Windows Analysis Report Zr26f1rL6r.danger

ID:	528518
Product:	CloudBasic
Start time:	12:43:41
Start date:	25.11.2021
Sample:	Zr26f1rL6r.danger
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	812181df251e06433bf2f4f6a0c0f0f4
SHA1:	aa38a567ee48483d98966622fd320c791bc45871
SHA256:	4d6c910a379d00f329e55ad98a7817de0370695566443a74a9a02c85d2463a9d
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\~DFD789DA64D34966AA.TMP	Composite Document File V2 Document, Cannot read section info	E9F7C24086FE230572BB84C262385677	16B4D54B227860CD7942CB26F607C2464F69B416	1F1B9BB21DBBE012A4824C25111BAB849BE0E7BCED9234527701823A68C65374

AV Detection:

Found malware configuration

Source: 00000001.00000002.804770184.0000000002A60000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://atseasonals.com/GHrtt/bin_k"}

Multi AV Scanner detection for submitted file

Source: Zr26f1rL6r.exe	Virustotal: Detection: 40%			Perma Link
Source: Zr26f1rL6r.exe	ReversingLabs: Detection: 20%

Compliance:

Uses 32bit PE files

Source: Zr26f1rL6r.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://atseasonals.com/GHrtt/bin_k

URLs found in memory or binary data

Source: Zr26f1rL6r.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Zr26f1rL6r.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Zr26f1rL6r.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Zr26f1rL6r.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Zr26f1rL6r.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Zr26f1rL6r.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Zr26f1rL6r.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Zr26f1rL6r.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: Zr26f1rL6r.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Zr26f1rL6r.exe	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: Zr26f1rL6r.exe, 00000001.00000002.804004031.000000000071A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Uses 32bit PE files

Source: Zr26f1rL6r.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Sample file is different than original file name gathered from version info

Source: Zr26f1rL6r.exe, 00000001.00000000.279454201.0000000000422000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUNDERWR.exe vs Zr26f1rL6r.exe
Source: Zr26f1rL6r.exe	Binary or memory string: OriginalFilenameUNDERWR.exe vs Zr26f1rL6r.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_00401772		1_2_00401772
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_00401725		1_2_00401725
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_00401536		1_2_00401536
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6523E		1_2_02A6523E
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A65814		1_2_02A65814
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6FFED		1_2_02A6FFED

PE / OLE file has an invalid certificate

Source: Zr26f1rL6r.exe

Static PE information: invalid certificate

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: Zr26f1rL6r.exe	Virustotal: Detection: 40%
Source: Zr26f1rL6r.exe	ReversingLabs: Detection: 20%

PE file has an executable .text section and no other executable section

Source: Zr26f1rL6r.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

File created: C:\Users\user\AppData\Local\Temp\~DFD789DA64D34966AA.TMP

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/1@0/0

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.804770184.0000000002A60000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_004093B3 push ebx; ret		1_2_004093B4
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A62286 push esi; retf		1_2_02A62228
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A638B3 push 4674B5B4h; retf		1_2_02A63876
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6388E push 4674B5B4h; retf		1_2_02A63876
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A660C4 pushfd ; iretd		1_2_02A660C7
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A638CA push 4674B5B4h; retf		1_2_02A63876
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A658DF pushfd ; retf		1_2_02A658DE
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A63800 push 4674B5B4h; retf		1_2_02A63876
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A65814 pushfd ; retf		1_2_02A658DE
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A65814 push ebx; retf		1_2_02A65A54
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A60047 push ds; ret		1_2_02A60051
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A60047 push ds; ret		1_2_02A600B3
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A63841 push 4674B5B4h; retf		1_2_02A63876
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A659A2 push ebx; retf		1_2_02A65A54
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A659AE push ebx; retf		1_2_02A65A54
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6598A push ebx; retf		1_2_02A65A54
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A65996 push ebx; retf		1_2_02A65A54
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6590E pushfd ; retf		1_2_02A658DE
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6010F push ds; ret		1_2_02A600B3
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A61918 push esi; ret		1_2_02A6192F
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A65919 push ebx; retf		1_2_02A65A54
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6597F push ebx; retf		1_2_02A65A54
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A62954 pushad ; ret		1_2_02A62955
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A64DAC push ecx; ret		1_2_02A64DAD

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

RDTSC instruction interceptor: First address: 0000000002A70462 second address: 0000000002A70462 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 6DE2EF76h 0x00000007 xor eax, 3DB09C71h 0x0000000c sub eax, 5442A7C9h 0x00000011 xor eax, FC0FCB3Fh 0x00000016 cpuid 0x00000018 jmp 00007FA49CC56E26h 0x0000001a cmp cx, bx 0x0000001d popad 0x0000001e cmp esi, 4B3AFD05h 0x00000024 call 00007FA49CC56DECh 0x00000029 lfence 0x0000002c mov edx, 710EE3C3h 0x00000031 xor edx, C84DA636h 0x00000037 xor edx, 5FA736A0h 0x0000003d xor edx, 991A7341h 0x00000043 mov edx, dword ptr [edx] 0x00000045 lfence 0x00000048 jmp 00007FA49CC56E1Ah 0x0000004a cmp ecx, C21290E3h 0x00000050 cmp cx, B483h 0x00000055 ret 0x00000056 sub edx, esi 0x00000058 ret 0x00000059 cmp cl, dl 0x0000005b jmp 00007FA49CC56E26h 0x0000005d cmp cx, bx 0x00000060 cmp esi, 7ED3C2E3h 0x00000066 add edi, edx 0x00000068 dec dword ptr [ebp+000000F8h] 0x0000006e cmp dword ptr [ebp+000000F8h], 00000000h 0x00000075 jne 00007FA49CC56D73h 0x00000077 cmp edx, ecx 0x00000079 cmp ebx, 1CFC15CDh 0x0000007f call 00007FA49CC56E8Bh 0x00000084 call 00007FA49CC56E5Ch 0x00000089 lfence 0x0000008c mov edx, 710EE3C3h 0x00000091 xor edx, C84DA636h 0x00000097 xor edx, 5FA736A0h 0x0000009d xor edx, 991A7341h 0x000000a3 mov edx, dword ptr [edx] 0x000000a5 lfence 0x000000a8 jmp 00007FA49CC56E1Ah 0x000000aa cmp ecx, C21290E3h 0x000000b0 cmp cx, B483h 0x000000b5 ret 0x000000b6 mov esi, edx 0x000000b8 pushad 0x000000b9 rdtsc

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

Code function: 1_2_02A7045A rdtsc

1_2_02A7045A

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

Process Stats: CPU usage > 90% for more than 60s

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6F3CA mov eax, dword ptr fs:[00000030h]		1_2_02A6F3CA
Source: C:\Users\user\Desktop\Zr26f1rL6r.exe	Code function: 1_2_02A6FCC1 mov eax, dword ptr fs:[00000030h]		1_2_02A6FCC1

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\Zr26f1rL6r.exe

Code function: 1_2_02A7045A rdtsc

1_2_02A7045A

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: Zr26f1rL6r.exe, 00000001.00000002.804242856.0000000000CA0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Zr26f1rL6r.exe, 00000001.00000002.804242856.0000000000CA0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Zr26f1rL6r.exe, 00000001.00000002.804242856.0000000000CA0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Zr26f1rL6r.exe, 00000001.00000002.804242856.0000000000CA0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock