bh, ah 0x00000034 mov dword ptr [ebp+08h], ecx 0x00000037 cmp cl, bl 0x00000039 mov ecx, dword ptr [eax+1Ch] 0x0000003c mov dword ptr [ebp+14h], ecx 0x0000003f cmp cl, cl 0x00000041 mov ecx, dword ptr [eax+24h] 0x00000044 mov dword ptr [ebp+10h], ecx 0x00000047 test dl, dl 0x00000049 mov esi, dword ptr [eax+20h] 0x0000004c add esi, dword ptr [ebp+04h] 0x0000004f xor ecx, ecx 0x00000051 test bh, FFFFFFA3h 0x00000054 cmp ax, bx 0x00000057 pushad 0x00000058 lfence 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226A8D3 second address: 000000000226A8D3 instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226A973 second address: 000000000226A973 instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226AA14 second address: 000000000226AA6A instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a jmp 00007FA1809A4D2Ch 0x0000000f call 00007FA1809A4A99h 0x00000014 mov dword ptr [ebp+000001DDh], ecx 0x0000001a test ax, 00006196h 0x0000001e mov ecx, 744B4324h 0x00000023 cmp ebx, edx 0x00000025 xor ecx, 3F893887h 0x0000002b xor ecx, 86A7B7DBh 0x00000031 test bl, bl 0x00000033 sub ecx, CD65CC3Ch 0x00000039 pushad 0x0000003a mov cx, 6E0Fh 0x0000003e cmp cx, 6E0Fh 0x00000043 jne 00007FA1809A870Fh 0x00000049 popad 0x0000004a push ecx 0x0000004b mov ecx, dword ptr [ebp+000001DDh] 0x00000051 cmp dx, bx 0x00000054 push dword ptr [ebp+00000140h] 0x0000005a pushad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226AA6A second address: 000000000226AA6A instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226F981 second address: 000000000226F981 instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 0000000002272352 second address: 0000000002272352 instructions:
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe RDTSC instruction interceptor: First address: 000000000226F43E second address: 000000000226F4DF instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov dword ptr [ebp+000000F8h], 00A95F60h 0x00000015 test ecx, ecx 0x00000017 cmp al, al 0x00000019 cmp bl, cl 0x0000001b call 00007FA1809A4C5Eh 0x00000020 call 00007FA1809A4C6Ah 0x00000025 lfence 0x00000028 mov edx, 70E07C5Ch 0x0000002d xor edx, A2B34B25h 0x00000033 xor edx, 89B1DF2Eh 0x00000039 xor edx, 241CE843h 0x0000003f mov edx, dword ptr [edx] 0x00000041 lfence 0x00000044 jmp 00007FA1809A4C2Eh 0x00000046 test dx, cx 0x00000049 cmp ebx, edx 0x0000004b cmp bl, FFFFFF8Ch 0x0000004e jmp 00007FA1809A4C2Eh 0x00000050 test bl, bl 0x00000052 test ax, cx 0x00000055 nop 0x00000056 pushad 0x00000057 mov dx, B385h 0x0000005b cmp dx, B385h 0x00000060 jne 00007FA1809A3B2Dh 0x00000066 popad 0x00000067 ret 0x00000068 mov esi, edx 0x0000006a pushad 0x0000006b rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226AA23 rdtsc 0_2_0226AA23
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

barindex
Found potential dummy code loops (likely to delay analysis)
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Process Stats: CPU usage > 90% for more than 60s
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226AA23 rdtsc 0_2_0226AA23
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02270605 mov eax, dword ptr fs:[00000030h] 0_2_02270605
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266ACD mov eax, dword ptr fs:[00000030h] 0_2_02266ACD
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_022656DC mov eax, dword ptr fs:[00000030h] 0_2_022656DC
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266B22 mov eax, dword ptr fs:[00000030h] 0_2_02266B22
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226EF31 mov eax, dword ptr fs:[00000030h] 0_2_0226EF31
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266453 mov eax, dword ptr fs:[00000030h] 0_2_02266453
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02266451 mov eax, dword ptr fs:[00000030h] 0_2_02266451
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_0226E55E mov eax, dword ptr fs:[00000030h] 0_2_0226E55E
Source: C:\Users\user\Desktop\Odeme_310521657_876007850.exe Code function: 0_2_02269D90 mov eax, dword ptr fs:[00000030h] 0_2_02269D90
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: Odeme_310521657_876007850.exe, 00000000.00000002.1165487714.0000000000D70000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: Odeme_310521657_876007850.exe, 00000000.00000002.1165487714.0000000000D70000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: Odeme_310521657_876007850.exe, 00000000.00000002.1165487714.0000000000D70000.00000002.00000001.sdmp Binary or memory string: Progman
Source: Odeme_310521657_876007850.exe, 00000000.00000002.1165487714.0000000000D70000.00000002.00000001.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 431163 Sample: Odeme_310521657_876007850.exe Startdate: 08/06/2021 Architecture: WINDOWS Score: 80 8 Potential malicious icon found 2->8 10 Multi AV Scanner detection for submitted file 2->10 12 Yara detected GuLoader 2->12 5 Odeme_310521657_876007850.exe 2->5         started        process3 signatures4 14 Contains functionality to detect hardware virtualization (CPUID execution measurement) 5->14 16 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 5->16 18 Found potential dummy code loops (likely to delay analysis) 5->18 20 Tries to detect virtualization through RDTSC time measurements 5->20
No contacted IP infos