Analysis Report EXErprijFY

ID:	433989
Product:	CloudBasic
Start time:	09:17:28
Start date:	14.06.2021
Sample:	EXErprijFY
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	ee83942376ea5717149517fcc832ab9f
SHA1:	ec75b10c6ef046cb63eaa20470ac94529fb4873a
SHA256:	b3498937a71913d7101fafb04eb48a791106bec97e21839b2e1be8bb55a3f5fc
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: EXErprijFY.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://bara-seck.com/bin_NpuMLUuCfC62.bin, http://farmersschool.ge/bin_NpuMLUuCfC62.bin

Avira URL Cloud: Label: malware

Found malware configuration

Source: EXErprijFY.exe

Malware Configuration Extractor: GuLoader {"Payload URL": "https://bara-seck.com/bin_NpuMLUuCfC62.bin, http://farmersschool.ge/bin_NpuMLUuCfC62.bin"}

Compliance:

Uses 32bit PE files

Source: EXErprijFY.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://bara-seck.com/bin_NpuMLUuCfC62.bin, http://farmersschool.ge/bin_NpuMLUuCfC62.bin

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: EXErprijFY.exe, 00000000.00000002.1164512673.00000000006FA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\EXErprijFY.exe

Process Stats: CPU usage > 98%

Detected potential crypto function

Source: C:\Users\user\Desktop\EXErprijFY.exe	Code function: 0_2_004018A4		0_2_004018A4
Source: C:\Users\user\Desktop\EXErprijFY.exe	Code function: 0_2_00405732		0_2_00405732

PE file contains strange resources

Source: EXErprijFY.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: EXErprijFY.exe, 00000000.00000000.641912573.0000000000424000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamepetered.exe vs EXErprijFY.exe
Source: EXErprijFY.exe, 00000000.00000002.1164581076.00000000020E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamepetered.exeFE2X2 vs EXErprijFY.exe
Source: EXErprijFY.exe, 00000000.00000002.1164581076.00000000020E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamepetered.exeFE2X vs EXErprijFY.exe
Source: EXErprijFY.exe, 00000000.00000002.1164581076.00000000020E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamepetered.exeFE2XpJ4 vs EXErprijFY.exe
Source: EXErprijFY.exe, 00000000.00000002.1164581076.00000000020E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamepetered.exeFE2X_I vs EXErprijFY.exe
Source: EXErprijFY.exe, 00000000.00000002.1164581076.00000000020E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamepetered.exeFE2X>N~ vs EXErprijFY.exe
Source: EXErprijFY.exe, 00000000.00000002.1164581076.00000000020E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamepetered.exeFE2XxO< vs EXErprijFY.exe
Source: EXErprijFY.exe, 00000000.00000002.1164564990.00000000020A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs EXErprijFY.exe
Source: EXErprijFY.exe	Binary or memory string: OriginalFilenamepetered.exe vs EXErprijFY.exe

Uses 32bit PE files

Source: EXErprijFY.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@1/0@0/0

PE file has an executable .text section and no other executable section

Source: EXErprijFY.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\EXErprijFY.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\EXErprijFY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1164652170.0000000002230000.00000040.00000001.sdmp, type: MEMORY

Yara detected GuLoader

Source: Yara match	File source: EXErprijFY.exe, type: SAMPLE
Source: Yara match	File source: 0.0.EXErprijFY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EXErprijFY.exe.400000.0.unpack, type: UNPACKEDPE

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\EXErprijFY.exe	Code function: 0_2_004059CC pushfd ; iretd		0_2_004059D5
Source: C:\Users\user\Desktop\EXErprijFY.exe	Code function: 0_2_00406199 push ss; ret		0_2_004062BA
Source: C:\Users\user\Desktop\EXErprijFY.exe	Code function: 0_2_00407E0A push ecx; iretd		0_2_00407E0C
Source: C:\Users\user\Desktop\EXErprijFY.exe	Code function: 0_2_004062BD push ss; ret		0_2_004062BA
Source: C:\Users\user\Desktop\EXErprijFY.exe	Code function: 0_2_00402F0B push dword ptr [ebp-1Ch]; ret		0_2_0041B724
Source: C:\Users\user\Desktop\EXErprijFY.exe	Code function: 0_2_00409B16 push ecx; retf		0_2_00409B23

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\EXErprijFY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\EXErprijFY.exe	RDTSC instruction interceptor: First address: 0000000002237154 second address: 0000000002237154 instructions:
Source: C:\Users\user\Desktop\EXErprijFY.exe	RDTSC instruction interceptor: First address: 000000000223A078 second address: 000000000223A078 instructions:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\EXErprijFY.exe	RDTSC instruction interceptor: First address: 0000000002237154 second address: 0000000002237154 instructions:
Source: C:\Users\user\Desktop\EXErprijFY.exe	RDTSC instruction interceptor: First address: 000000000223A021 second address: 000000000223A078 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 53673179h 0x00000007 sub eax, 2CF91FC3h 0x0000000c xor eax, 4DAF12BEh 0x00000011 sub eax, 6BC10307h 0x00000016 cpuid 0x00000018 jmp 00007F311485C18Eh 0x0000001a pushad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\EXErprijFY.exe	RDTSC instruction interceptor: First address: 000000000223A078 second address: 000000000223A078 instructions:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\EXErprijFY.exe

Process Stats: CPU usage > 90% for more than 60s

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: EXErprijFY.exe, 00000000.00000002.1164536037.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: EXErprijFY.exe, 00000000.00000002.1164536037.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: EXErprijFY.exe, 00000000.00000002.1164536037.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: EXErprijFY.exe, 00000000.00000002.1164536037.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: Progmanlock