Analysis Report dt9XEhpeQQ

Overview

General Information

Sample Name: dt9XEhpeQQ (renamed file extension from none to exe)
Analysis ID: 431849
MD5: 5423976b486afd6a8dad047fb947b190
SHA1: f04947aa1b4e9500e4b31d2365ac886447ba4427
SHA256: e73ecaf549049b8c4f8701e55c95220e09890df2d93ef52465ccd4b448a6d19f
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Potential malicious icon found
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Machine Learning detection for sample
Source: dt9XEhpeQQ.exe Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: dt9XEhpeQQ.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

barindex
Potential malicious icon found
Source: initial sample Icon embedded in PE file: bad icon match: 20047c7c70f0e004
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227578F NtAllocateVirtualMemory, 0_2_0227578F
Detected potential crypto function
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00401368 0_2_00401368
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227578F 0_2_0227578F
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02274A31 0_2_02274A31
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02272A05 0_2_02272A05
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227127D 0_2_0227127D
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02270247 0_2_02270247
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022782E3 0_2_022782E3
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022776CE 0_2_022776CE
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02271F06 0_2_02271F06
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02272F01 0_2_02272F01
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02274700 0_2_02274700
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02271F11 0_2_02271F11
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02270763 0_2_02270763
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02278F6A 0_2_02278F6A
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227737E 0_2_0227737E
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02278F7C 0_2_02278F7C
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02274B5A 0_2_02274B5A
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022723A5 0_2_022723A5
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022717A4 0_2_022717A4
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02270F82 0_2_02270F82
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02271389 0_2_02271389
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02271793 0_2_02271793
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022783EB 0_2_022783EB
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227282E 0_2_0227282E
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227903F 0_2_0227903F
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227541A 0_2_0227541A
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02272869 0_2_02272869
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02273041 0_2_02273041
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02272CBB 0_2_02272CBB
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02271C8D 0_2_02271C8D
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227389C 0_2_0227389C
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02271498 0_2_02271498
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022784E9 0_2_022784E9
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022730D6 0_2_022730D6
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02274922 0_2_02274922
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227452A 0_2_0227452A
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02277929 0_2_02277929
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022741B9 0_2_022741B9
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022725ED 0_2_022725ED
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022705C4 0_2_022705C4
PE file contains strange resources
Source: dt9XEhpeQQ.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: dt9XEhpeQQ.exe, 00000000.00000002.730326538.0000000002B90000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSkiftela2.exeFE2XG vs dt9XEhpeQQ.exe
Source: dt9XEhpeQQ.exe, 00000000.00000000.197757674.0000000000431000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSkiftela2.exe vs dt9XEhpeQQ.exe
Source: dt9XEhpeQQ.exe Binary or memory string: OriginalFilenameSkiftela2.exe vs dt9XEhpeQQ.exe
Uses 32bit PE files
Source: dt9XEhpeQQ.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal76.rans.troj.evad.winEXE@1/0@0/0
Source: dt9XEhpeQQ.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.726927827.0000000002270000.00000040.00000001.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_004190F0 push eax; retf 0_2_004190FB
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0041B14B push cs; retf 0_2_0041B156
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0041DB0B push es; iretd 0_2_0041DB0C
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00419F95 push cs; retf 0_2_00419F9A
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_006215F3 push edx; ret 0_2_00621621
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00623063 push edx; ret 0_2_00623091
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00621863 push edx; ret 0_2_00621891
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00624863 push edx; ret 0_2_00624891
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00626065 push edx; ret 0_2_00626091
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00620068 push edx; ret 0_2_00620091
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00622074 push edx; ret 0_2_006220A1
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00623874 push edx; ret 0_2_006238A1
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00625074 push edx; ret 0_2_006250A1
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00626875 push edx; ret 0_2_006268A1
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00620878 push edx; ret 0_2_006208A1
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00620843 push edx; ret 0_2_00620871
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00622043 push edx; ret 0_2_00622071
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00623843 push edx; ret 0_2_00623871
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00625043 push edx; ret 0_2_00625071
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00626844 push edx; ret 0_2_00626871
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00621054 push edx; ret 0_2_00621081
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00622854 push edx; ret 0_2_00622881
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00624054 push edx; ret 0_2_00624081
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00625854 push edx; ret 0_2_00625881
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00627054 push edx; ret 0_2_00627081
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00621023 push edx; ret 0_2_00621051
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00622823 push edx; ret 0_2_00622851
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00624023 push edx; ret 0_2_00624051
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00627024 push edx; ret 0_2_00627051
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00625825 push edx; ret 0_2_00625851
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_00624833 push edx; ret 0_2_00624861
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227578F NtAllocateVirtualMemory, 0_2_0227578F
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022782E3 0_2_022782E3
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02272F01 0_2_02272F01
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02274700 0_2_02274700
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02278F6A 0_2_02278F6A
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022723A5 0_2_022723A5
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02270F82 0_2_02270F82
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022783EB 0_2_022783EB
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227282E 0_2_0227282E
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02273041 0_2_02273041
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02272CBB 0_2_02272CBB
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022784E9 0_2_022784E9
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022730D6 0_2_022730D6
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227452A 0_2_0227452A
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02277929 0_2_02277929
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022741B9 0_2_022741B9
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe RDTSC instruction interceptor: First address: 00000000022759C0 second address: 00000000022759C0 instructions:
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe RDTSC instruction interceptor: First address: 0000000002277E3F second address: 0000000002277E3F instructions:
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe RDTSC instruction interceptor: First address: 0000000002279186 second address: 0000000002279186 instructions:
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe RDTSC instruction interceptor: First address: 00000000022759C0 second address: 00000000022759C0 instructions:
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe RDTSC instruction interceptor: First address: 0000000002277E3F second address: 0000000002277E3F instructions:
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe RDTSC instruction interceptor: First address: 0000000002279186 second address: 0000000002279186 instructions:
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe RDTSC instruction interceptor: First address: 0000000002277B34 second address: 0000000002277B34 instructions: 0x00000000 rdtsc 0x00000002 mov eax, A61B5935h 0x00000007 sub eax, 0A56D0FAh 0x0000000c sub eax, E6EE1F05h 0x00000011 sub eax, B4D66935h 0x00000016 cpuid 0x00000018 cmp ax, bx 0x0000001b popad 0x0000001c call 00007F8C6CD58698h 0x00000021 lfence 0x00000024 mov edx, DFDCCA82h 0x00000029 add edx, 10E79E27h 0x0000002f add edx, 1BD31F13h 0x00000035 xor edx, 736987A8h 0x0000003b mov edx, dword ptr [edx] 0x0000003d lfence 0x00000040 cmp edx, edx 0x00000042 cmp ch, dh 0x00000044 cmp ah, dh 0x00000046 test dh, 00000068h 0x00000049 test dl, cl 0x0000004b ret 0x0000004c sub edx, esi 0x0000004e ret 0x0000004f add edi, edx 0x00000051 test bl, FFFFFFB5h 0x00000054 dec dword ptr [ebp+000000F8h] 0x0000005a test dx, dx 0x0000005d cmp dword ptr [ebp+000000F8h], 00000000h 0x00000064 jne 00007F8C6CD58672h 0x00000066 test dl, al 0x00000068 cmp bh, bh 0x0000006a call 00007F8C6CD586B9h 0x0000006f call 00007F8C6CD586BCh 0x00000074 lfence 0x00000077 mov edx, DFDCCA82h 0x0000007c add edx, 10E79E27h 0x00000082 add edx, 1BD31F13h 0x00000088 xor edx, 736987A8h 0x0000008e mov edx, dword ptr [edx] 0x00000090 lfence 0x00000093 cmp edx, edx 0x00000095 cmp ch, dh 0x00000097 cmp ah, dh 0x00000099 test dh, 00000068h 0x0000009c test dl, cl 0x0000009e ret 0x0000009f mov esi, edx 0x000000a1 pushad 0x000000a2 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227578F rdtsc 0_2_0227578F
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

barindex
Found potential dummy code loops (likely to delay analysis)
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Process Stats: CPU usage > 90% for more than 60s
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227578F rdtsc 0_2_0227578F
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_022782E3 mov eax, dword ptr fs:[00000030h] 0_2_022782E3
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02275346 mov eax, dword ptr fs:[00000030h] 0_2_02275346
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02277390 mov eax, dword ptr fs:[00000030h] 0_2_02277390
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227787F mov eax, dword ptr fs:[00000030h] 0_2_0227787F
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_02272CBB mov eax, dword ptr fs:[00000030h] 0_2_02272CBB
Source: C:\Users\user\Desktop\dt9XEhpeQQ.exe Code function: 0_2_0227389C mov eax, dword ptr fs:[00000030h] 0_2_0227389C
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: dt9XEhpeQQ.exe, 00000000.00000002.726264180.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: dt9XEhpeQQ.exe, 00000000.00000002.726264180.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: dt9XEhpeQQ.exe, 00000000.00000002.726264180.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: dt9XEhpeQQ.exe, 00000000.00000002.726264180.0000000000DA0000.00000002.00000001.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 431849 Sample: dt9XEhpeQQ Startdate: 09/06/2021 Architecture: WINDOWS Score: 76 8 Potential malicious icon found 2->8 10 Yara detected GuLoader 2->10 12 Machine Learning detection for sample 2->12 5 dt9XEhpeQQ.exe 2->5         started        process3 signatures4 14 Contains functionality to detect hardware virtualization (CPUID execution measurement) 5->14 16 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 5->16 18 Found potential dummy code loops (likely to delay analysis) 5->18 20 Tries to detect virtualization through RDTSC time measurements 5->20
No contacted IP infos