Windows Analysis Report SWIFT_ACK-89813.02.exe

ID:	539387
Product:	CloudBasic
Start time:	08:26:42
Start date:	14.12.2021
Sample:	SWIFT_ACK-89813.02.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	2f19182da895afc914c7b9851a4f2d49
SHA1:	7d111bd6284cdd87498e72d90a595aea9fc35d5d
SHA256:	24d5129d6ecbe5ba5e88077d1207bc09fc68d076dea00892bc614a267f9f0b1b
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\~DFA1C4850DA9C6EF9A.TMP	Composite Document File V2 Document, Cannot read section info	52AA63688AAC03A75A4231F6519EBA14	7BAA47908391E462A575DF51EBCE7F3EFF076B17	FB8C5BC990C88E0716500458D7685B934A75580DDB42DDC9D616FF0E2A2E6ADC

AV Detection:

Found malware configuration

Source: 00000000.00000002.824783872.00000000023F0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?expor"}

Compliance:

Uses 32bit PE files

Source: SWIFT_ACK-89813.02.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?expor

System Summary:

Uses 32bit PE files

Source: SWIFT_ACK-89813.02.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Contains functionality to call native functions

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

Code function: 0_2_023F83D2 NtAllocateVirtualMemory,

0_2_023F83D2

Sample file is different than original file name gathered from version info

Source: SWIFT_ACK-89813.02.exe, 00000000.00000000.293724818.000000000042B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameerst.exe vs SWIFT_ACK-89813.02.exe
Source: SWIFT_ACK-89813.02.exe, 00000000.00000002.824752496.00000000022E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameerst.exeFE2X vs SWIFT_ACK-89813.02.exe
Source: SWIFT_ACK-89813.02.exe	Binary or memory string: OriginalFilenameerst.exe vs SWIFT_ACK-89813.02.exe

PE file contains strange resources

Source: SWIFT_ACK-89813.02.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

Process Stats: CPU usage > 98%

Detected potential crypto function

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F83D2		0_2_023F83D2
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023FD477		0_2_023FD477
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F023A		0_2_023F023A
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F7AB2		0_2_023F7AB2
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F730C		0_2_023F730C
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F575A		0_2_023F575A
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023FBF90		0_2_023FBF90
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023FBB83		0_2_023FBB83
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F5D96		0_2_023F5D96
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F5989		0_2_023F5989

Creates temporary files

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

File created: C:\Users\user\AppData\Local\Temp\~DFA1C4850DA9C6EF9A.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: SWIFT_ACK-89813.02.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Classification label

Source: classification engine

Classification label: mal60.troj.winEXE@1/1@0/0

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.824783872.00000000023F0000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_00406901 push ds; ret		0_2_00406902
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_00409518 push ebx; iretd		0_2_00409519
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_00407D81 push edx; ret		0_2_00407D8D
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_00407999 push ebx; iretd		0_2_0040799D
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_00406DAE push ebp; ret		0_2_00406DB5
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_004055BC push ds; ret		0_2_004055D6
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_0040A644 push cs; iretd		0_2_0040A650
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_00405EC9 push cs; ret		0_2_00405F04
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_0040828C push eax; iretd		0_2_004082D1
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_00406FE2 push ebx; iretd		0_2_00407075
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F1E08 push ss; retf		0_2_023F1E0E
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F3394 pushad ; retn 0004h		0_2_023F33CF

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.1391806469

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

Code function: 0_2_023F7F96 rdtsc

0_2_023F7F96

Anti Debugging:

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023FB23E mov eax, dword ptr fs:[00000030h]		0_2_023FB23E
Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe	Code function: 0_2_023F797D mov eax, dword ptr fs:[00000030h]		0_2_023F797D

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

Code function: 0_2_023F7F96 rdtsc

0_2_023F7F96

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\SWIFT_ACK-89813.02.exe

Code function: 0_2_023FD477 RtlAddVectoredExceptionHandler,

0_2_023FD477

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: SWIFT_ACK-89813.02.exe, 00000000.00000002.824477565.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: SWIFT_ACK-89813.02.exe, 00000000.00000002.824477565.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: SWIFT_ACK-89813.02.exe, 00000000.00000002.824477565.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: SWIFT_ACK-89813.02.exe, 00000000.00000002.824477565.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Progmanlock