Windows Analysis Report DHL Express shipment notification.exe

ID:	532143
Product:	CloudBasic
Start time:	19:03:59
Start date:	01.12.2021
Sample:	DHL Express shipment notification.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	26e034a56f86ed41cb3e869095ec73b7
SHA1:	a74551ce377aadbaae0b31b54b2536daaa832754
SHA256:	60ab75a94e04aa5dfab1a68da060a817e9f5ccb79f8a93d0c3dbfe47cb526b7d
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Found malware configuration

Source: 00000000.00000002.778696939.00000000021D0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=downlo8"}

Multi AV Scanner detection for submitted file

Source: DHL Express shipment notification.exe	Virustotal: Detection: 25%			Perma Link
Source: DHL Express shipment notification.exe	ReversingLabs: Detection: 11%

Compliance:

Uses 32bit PE files

Source: DHL Express shipment notification.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=downlo8

URLs found in memory or binary data

Source: DHL Express shipment notification.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: DHL Express shipment notification.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: DHL Express shipment notification.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: DHL Express shipment notification.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: DHL Express shipment notification.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: DHL Express shipment notification.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: DHL Express shipment notification.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: DHL Express shipment notification.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: DHL Express shipment notification.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: DHL Express shipment notification.exe	String found in binary or memory: https://www.digicert.com/CPS0

System Summary:

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Uses 32bit PE files

Source: DHL Express shipment notification.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Sample file is different than original file name gathered from version info

Source: DHL Express shipment notification.exe, 00000000.00000002.778676915.00000000020D0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSlesk8.exeFE2XW vs DHL Express shipment notification.exe
Source: DHL Express shipment notification.exe, 00000000.00000002.777938364.0000000000424000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSlesk8.exe vs DHL Express shipment notification.exe
Source: DHL Express shipment notification.exe	Binary or memory string: OriginalFilenameSlesk8.exe vs DHL Express shipment notification.exe

PE file contains strange resources

Source: DHL Express shipment notification.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Detected potential crypto function

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021E6860		0_2_021E6860
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021DAA34		0_2_021DAA34
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021DDFFD		0_2_021DDFFD
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021E39E4		0_2_021E39E4

PE / OLE file has an invalid certificate

Source: DHL Express shipment notification.exe

Static PE information: invalid certificate

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: DHL Express shipment notification.exe	Virustotal: Detection: 25%
Source: DHL Express shipment notification.exe	ReversingLabs: Detection: 11%

PE file has an executable .text section and no other executable section

Source: DHL Express shipment notification.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Creates files inside the user directory

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

File created: C:\Users\user\AppData\Roaming\XvFu5flZcgudIlwvVLtjOx372

Jump to behavior

Classification label

Source: classification engine

Classification label: mal80.rans.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.778696939.00000000021D0000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_00406464 push edx; iretd		0_2_0040647C
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_0040A07F push ds; iretd		0_2_0040A095
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_004070A2 push 3E0AA415h; retf		0_2_004070B7
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_00403976 pushfd ; ret		0_2_0040398B
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021D26FB push eax; iretd		0_2_021D26FC
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021D4C6D push eax; iretd		0_2_021D4C6F

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

RDTSC instruction interceptor: First address: 00000000021E3495 second address: 00000000021E3495 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 36E14280h 0x00000007 xor eax, 7FA3071Ah 0x0000000c sub eax, F9689012h 0x00000011 sub eax, 4FD9B587h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F51E8F968F7h 0x0000001e lfence 0x00000021 mov edx, E407433Dh 0x00000026 add edx, 04D23EBAh 0x0000002c add edx, 3E86FD7Bh 0x00000032 xor edx, 589E7F66h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d jmp 00007F51E8F968DDh 0x00000042 test cl, al 0x00000044 cmp al, 3Fh 0x00000046 test ch, ah 0x00000048 ret 0x00000049 jmp 00007F51E8F968E9h 0x0000004e test ebx, 2244023Eh 0x00000054 sub edx, esi 0x00000056 ret 0x00000057 add edi, edx 0x00000059 dec dword ptr [ebp+000000F8h] 0x0000005f test ecx, ebx 0x00000061 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000068 jne 00007F51E8F967FAh 0x0000006a call 00007F51E8F96861h 0x0000006f call 00007F51E8F96918h 0x00000074 lfence 0x00000077 mov edx, E407433Dh 0x0000007c add edx, 04D23EBAh 0x00000082 add edx, 3E86FD7Bh 0x00000088 xor edx, 589E7F66h 0x0000008e mov edx, dword ptr [edx] 0x00000090 lfence 0x00000093 jmp 00007F51E8F968DDh 0x00000098 test cl, al 0x0000009a cmp al, 3Fh 0x0000009c test ch, ah 0x0000009e ret 0x0000009f mov esi, edx 0x000000a1 pushad 0x000000a2 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

Code function: 0_2_021E3692 rdtsc

0_2_021E3692

Anti Debugging:

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021E1E86 mov eax, dword ptr fs:[00000030h]		0_2_021E1E86
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021E2A85 mov eax, dword ptr fs:[00000030h]		0_2_021E2A85
Source: C:\Users\user\Desktop\DHL Express shipment notification.exe	Code function: 0_2_021DCF89 mov eax, dword ptr fs:[00000030h]		0_2_021DCF89

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

Code function: 0_2_021E3692 rdtsc

0_2_021E3692

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\DHL Express shipment notification.exe

Code function: 0_2_021E6860 RtlAddVectoredExceptionHandler,

0_2_021E6860

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: DHL Express shipment notification.exe, 00000000.00000002.778410130.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: DHL Express shipment notification.exe, 00000000.00000002.778410130.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: DHL Express shipment notification.exe, 00000000.00000002.778410130.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: DHL Express shipment notification.exe, 00000000.00000002.778410130.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: DHL Express shipment notification.exe, 00000000.00000002.778410130.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock