Analysis Report Facturas Pagadas Al Vencimiento.exe

ID:	433561
Product:	CloudBasic
Start time:	15:09:33
Start date:	12.06.2021
Sample:	Facturas Pagadas Al Vencimiento.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	c8d357afda8635441bc5838244ca0029
SHA1:	026b3b6bafa462c763860afeb21b3cfe05aeb600
SHA256:	94bfbe95a21d987080ac95825abde8cf1aa7955fa711c8daeea32ba18590979d
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Facturas Pagadas_2024e1b44264dba4d9a5d8d4883c883c62d1e68_380e93cd_0c3f9333\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	9EA029D2DEC2DAC1871DA0DE53099B26	EC7F053B9C4D11B27BA47633298867D30D4348AE	DA4F27E735FEA5ECF5F676004681DC59A448345BBB6EA095624B160C2BF7C63A
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Facturas Pagadas_e1b59d2026da206526c3718df9ca6d5772b50_380e93cd_15f7655d\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	A29547129D5A2CB01A0ACB99A9CDC563	C9AFB5880D3BCA7B7F8D44895DAAECCA6FA30BA5	35C3B671447641B38440405ABA08AC6B6296BE017A0CE7F9A1D4E394B0C86DB7
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C35.tmp.dmp	Mini DuMP crash report, 14 streams, Sat Jun 12 22:10:31 2021, 0x1205a4 type	1631B17E646B5ABB302115F47F42516A	6B9FA3B6E2E47306B33C4622A993A43446ACF02E	635BAF95212741218C99B5A61B6E547E1DB55CC61C49A900BAE3751D9049964B
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D8E.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	6E948DEB4BF5FCA5846D52C14CEB2F19	98419967C462534BCBD83F4D5992DCFBFD2018B3	E78B92EC4695D4C464298740C0A83F09392971B5A99D945FE41D2AC318F3841D
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E2B.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	5C690A8607E83CF1AC15D11729446481	C1E5152E057B266A70454F0D541FE284F165CE74	A712512A506D92FC2E5EA1BF56026954E8D67CF61AD60C1CDAA6AED6527858F2
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8587.tmp.dmp	Mini DuMP crash report, 14 streams, Sat Jun 12 22:10:41 2021, 0x1205a4 type	740B80A74D73165741D221C663BF2747	F9CA62EE3CCA562211EC55E79D567EBB8FD44A22	4A265581BA51892FC94B803C6E776FF2B2E3FD5004B6E5E7E07FEA1A8F8B8AEC
C:\ProgramData\Microsoft\Windows\WER\Temp\WER86B1.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	F922260DAAF05B490EB120AEF46E81FE	47DA4C10A2B4B214357A85DC16824168DB99251C	839A6D242FE912CC16F82DF24F0D0214F1F0E20D7816B49B9FAEA715A575A93A
C:\ProgramData\Microsoft\Windows\WER\Temp\WER874F.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	E02DDF099C74EDBE4B94FCE2858DFE5D	050B6AA8F3393539E468BD039BA4C76DFF46D763	93E8E1A1BED1CE09C3229858CCE21C853F7F958E1B6A29063875123220844AA6

AV Detection:

Found malware configuration

Source: Facturas Pagadas Al Vencimiento.exe

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1dBTGLOe-ZeMuRpNWg8qsJp7BOE8QNF9s5l"}

Multi AV Scanner detection for submitted file

Source: Facturas Pagadas Al Vencimiento.exe	Virustotal: Detection: 71%			Perma Link
Source: Facturas Pagadas Al Vencimiento.exe	Metadefender: Detection: 45%			Perma Link
Source: Facturas Pagadas Al Vencimiento.exe	ReversingLabs: Detection: 69%

Compliance:

Uses 32bit PE files

Source: Facturas Pagadas Al Vencimiento.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1dBTGLOe-ZeMuRpNWg8qsJp7BOE8QNF9s5l

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: Facturas Pagadas Al Vencimiento.exe, 00000000.00000002.251983968.000000000073A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Detected potential crypto function

Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe

Code function: 0_2_004014BC

0_2_004014BC

One or more processes crash

Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 696

PE file contains strange resources

Source: Facturas Pagadas Al Vencimiento.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: Facturas Pagadas Al Vencimiento.exe, 00000000.00000000.236913139.0000000000610000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs Facturas Pagadas Al Vencimiento.exe
Source: Facturas Pagadas Al Vencimiento.exe, 00000000.00000000.228562671.0000000000421000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameGRFTNING.exe vs Facturas Pagadas Al Vencimiento.exe
Source: Facturas Pagadas Al Vencimiento.exe	Binary or memory string: OriginalFilenameGRFTNING.exe vs Facturas Pagadas Al Vencimiento.exe

Uses 32bit PE files

Source: Facturas Pagadas Al Vencimiento.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal76.rans.troj.winEXE@3/8@0/1

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6040

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C35.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: Facturas Pagadas Al Vencimiento.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: Facturas Pagadas Al Vencimiento.exe	Virustotal: Detection: 71%
Source: Facturas Pagadas Al Vencimiento.exe	Metadefender: Detection: 45%
Source: Facturas Pagadas Al Vencimiento.exe	ReversingLabs: Detection: 69%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe 'C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe'
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 696
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 696

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Yara detected GuLoader

Source: Yara match	File source: Facturas Pagadas Al Vencimiento.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Facturas Pagadas Al Vencimiento.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Facturas Pagadas Al Vencimiento.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Facturas Pagadas Al Vencimiento.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Facturas Pagadas Al Vencimiento.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Facturas Pagadas Al Vencimiento.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Facturas Pagadas Al Vencimiento.exe.400000.7.unpack, type: UNPACKEDPE

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_00406C48 push edi; iretd		0_2_00406C4C
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040A4F0 push edi; retf		0_2_0040A4F6
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040B88A push es; ret		0_2_0040B902
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_004018A5 push eax; retn 0041h		0_2_004018AD
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040CD40 push FFFFFF87h; ret		0_2_0040CD42
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040AD1C pushfd ; ret		0_2_0040AD2E
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040DE63 push ds; ret		0_2_0040DE6D
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040C20B push FFFFFFF9h; ret		0_2_0040C2DE
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040C20D push FFFFFFF9h; ret		0_2_0040C2DE
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040CAC2 pushad ; ret		0_2_0040CAD2
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_00405EC5 push es; ret		0_2_00405EC8
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040D6DA push cs; ret		0_2_0040D6F1
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040BA91 push ss; ret		0_2_0040BA92
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_0040829F push 00000055h; ret		0_2_004082BD
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_00409768 push ebp; ret		0_2_0040976D
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_00409F3A push 00000048h; ret		0_2_00409F92
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_00409FCB push 00000048h; ret		0_2_00409F92
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Code function: 0_2_004077DD push ebp; ret		0_2_0040780E

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\Facturas Pagadas Al Vencimiento.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: Facturas Pagadas Al Vencimiento.exe, 00000000.00000000.237197797.0000000000CC0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Facturas Pagadas Al Vencimiento.exe, 00000000.00000000.237197797.0000000000CC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Facturas Pagadas Al Vencimiento.exe, 00000000.00000000.237197797.0000000000CC0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Facturas Pagadas Al Vencimiento.exe, 00000000.00000000.237197797.0000000000CC0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock