Play interactive tour

Edit tour

Windows Analysis Report Unreal.exe

Overview

General Information

Sample Name:	Unreal.exe
Analysis ID:	491482
MD5:	35a93d1f2edc044b3d8289abfeb17a43
SHA1:	c29f2524ae4bd239c849720b1fc6ce5c13bee93b
SHA256:	88d3b3a6564e25b63b31f4a00361384fd294f228763b3bde4e3162144971d385
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

Unreal.exe (PID: 1424 cmdline: 'C:\Users\user\Desktop\Unreal.exe' MD5: 35A93D1F2EDC044B3D8289ABFEB17A43)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=dow"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: Unreal.exe

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=dow"}

Multi AV Scanner detection for submitted file

Show sources

Source: Unreal.exe

ReversingLabs: Detection: 13%

Machine Learning detection for sample

Show sources

Source: Unreal.exe

Joe Sandbox ML: detected

Source: Unreal.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=dow

Source: Unreal.exe, 00000001.00000002.1194418396.00000000006CA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Unreal.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Unreal.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C0A31F	1_2_02C0A31F
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C00AC4	1_2_02C00AC4
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C07281	1_2_02C07281
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C09AA7	1_2_02C09AA7
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C0E2B0	1_2_02C0E2B0
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C07996	1_2_02C07996
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C095CB	1_2_02C095CB
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C0E567	1_2_02C0E567
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C09515	1_2_02C09515

Source: C:\Users\user\Desktop\Unreal.exe

Code function: 1_2_02C0A31F NtAllocateVirtualMemory,

1_2_02C0A31F

Source: C:\Users\user\Desktop\Unreal.exe

Process Stats: CPU usage > 98%

Source: Unreal.exe

ReversingLabs: Detection: 13%

Source: Unreal.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Unreal.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Unreal.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Unreal.exe

File created: C:\Users\user\AppData\Local\Temp\~DFBFBC969339417D40.TMP

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@0/0

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_00406669 push ds; iretd	1_2_0040666C
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_00404623 push esp; iretd	1_2_00404625
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_004064A6 push ebx; retf	1_2_004064B5
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_0040276E push ebx; iretd	1_2_00402771
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C05AED push eax; retf	1_2_02C05A8A
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C03221 push esp; retf	1_2_02C03223
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C00B2A push FFFFFFDEh; iretd	1_2_02C00B2C
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C01B33 push cs; iretd	1_2_02C01B34
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C02544 push ebp; retf	1_2_02C02546

Source: C:\Users\user\Desktop\Unreal.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Unreal.exe

Code function: 1_2_02C099BA rdtsc

1_2_02C099BA

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Unreal.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C09749 mov eax, dword ptr fs:[00000030h]	1_2_02C09749
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C0E567 mov eax, dword ptr fs:[00000030h]	1_2_02C0E567
Source: C:\Users\user\Desktop\Unreal.exe	Code function: 1_2_02C0D56C mov eax, dword ptr fs:[00000030h]	1_2_02C0D56C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Unreal.exe

Code function: 1_2_02C099BA rdtsc

1_2_02C099BA

Source: Unreal.exe, 00000001.00000002.1194495461.0000000000D60000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Unreal.exe, 00000001.00000002.1194495461.0000000000D60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Unreal.exe, 00000001.00000002.1194495461.0000000000D60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Unreal.exe, 00000001.00000002.1194495461.0000000000D60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery11	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Unreal.exe	13%	ReversingLabs	Win32.Trojan.Ursu
Unreal.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491482
Start date:	27.09.2021
Start time:	16:21:30
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Unreal.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 31.3% (good quality ratio 13.6%) Quality average: 24.7% Quality standard deviation: 31.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.50.102.62, 23.0.174.200, 23.0.174.185, 209.197.3.8, 20.54.110.249, 40.112.88.60, 23.10.249.26, 23.10.249.43, 20.82.210.154 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.281321845122127
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Unreal.exe
File size:	102400
MD5:	35a93d1f2edc044b3d8289abfeb17a43
SHA1:	c29f2524ae4bd239c849720b1fc6ce5c13bee93b
SHA256:	88d3b3a6564e25b63b31f4a00361384fd294f228763b3bde4e3162144971d385
SHA512:	dab0233817f1a28f0e1d15eb449d9c3c364796f6ddd66ced4307f3359635c29f38f80edd5e348bba03dd01d5522d358df1abd6d59e9ae94e750238af53b04bff
SSDEEP:	1536:yS+Spugs2L010fBhmNDLI41mFLHvHWJbrZk5Le5O3VzM/:F5puZA01iBYNh1m1HvHwfZkRz0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L...UL[W.................P...0...............`....@................

File Icon


Icon Hash:	78f8d6d4ac88d0e2

Static PE Info

General
Entrypoint:	0x4012d4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x575B4C55 [Fri Jun 10 23:25:09 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1eb0aaa4f15bbd841e91215ce68e26d2

Entrypoint Preview

Instruction
push 00413CE4h
call 00007F839479FCB5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
retf
dec ebx
enter 5C49h, 45h
or byte ptr [eax-32482CABh], 0000002Dh
mov dword ptr [eax], 00000000h
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, ah
call 00007F840DC0FCE4h
insd
outsb
outsd
add byte ptr [ecx+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
add dword ptr [55396847h], ebp
retf
adc ecx, dword ptr [ecx-62h]
xor ch, ch
mov byte ptr [edx+ebx*2], dl
xor ah, byte ptr [ecx+05h]
adc al, dh
stosd
in eax, 79h
push ecx
inc eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x153b4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x1cb8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xdc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14788	0x15000	False	0.563720703125	data	6.65071196081	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x16000	0x9f4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x1cb8	0x2000	False	0.26416015625	data	3.4642899067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x18b7a	0x13e	MS Windows icon resource - 1 icon, 16x16, 16 colors	English	United States
CUSTOM	0x185fc	0x57e	MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel	English	United States
CUSTOM	0x1807e	0x57e	MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel	English	United States
CUSTOM	0x17f40	0x13e	MS Windows icon resource - 1 icon, 16x16, 16 colors	English	United States
RT_ICON	0x178d8	0x668	dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 252, next used block 65280
RT_ICON	0x175f0	0x2e8	data
RT_ICON	0x174c8	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x17498	0x30	data
RT_VERSION	0x17230	0x268	MS Windows COFF Motorola 68000 object file	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Unreal
FileVersion	1.00
CompanyName	CelRox
Comments	CelRox
ProductName	CelRox
ProductVersion	1.00
FileDescription	CelRox
OriginalFilename	Unreal.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 16:22:55.802932024 CEST	58028	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:22:55.816143036 CEST	53	58028	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:14.649259090 CEST	53097	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:14.670001030 CEST	53	53097	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:14.850871086 CEST	49257	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:14.863709927 CEST	53	49257	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:15.408842087 CEST	62389	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:15.423602104 CEST	53	62389	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:16.172935963 CEST	49910	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:16.186321020 CEST	53	49910	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:17.174115896 CEST	55854	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:17.187020063 CEST	53	55854	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:17.586230040 CEST	64549	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:17.599744081 CEST	53	64549	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:21.041425943 CEST	63153	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:21.054033995 CEST	53	63153	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:21.459696054 CEST	52991	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:21.473274946 CEST	53	52991	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:21.897768974 CEST	53700	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:21.911376953 CEST	53	53700	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:22.579282045 CEST	51726	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:22.592345953 CEST	53	51726	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:23.162048101 CEST	56794	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:23.175529957 CEST	53	56794	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:23.667499065 CEST	56534	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:23.680376053 CEST	53	56534	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:24.591263056 CEST	56627	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:24.619868040 CEST	53	56627	8.8.8.8	192.168.2.4
Sep 27, 2021 16:23:42.471806049 CEST	56621	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:23:42.531838894 CEST	53	56621	8.8.8.8	192.168.2.4
Sep 27, 2021 16:24:12.893364906 CEST	63116	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:24:12.906344891 CEST	53	63116	8.8.8.8	192.168.2.4
Sep 27, 2021 16:24:15.293754101 CEST	64078	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:24:15.330523968 CEST	53	64078	8.8.8.8	192.168.2.4
Sep 27, 2021 16:24:47.693201065 CEST	64801	53	192.168.2.4	8.8.8.8
Sep 27, 2021 16:24:47.731434107 CEST	53	64801	8.8.8.8	192.168.2.4

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Unreal.exe PID: 1424 Parent PID: 6024

General

Start time:	16:22:30
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\Unreal.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Unreal.exe'
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	35A93D1F2EDC044B3D8289ABFEB17A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Unreal.exe PID: 1424 Parent PID: 6024 Unreal.exeCOMMON

Executed Functions

Function 02C0A31F, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 175memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-A9BE32F9,?,3EB49220), ref: 02C0A5CE

Strings

*, xrefs: 02C0A424

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: *
API String ID: 2167126740-2709624293
Opcode ID: 36f4a9b3de385edd24c5d871a5b6c2e3c9b6275d4899926f302762dcd7cea90e
Instruction ID: 02527d619eb104a9d35286b88e03442f578ed831d70014fed85ebf95d2107626
Opcode Fuzzy Hash: 36f4a9b3de385edd24c5d871a5b6c2e3c9b6275d4899926f302762dcd7cea90e
Instruction Fuzzy Hash: 59517771908395DFDF348E698C943DA37A5AF05360F85821FDD8AAB2D4D3305A82CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00414610, Relevance: 73.9, APIs: 40, Strings: 2, Instructions: 401COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,00401196), ref: 0041462E
#648.MSVBVM60(0000000A), ref: 00414685
__vbaFreeVar.MSVBVM60 ref: 00414692
#593.MSVBVM60(0000000A), ref: 004146B1
__vbaFreeVar.MSVBVM60 ref: 004146BD
__vbaOnError.MSVBVM60(000000FF), ref: 004146CC
__vbaOnError.MSVBVM60(00000000), ref: 004146DB
#582.MSVBVM60(00000000,00000000), ref: 004146EC
__vbaFpR8.MSVBVM60 ref: 004146F2
#541.MSVBVM60(0000000A,15:15:15), ref: 00414719
__vbaStrVarMove.MSVBVM60(0000000A), ref: 00414723
__vbaStrMove.MSVBVM60 ref: 0041472E
__vbaFreeVar.MSVBVM60 ref: 00414737
__vbaNew2.MSVBVM60(0041438C,004162D4), ref: 00414757
__vbaHresultCheckObj.MSVBVM60(00000000,?,00414378,00000014), ref: 004147BD
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041439C,000000D8), ref: 00414820
__vbaStrMove.MSVBVM60 ref: 00414851
__vbaFreeObj.MSVBVM60 ref: 0041485A
#532.MSVBVM60(Specting7), ref: 0041486C
__vbaHresultCheckObj.MSVBVM60(?,?,00414278,000006F8), ref: 00414941
__vbaHresultCheckObj.MSVBVM60(00000000,?,00414248,000002B4), ref: 00414995
#595.MSVBVM60(00004003,00000000,0000000A,0000000A,?), ref: 00414A5B
__vbaFreeVarList.MSVBVM60(00000003,0000000A,0000000A,?), ref: 00414A6F
__vbaFreeStr.MSVBVM60(00414AC4), ref: 00414AB4
__vbaFreeStr.MSVBVM60 ref: 00414ABD

Strings

15:15:15, xrefs: 00414710
Specting7, xrefs: 00414867

Memory Dump Source

Source File: 00000001.00000002.1194378736.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1194372872.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1194392253.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1194398140.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$Error$#532#541#582#593#595#648ChkstkListNew2
String ID: 15:15:15$Specting7
API String ID: 4146733498-3993399904
Opcode ID: 3c19b350244f7a997bcc6d10953a02874933c961070751193c27143c43868876
Instruction ID: 5f9f51a66d304f39a9c33e4817ea7bc3dbc15a7f6d603ecbc25c27219b531422
Opcode Fuzzy Hash: 3c19b350244f7a997bcc6d10953a02874933c961070751193c27143c43868876
Instruction Fuzzy Hash: 7E0216B4901259EFDB14DF90CD88BDDBBB4FB48304F10819AE549BB2A0D7785A84CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004012D4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 004012D9

Strings

VB5!6&*, xrefs: 004012D4

Memory Dump Source

Source File: 00000001.00000002.1194378736.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1194372872.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1194392253.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1194398140.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 12fb11b6a79087246e86ef19f1addd359324f40b101fcb8d02bc8f309d971a70
Instruction ID: eae28493d6a045f80a0c899f4850ba8c675f22097e2f31701147fe64f079a303
Opcode Fuzzy Hash: 12fb11b6a79087246e86ef19f1addd359324f40b101fcb8d02bc8f309d971a70
Instruction Fuzzy Hash: 8BD0B65264F3C01EC303237168220816FB00D4361030B00E7D080EE0B3D00C088CC377

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02C0E567, Relevance: 6.5, Strings: 4, Instructions: 1529COMMON

Download Yara Rule

Strings

Ea^_, xrefs: 02C08967
:b, xrefs: 02C08D29
+dDe, xrefs: 02C0E8C6
<M, xrefs: 02C0EEA5

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +dDe$:b$Ea^_$<M
API String ID: 0-2267300782
Opcode ID: 17d4347909a57a9e3ac6b9621130d92e32f5102c5a6a13ef3e9d3eef55439778
Instruction ID: a3cb1a33d5bda6792ccad4f20fe456aec5e3d7d7e78bc86a687c4d80b9cb2e3b
Opcode Fuzzy Hash: 17d4347909a57a9e3ac6b9621130d92e32f5102c5a6a13ef3e9d3eef55439778
Instruction Fuzzy Hash: DBD22571604386CFDF349F39CD987EA7BA2AF56350F55821ECC8A8B295D3348685CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02C09515, Relevance: 3.5, Strings: 2, Instructions: 962COMMON

Download Yara Rule

Strings

Ea^_, xrefs: 02C08967
:b, xrefs: 02C08D29

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :b$Ea^_
API String ID: 0-1604152765
Opcode ID: 562a0ec52ef596e17c4cb021d136a39bd9e91751aa76766d1315a3ee688a1be6
Instruction ID: 4a90caddaab0850b5837b298566eff123a2d175be64eff3424d47aea710d9d91
Opcode Fuzzy Hash: 562a0ec52ef596e17c4cb021d136a39bd9e91751aa76766d1315a3ee688a1be6
Instruction Fuzzy Hash: C582307160434ADFDF389E39CD957EA7BA2BF55340F45821EDC8A9B294D3318A85CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02C0E2B0, Relevance: 3.4, Strings: 2, Instructions: 901COMMON

Download Yara Rule

Strings

Ea^_, xrefs: 02C08967
:b, xrefs: 02C08D29

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :b$Ea^_
API String ID: 0-1604152765
Opcode ID: 60cec1925ee3b25cc068d9e75a8e3af815fe31f791f1b4f2b160eb88572e71b6
Instruction ID: db40cab8250249981a5a62bfd559b50da55984a938bb011fa3912e2fd8f89228
Opcode Fuzzy Hash: 60cec1925ee3b25cc068d9e75a8e3af815fe31f791f1b4f2b160eb88572e71b6
Instruction Fuzzy Hash: E572207160434ADFDF389E39CD957EA7BA2BF55340F45821EDC8A9B294D3318A85CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02C095CB, Relevance: 3.4, Strings: 2, Instructions: 864COMMON

Download Yara Rule

Strings

Ea^_, xrefs: 02C08967
:b, xrefs: 02C08D29

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :b$Ea^_
API String ID: 0-1604152765
Opcode ID: eb6467110929b8c652b452a48598845c67328433e501b371ab4ae886f1fbd388
Instruction ID: 3cb148d14fe2cca87b97bb1eec351457a53dc90650a99b893353a5981fbd53b5
Opcode Fuzzy Hash: eb6467110929b8c652b452a48598845c67328433e501b371ab4ae886f1fbd388
Instruction Fuzzy Hash: F972117160434ADFDB389E35CD957EA7BA2FF55340F85821EDC8A9B294D3318A85CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02C00AC4, Relevance: 3.4, Strings: 2, Instructions: 856COMMON

Download Yara Rule

Strings

Ea^_, xrefs: 02C08967
:b, xrefs: 02C08D29

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :b$Ea^_
API String ID: 0-1604152765
Opcode ID: 6c6397b9fd06f5386dd716baa66558d2ff0485cbb54e7f2defd0c7ab5e181de3
Instruction ID: fed4546532fec80317a502b56f3c0183f37c404f2a802f9da27f7043c7ec8016
Opcode Fuzzy Hash: 6c6397b9fd06f5386dd716baa66558d2ff0485cbb54e7f2defd0c7ab5e181de3
Instruction Fuzzy Hash: C172017160434ADFDB389E39C9957EA7BB2FF55340F45821EDC8A9B294D3318A85CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02C09AA7, Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

pg`r, xrefs: 02C09C96
"l, xrefs: 02C09B2C

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID: pg`r$"l
API String ID: 0-6584728
Opcode ID: b4149a2abde4ef57ef32d75635e149a17b6f212bcada828c8254e76b86ada554
Instruction ID: a720be7a6f1f3d7bf4c8c3bdf6d9e125f3b98fc985fc2806bc5bb797d27b2625
Opcode Fuzzy Hash: b4149a2abde4ef57ef32d75635e149a17b6f212bcada828c8254e76b86ada554
Instruction Fuzzy Hash: 6331F772B467488BEF384D3A8DE47EA22E3AF86750F55811BCC4E872D5D7354586CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02C07281, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29923c0bb3c3b68dde1c6660f7ed82b26d7376ddb3449d831e37483a7260a69b
Instruction ID: bba7339265cacaa25cade21ec2ff0863b393cc845acc030cca7321c6afa0b5a5
Opcode Fuzzy Hash: 29923c0bb3c3b68dde1c6660f7ed82b26d7376ddb3449d831e37483a7260a69b
Instruction Fuzzy Hash: 1F3160301483858BDB79DEB8D9C4BC6BB90AF12364F48829CCC9D8A1DBE3355146C752

Uniqueness

Uniqueness Score: -1.00%

Function 02C07996, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7259f1fc3035f5fe2f0b62125c918a9f6a0cfa6f255a026bc5019fc3cb49ae
Instruction ID: c0a3689eaed703078687906f2e53e07e5ac8d9bf0b38d047066a47e8f4b9bba6
Opcode Fuzzy Hash: 6f7259f1fc3035f5fe2f0b62125c918a9f6a0cfa6f255a026bc5019fc3cb49ae
Instruction Fuzzy Hash: BD11E431A883019FCB5C5D719A927EFBBE2EF15340F834A1ECCC282199C7344584CA03

Uniqueness

Uniqueness Score: -1.00%

Function 02C0D56C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ec8223dc2d870f8e77bc9ef0e2dc7ae8580d0bf7cb9c44e80547e63c0f02e5
Instruction ID: ea8af87273c49b69cae9d03142399111d198d5f0415960dd8030a09f6b6ca7e5
Opcode Fuzzy Hash: a3ec8223dc2d870f8e77bc9ef0e2dc7ae8580d0bf7cb9c44e80547e63c0f02e5
Instruction Fuzzy Hash: F711BFB6A012488FC734DF95C9D4BED73A2EF89B00F65446AD84A4B396C770AB41DB11

Uniqueness

Uniqueness Score: -1.00%

Function 02C099BA, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eeeb1f1757ac91cbe06c395ed6387b5cd174a035fc01037477d4a2a48af968f
Instruction ID: 706b84a931e1a45bf79c21b1c52e98a6561fb844d540d5c595ec1f7c1ef902aa
Opcode Fuzzy Hash: 8eeeb1f1757ac91cbe06c395ed6387b5cd174a035fc01037477d4a2a48af968f
Instruction Fuzzy Hash: 6ED080455DC2530833923476774839708125FD5FA4F0587105D16E71C7DD66CD417553

Uniqueness

Uniqueness Score: -1.00%

Function 02C09749, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1194764231.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e08f371d08430c0aa7c24ab263c8d88761a4deab28627cd0436a00fb98a763
Instruction ID: 120efc9e94c0b896860df485d576750613d3e983be090d8f51926390d19d9c17
Opcode Fuzzy Hash: e9e08f371d08430c0aa7c24ab263c8d88761a4deab28627cd0436a00fb98a763
Instruction Fuzzy Hash: 5BB092B6201A809FEF02CE08D482B4073B0FB05A84B0904D0E402CB712C228E904CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00414E60, Relevance: 71.0, APIs: 47, Instructions: 452COMMON

Download Yara Rule

APIs

#713.MSVBVM60(004143E8,?,?,?,?,?,?,?,?,?,?,?,?,?,00401196), ref: 00414EA8
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401196), ref: 00414EB3
__vbaStrCmp.MSVBVM60(004143F4,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401196), ref: 00414EBF
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401196), ref: 00414ED2
__vbaRedim.MSVBVM60(00000080,00000002,?,00000002,00000001,00000012,00000000), ref: 00414EF3
__vbaGenerateBoundsError.MSVBVM60 ref: 00414F1B
__vbaGenerateBoundsError.MSVBVM60 ref: 00414F2B
__vbaGenerateBoundsError.MSVBVM60 ref: 00414F57
__vbaGenerateBoundsError.MSVBVM60 ref: 00414F61
__vbaGenerateBoundsError.MSVBVM60 ref: 00414F8D
__vbaGenerateBoundsError.MSVBVM60 ref: 00414F97
__vbaGenerateBoundsError.MSVBVM60 ref: 00414FC3
__vbaGenerateBoundsError.MSVBVM60 ref: 00414FCD
__vbaGenerateBoundsError.MSVBVM60 ref: 00414FF9
__vbaGenerateBoundsError.MSVBVM60 ref: 00415003
__vbaGenerateBoundsError.MSVBVM60 ref: 0041502F
__vbaGenerateBoundsError.MSVBVM60 ref: 00415039
__vbaGenerateBoundsError.MSVBVM60 ref: 00415065
__vbaGenerateBoundsError.MSVBVM60 ref: 0041506F
__vbaGenerateBoundsError.MSVBVM60 ref: 0041509B
__vbaGenerateBoundsError.MSVBVM60 ref: 004150A5
__vbaGenerateBoundsError.MSVBVM60 ref: 004150D1
__vbaGenerateBoundsError.MSVBVM60 ref: 004150DB
__vbaGenerateBoundsError.MSVBVM60 ref: 00415107
__vbaGenerateBoundsError.MSVBVM60 ref: 00415111
__vbaGenerateBoundsError.MSVBVM60 ref: 0041513D
__vbaGenerateBoundsError.MSVBVM60 ref: 00415147
__vbaGenerateBoundsError.MSVBVM60 ref: 00415173
__vbaGenerateBoundsError.MSVBVM60 ref: 0041517D
__vbaGenerateBoundsError.MSVBVM60 ref: 004151A9
__vbaGenerateBoundsError.MSVBVM60 ref: 004151B3
__vbaGenerateBoundsError.MSVBVM60 ref: 004151DF
__vbaGenerateBoundsError.MSVBVM60 ref: 004151E9
__vbaGenerateBoundsError.MSVBVM60 ref: 00415215
__vbaGenerateBoundsError.MSVBVM60 ref: 0041521F
__vbaGenerateBoundsError.MSVBVM60 ref: 0041524B
__vbaGenerateBoundsError.MSVBVM60 ref: 00415255
__vbaGenerateBoundsError.MSVBVM60 ref: 00415281
__vbaGenerateBoundsError.MSVBVM60 ref: 0041528B
__vbaGenerateBoundsError.MSVBVM60 ref: 004152B7
__vbaGenerateBoundsError.MSVBVM60 ref: 004152C1
__vbaNew2.MSVBVM60(0041438C,004162D4), ref: 004152E1
__vbaHresultCheckObj.MSVBVM60(00000000,021F004C,00414378,00000014), ref: 0041530C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041439C,00000078), ref: 00415334
__vbaFreeObj.MSVBVM60 ref: 00415339
__vbaHresultCheckObj.MSVBVM60(00000000,00401180,00414248,00000254), ref: 00415362
__vbaAryDestruct.MSVBVM60(00000000,?,0041538B), ref: 00415384

Memory Dump Source

Source File: 00000001.00000002.1194378736.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1194372872.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1194392253.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1194398140.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$BoundsErrorGenerate$CheckHresult$Free$#713DestructMoveNew2Redim
String ID:
API String ID: 58225848-0
Opcode ID: 55597f09d81c99a19fc9b46ab2849b01153f8409f8f86cdfbd7813b32d4e4f50
Instruction ID: 05e61b26f8d52e1746c9c80d715b7f81e21d321a5afcf69a3e66fbe9a8008d5b
Opcode Fuzzy Hash: 55597f09d81c99a19fc9b46ab2849b01153f8409f8f86cdfbd7813b32d4e4f50
Instruction Fuzzy Hash: DB024A35A0061ACBCB14EFA4C5819FEFBB5AF85304F21416AC9026B790D775ACC7CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414CA0, Relevance: 16.6, APIs: 11, Instructions: 128COMMON

Download Yara Rule

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,?,00414248,00000114), ref: 00414CFD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00414248,00000110), ref: 00414D26
#554.MSVBVM60 ref: 00414D32
__vbaNew2.MSVBVM60(0041438C,004162D4), ref: 00414D4A
__vbaHresultCheckObj.MSVBVM60(00000000,021F004C,00414378,00000014), ref: 00414D6F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041439C,000000C0), ref: 00414D95
__vbaFreeObj.MSVBVM60 ref: 00414D9A
__vbaNew2.MSVBVM60(0041438C,004162D4), ref: 00414DB2
__vbaHresultCheckObj.MSVBVM60(00000000,021F004C,00414378,00000034), ref: 00414DFC
__vbaObjSet.MSVBVM60(?,?), ref: 00414E0D
__vbaFreeObj.MSVBVM60(00414E35), ref: 00414E2E

Memory Dump Source

Source File: 00000001.00000002.1194378736.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1194372872.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1194392253.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1194398140.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2$#554
String ID:
API String ID: 420915087-0
Opcode ID: bc259f7e016f157a75e6de2a4ff6ef7d57a7aaea0983f664e82ff4718ab796d7
Instruction ID: 9ad67d717651f06e4d8735d053d3e89020d3d354963e254ec6265aedec3f33d7
Opcode Fuzzy Hash: bc259f7e016f157a75e6de2a4ff6ef7d57a7aaea0983f664e82ff4718ab796d7
Instruction Fuzzy Hash: DC41B270941318ABDB04EF94DD89EDEBBB8FF48705F21406AF544B7290C7B4A984CB68

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Unreal.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Unreal.exe PID: 1424 Parent PID: 6024

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Unreal.exe PID: 1424 Parent PID: 6024 Unreal.exeCOMMON

Executed Functions