Play interactive tour

Edit tour

Windows Analysis Report payment confirmation.exe

Overview

General Information

Sample Name:	payment confirmation.exe
Analysis ID:	491535
MD5:	930debccdeecb4fc138b0319bef33720
SHA1:	b56f93dc8316eb35a3b311ce1c412e5d617bcfeb
SHA256:	03082b2f67073c9017a28fe1ef9166d38edd339ef72da583653f083ec2b9fac4
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Initial sample is a PE file and has a suspicious name

Tries to detect virtualization through RDTSC time measurements

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

payment confirmation.exe (PID: 3316 cmdline: 'C:\Users\user\Desktop\payment confirmation.exe' MD5: 930DEBCCDEECB4FC138B0319BEF33720)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=dow"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=dow"}

Multi AV Scanner detection for submitted file

Show sources

Source: payment confirmation.exe	Virustotal: Detection: 30%			Perma Link
Source: payment confirmation.exe	ReversingLabs: Detection: 15%

Source: payment confirmation.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=dow

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: payment confirmation.exe

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: payment confirmation.exe

Static file information: Suspicious name

Source: payment confirmation.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: payment confirmation.exe, 00000001.00000002.872716225.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamedamrred.exe vs payment confirmation.exe
Source: payment confirmation.exe	Binary or memory string: OriginalFilenamedamrred.exe vs payment confirmation.exe

Source: payment confirmation.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F72A4
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021FBC77
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6236
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F622A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F625A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F624E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6242
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5A96
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5A8A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5AAE
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5AA2
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5AEA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F637A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5B78
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F636E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F639E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6392
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6386
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021FABBD
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F63C2
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5876
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F589A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F588E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5882
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F58A6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F58CA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F60FE
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F60F2
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6116
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F610A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6122
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6146
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5161
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5996
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F598A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F59BA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F59A2
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F59C6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5652
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5646
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5676
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5E9E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5E92
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5E86
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5682
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F76AB
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F575E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5752
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F576A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5F9E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5F92
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5FB6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5FAA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F57A6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5FF6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6FEA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C3E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C32
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C56
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C4A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C6E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C62
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F54D0
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D3E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5536
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D32
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F552A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D26
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D56
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F554E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D4A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5542
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D7A

Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F72A4 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F787E NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7872 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7866 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7896 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F788A NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F78BA NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F76AB NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F774E NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F777E NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7772 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7766 NtAllocateVirtualMemory,

Source: C:\Users\user\Desktop\payment confirmation.exe

Process Stats: CPU usage > 98%

Source: payment confirmation.exe	Virustotal: Detection: 30%
Source: payment confirmation.exe	ReversingLabs: Detection: 15%

Source: payment confirmation.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\payment confirmation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\payment confirmation.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: C:\Users\user\Desktop\payment confirmation.exe

File created: C:\Users\user\AppData\Local\Temp\~DF6135C90C205E10D1.TMP

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_00406252 push ebx; retf
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_0040645E push edi; retf
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_00404A04 push 0000003Ah; iretd
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_0040523B push edi; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_004080D3 push cs; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_004060E8 push dword ptr [edi-36h]; iretd
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_00408098 push cs; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_004047D9 push cs; retf
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_00404795 push cs; retf
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F8A25 pushad ; retf
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F8A44 push eax; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F2AFA push eax; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F8336 push 5FF5B4E2h; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F236E push ecx; retf
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F83AF push 84000016h; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F8890 push esi; iretd
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1883 pushad ; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F3882 push eax; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F49C7 push esp; iretd
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1698 pushad ; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F16FE pushad ; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1716 pushad ; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F170A pushad ; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1722 pushad ; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1568 push eax; ret
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F45D4 pusha ; iretd

Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\payment confirmation.exe	RDTSC instruction interceptor: First address: 000000000040EC4B second address: 000000000040EC4B instructions: 0x00000000 rdtsc 0x00000002 cmp ecx, 50h 0x00000005 cmp eax, 00000089h 0x0000000a popad 0x0000000b cmp eax, 4Fh 0x0000000e wait 0x0000000f dec edi 0x00000010 lfence 0x00000013 wait 0x00000014 cmp edi, 00000000h 0x00000017 jne 00007F6508BEA90Fh 0x00000019 pushfd 0x0000001a popfd 0x0000001b mfence 0x0000001e pushad 0x0000001f mfence 0x00000022 wait 0x00000023 rdtsc
Source: C:\Users\user\Desktop\payment confirmation.exe	RDTSC instruction interceptor: First address: 00000000021F6F29 second address: 00000000021F6F29 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 6D2A1F19h 0x00000007 xor eax, 45945F07h 0x0000000c add eax, C726675Ch 0x00000011 add eax, 101B5887h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F650838F078h 0x0000001e lfence 0x00000021 mov edx, CC755165h 0x00000026 xor edx, BA4B37F6h 0x0000002c xor edx, 2C31E30Ah 0x00000032 xor edx, 25F1858Dh 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 add edi, edx 0x00000044 dec ecx 0x00000045 mov dword ptr [ebp+000001B3h], ecx 0x0000004b mov ecx, A73C3F3Ch 0x00000050 add ecx, 692C6FF6h 0x00000056 sub ecx, 1AB1EA29h 0x0000005c add ecx, 0A493AF7h 0x00000062 cmp dword ptr [ebp+000001B3h], ecx 0x00000068 mov ecx, dword ptr [ebp+000001B3h] 0x0000006e jne 00007F650838F02Dh 0x00000070 test al, al 0x00000072 mov dword ptr [ebp+0000025Bh], edi 0x00000078 mov edi, ecx 0x0000007a push edi 0x0000007b mov edi, dword ptr [ebp+0000025Bh] 0x00000081 call 00007F650838F148h 0x00000086 call 00007F650838F099h 0x0000008b lfence 0x0000008e mov edx, CC755165h 0x00000093 xor edx, BA4B37F6h 0x00000099 xor edx, 2C31E30Ah 0x0000009f xor edx, 25F1858Dh 0x000000a5 mov edx, dword ptr [edx] 0x000000a7 lfence 0x000000aa ret 0x000000ab mov esi, edx 0x000000ad pushad 0x000000ae rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\payment confirmation.exe

Code function: 1_2_021F7235 rdtsc

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\payment confirmation.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021FABBD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F99FC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F9F4F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6D48 mov eax, dword ptr fs:[00000030h]

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\payment confirmation.exe

Code function: 1_2_021F7235 rdtsc

Source: C:\Users\user\Desktop\payment confirmation.exe

Code function: 1_2_021FBC77 RtlAddVectoredExceptionHandler,

Source: payment confirmation.exe, 00000001.00000002.872876297.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: payment confirmation.exe, 00000001.00000002.872876297.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: payment confirmation.exe, 00000001.00000002.872876297.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: payment confirmation.exe, 00000001.00000002.872876297.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
payment confirmation.exe	30%	Virustotal		Browse
payment confirmation.exe	16%	ReversingLabs	Win32.Trojan.Mucc

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491535
Start date:	27.09.2021
Start time:	17:18:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	payment confirmation.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 9.4% (good quality ratio 6.5%) Quality average: 46.4% Quality standard deviation: 35.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 2.18.108.150, 20.49.157.6, 23.209.125.83, 23.209.125.71, 20.54.110.249, 40.112.88.60, 20.82.209.183, 23.10.249.43, 23.10.249.26, 95.100.54.203 Excluded domains from analysis (whitelisted): a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, cdn.onenote.net.edgekey.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, prod.fs.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, e1553.dspg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.750728457752444
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	payment confirmation.exe
File size:	90112
MD5:	930debccdeecb4fc138b0319bef33720
SHA1:	b56f93dc8316eb35a3b311ce1c412e5d617bcfeb
SHA256:	03082b2f67073c9017a28fe1ef9166d38edd339ef72da583653f083ec2b9fac4
SHA512:	bfd528e239d9dc5ed5c74b6443eb2f4eacf508e4254a7ece0f5d997f80103afea403510257c83a6820f4aa516ac87614887cb19f3b0082c5b0fd9c3ecab7daa7
SSDEEP:	1536:t+xDOj9YiJi9u4zT3rHf4AnDUHK1DxFAWfWt7vAjmt:t+xDO9YiJnELLFnDxF3MA8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L....).O.................0... ...............@....@........

File Icon


Icon Hash:	821ca88c8e8c8c00

Static PE Info

General
Entrypoint:	0x4012c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4FA929E5 [Tue May 8 14:12:53 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e73b8c032c82c64991ebe487a7ffcd43

Entrypoint Preview

Instruction
push 0040FF98h
call 00007F6508B26DF3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi+01h], al
inc esi
cmp dword ptr [ebx-5ABC39A1h], FFFFFFC6h
or eax, 71097B6Dh
clc
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
cmp eax, 6C614620h
jnc 00007F6508B26E56h
push 65646E75h
jc 00007F6508B26E64h
outsd
js 00007F6508B26E38h
add byte ptr [edx], cl
and byte ptr [0000000Ah], cl
add bh, bh
int3
xor dword ptr [eax], eax
cmp cl, dl
jo 00007F6508B26E14h
or al, D2h
xor al, E2h
inc ecx
lea ebp, dword ptr [ecx+4AEA7E0Ch]
setnb byte ptr [eax]
adc al, C4h
scasd
sbb eax, 8F43FF8Ch
das
mov byte ptr [752CBDB8h], al
sub edi, dword ptr [edx]
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, EAh
add byte ptr [eax], al
xchg eax, edi
add dword ptr [eax], eax
add byte ptr [eax], al
or byte ptr [eax], al
arpl word ptr [eax+65h], bp
insb
jns 00007F6508B26E66h
jc 00007F6508B26E67h
add byte ptr [55000B01h], cl
inc esp
pop ecx
inc edi
push esp
dec ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x136b4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x540	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12b1c	0x13000	False	0.519017269737	data	6.24212865941	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0xcf4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x540	0x1000	False	0.129150390625	data	1.40409416772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15418	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x15404	0x14	data
RT_VERSION	0x150f0	0x314	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	ChatSwipe
InternalName	damrred
FileVersion	4.04.0001
CompanyName	ChatSwipe
LegalTrademarks	ChatSwipe
Comments	ChatSwipe
ProductName	ChatSwipe
ProductVersion	4.04.0001
FileDescription	ChatSwipe
OriginalFilename	damrred.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 17:19:57.802509069 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:19:57.828666925 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:01.744852066 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:01.758511066 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:20.933399916 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:20.946444035 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:22.883145094 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:22.897078037 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:24.236115932 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:24.250313997 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:24.786951065 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:24.800359964 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:25.083745003 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:25.097210884 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:25.487617970 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:25.500909090 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:26.143419981 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:26.219031096 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:26.229260921 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:26.263164043 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:26.780441046 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:26.794018030 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:27.470508099 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:27.484445095 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:28.601474047 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:28.615058899 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:28.989866972 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:29.082186937 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:40.073616028 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:40.094414949 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:40.235743999 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:40.253118992 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:49.744210958 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:49.764194012 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:59.170593023 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:59.236433983 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 27, 2021 17:21:26.905345917 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:21:26.931402922 CEST	53	49694	8.8.8.8	192.168.2.6
Sep 27, 2021 17:21:27.161016941 CEST	54982	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:21:27.188034058 CEST	53	54982	8.8.8.8	192.168.2.6
Sep 27, 2021 17:22:02.833758116 CEST	50010	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:22:02.860853910 CEST	53	50010	8.8.8.8	192.168.2.6

Code Manipulations

Statistics

System Behavior

Analysis Process: payment confirmation.exe PID: 3316 Parent PID: 5404

General

Start time:	17:19:36
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\payment confirmation.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\payment confirmation.exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	930DEBCCDEECB4FC138B0319BEF33720
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report payment confirmation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

System Behavior

Analysis Process: payment confirmation.exe PID: 3316 Parent PID: 5404

General

Disassembly

Code Analysis