Windows Analysis Report GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

ID:	491600
Product:	CloudBasic
Start time:	18:31:27
Start date:	27.09.2021
Sample:	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	991bee5a9edd18a183c900b7edeccefe
SHA1:	18189c5a9d3ab005df5426494e2016a5d64b8c72
SHA256:	e3c94531505c4a4d5bb35bb62e773676f7e9ab522111d930f02c3144c971414d
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Found malware configuration

Source: 00000001.00000002.505045374.0000000002A30000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1ycJKs"}

Multi AV Scanner detection for submitted file

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Virustotal: Detection: 27%			Perma Link
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	ReversingLabs: Detection: 11%

Compliance:

Uses 32bit PE files

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1ycJKs

System Summary:

Uses 32bit PE files

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Sample file is different than original file name gathered from version info

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe, 00000001.00000000.237743772.0000000000417000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameKios2.exe vs GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Binary or memory string: OriginalFilenameKios2.exe vs GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

PE file contains strange resources

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Detected potential crypto function

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A37233		1_2_02A37233
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A37403		1_2_02A37403

Sample is known by Antivirus

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Virustotal: Detection: 27%
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	ReversingLabs: Detection: 11%

Creates temporary files

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

File created: C:\Users\user\AppData\Local\Temp\~DF2528AA0FB36E21C6.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Classification label

Source: classification engine

Classification label: mal68.troj.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.505045374.0000000002A30000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_004055C5 push eax; retf		1_2_004055C6
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_00402ACE push ecx; ret		1_2_00402AD4
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_004066FC push ebx; ret		1_2_00406705
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A320A4 push esp; iretd		1_2_02A320A8
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A36288 push cs; iretd		1_2_02A36311
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A350E2 push ebp; retf		1_2_02A350E3
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A33EF3 push ss; ret		1_2_02A33F02
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A344FF push cs; retf		1_2_02A345D8
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A36215 push 89000002h; iretd		1_2_02A3621A
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A32219 push ss; iretd		1_2_02A3225B
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A3626F push cs; iretd		1_2_02A36311
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A3225C push ss; iretd		1_2_02A3225B
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A321A7 push ss; iretd		1_2_02A3225B
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A363BB push ss; ret		1_2_02A3640F
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A363E9 push ss; ret		1_2_02A3640F
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A36312 push cs; iretd		1_2_02A36311
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A32565 push ds; ret		1_2_02A32566
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A34576 push cs; retf		1_2_02A345D8

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Code function: 1_2_02A39850 rdtsc

1_2_02A39850

Anti Debugging:

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A3CC88 mov eax, dword ptr fs:[00000030h]		1_2_02A3CC88
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A395F7 mov eax, dword ptr fs:[00000030h]		1_2_02A395F7
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Code function: 1_2_02A3D33B mov eax, dword ptr fs:[00000030h]		1_2_02A3D33B

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe

Code function: 1_2_02A39850 rdtsc

1_2_02A39850

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe, 00000001.00000002.504865617.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe, 00000001.00000002.504865617.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe, 00000001.00000002.504865617.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe, 00000001.00000002.504865617.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe, 00000001.00000002.504865617.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock