Play interactive tour

Edit tour

Windows Analysis Report FACTURAS.exe

Overview

General Information

Sample Name:	FACTURAS.exe
Analysis ID:	539419
MD5:	2332fdde9344114749db5496eef5f5f9
SHA1:	303c40dd112294dc012836be48eb38e8af056432
SHA256:	0e693b9dcb4ccb3e64cb61396447dd4e3871234b4af80c2d57e4fbc9b6268a61
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Contains functionality to call native functions

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Detected potential crypto function

Classification

Process Tree

System is w10x64

FACTURAS.exe (PID: 6492 cmdline: "C:\Users\user\Desktop\FACTURAS.exe" MD5: 2332FDDE9344114749DB5496EEF5F5F9)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=downlD'"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.862055491.0000000003060000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.862055491.0000000003060000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=downlD'"}

Multi AV Scanner detection for submitted file

Show sources

Source: FACTURAS.exe	Virustotal: Detection: 40%	Perma Link
Source: FACTURAS.exe	Metadefender: Detection: 38%	Perma Link
Source: FACTURAS.exe	ReversingLabs: Detection: 57%

Source: FACTURAS.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=downlD'

Source: FACTURAS.exe, 00000000.00000002.860970740.00000000005CA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: FACTURAS.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306D940 NtAllocateVirtualMemory,	0_2_0306D940
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306DB0E NtAllocateVirtualMemory,	0_2_0306DB0E
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306DB52 NtAllocateVirtualMemory,	0_2_0306DB52
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306DE06 NtAllocateVirtualMemory,	0_2_0306DE06
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306DC8C NtAllocateVirtualMemory,	0_2_0306DC8C

Source: FACTURAS.exe, 00000000.00000002.860928984.0000000000424000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSERVICEKONTRAKTS.exe vs FACTURAS.exe
Source: FACTURAS.exe, 00000000.00000002.861579074.0000000002A60000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSERVICEKONTRAKTS.exeFE2XMURALL vs FACTURAS.exe
Source: FACTURAS.exe	Binary or memory string: OriginalFilenameSERVICEKONTRAKTS.exe vs FACTURAS.exe

Source: C:\Users\user\Desktop\FACTURAS.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03076B17	0_2_03076B17
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306D940	0_2_0306D940
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306E3A7	0_2_0306E3A7
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A3A0	0_2_0306A3A0
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306E3C2	0_2_0306E3C2
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A28E	0_2_0306A28E
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_030692AF	0_2_030692AF
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_030692DA	0_2_030692DA
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A122	0_2_0306A122
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306B1FE	0_2_0306B1FE
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306B034	0_2_0306B034
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A0B4	0_2_0306A0B4
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A0D5	0_2_0306A0D5
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A730	0_2_0306A730
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306E75A	0_2_0306E75A
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306C76B	0_2_0306C76B
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_030697F8	0_2_030697F8
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306E65C	0_2_0306E65C
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A6C9	0_2_0306A6C9
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306D566	0_2_0306D566
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306957A	0_2_0306957A
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03074430	0_2_03074430
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03069444	0_2_03069444
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A4C0	0_2_0306A4C0
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306E4F6	0_2_0306E4F6
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306DB0E	0_2_0306DB0E
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03074BBF	0_2_03074BBF
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03073BCC	0_2_03073BCC
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03069A80	0_2_03069A80
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03073ABC	0_2_03073ABC
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306AAFA	0_2_0306AAFA
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03069932	0_2_03069932
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306993C	0_2_0306993C
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03073994	0_2_03073994
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306A9DE	0_2_0306A9DE
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0307382F	0_2_0307382F
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03073860	0_2_03073860
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306E8B4	0_2_0306E8B4
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306EF04	0_2_0306EF04
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03074F2E	0_2_03074F2E
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03069FA8	0_2_03069FA8
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03069E60	0_2_03069E60
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306AE9A	0_2_0306AE9A
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306EEB4	0_2_0306EEB4
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03073D0C	0_2_03073D0C
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306CD2E	0_2_0306CD2E
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306AD74	0_2_0306AD74
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03069DDE	0_2_03069DDE
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306AC38	0_2_0306AC38
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03069CDB	0_2_03069CDB

Source: FACTURAS.exe	Virustotal: Detection: 40%
Source: FACTURAS.exe	Metadefender: Detection: 38%
Source: FACTURAS.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\FACTURAS.exe

File created: C:\Users\user\AppData\Local\Temp\~DF6CBEB2FF77188695.TMP

Jump to behavior

Source: FACTURAS.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FACTURAS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\FACTURAS.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal68.troj.winEXE@1/2@0/0

Source: C:\Users\user\Desktop\FACTURAS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\FACTURAS.exe

File created: C:\Users\user\AppData\Roaming\Bh2BSU9xxO49MYboEPptixGKslvKjoQApxmsXHE151

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.862055491.0000000003060000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_004098C0 push 2DBAC715h; retf	0_2_004098C5
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_004098CB push ss; retf	0_2_004098CD
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0040508B pushad ; ret	0_2_0040509D
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0040755C push cs; retf	0_2_0040755D
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_00407179 push esp; iretd	0_2_00407181
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_00407584 push cs; retf	0_2_0040755D
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_004085B8 push edx; retf	0_2_004085B9
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_00406245 push ecx; retf	0_2_00406249
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_004072E6 push ebp; iretd	0_2_004072E9
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_004042FC push edx; retf	0_2_004042FD
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0040972A push eax; iretd	0_2_00409745
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_004083D6 pushfd ; iretd	0_2_00408422
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03066512 push ecx; retf	0_2_03066516
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03064E82 push esi; iretd	0_2_03064E99

Source: C:\Users\user\Desktop\FACTURAS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FACTURAS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FACTURAS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FACTURAS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FACTURAS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\FACTURAS.exe

Code function: 0_2_0306D11F rdtsc

0_2_0306D11F

Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0307339D mov eax, dword ptr fs:[00000030h]	0_2_0307339D
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_0306C76B mov eax, dword ptr fs:[00000030h]	0_2_0306C76B
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03072A70 mov eax, dword ptr fs:[00000030h]	0_2_03072A70
Source: C:\Users\user\Desktop\FACTURAS.exe	Code function: 0_2_03074F2E mov eax, dword ptr fs:[00000030h]	0_2_03074F2E

Source: C:\Users\user\Desktop\FACTURAS.exe

Code function: 0_2_0306D11F rdtsc

0_2_0306D11F

Source: C:\Users\user\Desktop\FACTURAS.exe

Code function: 0_2_03076B17 RtlAddVectoredExceptionHandler,

0_2_03076B17

Source: FACTURAS.exe, 00000000.00000002.861049488.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: FACTURAS.exe, 00000000.00000002.861049488.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: FACTURAS.exe, 00000000.00000002.861049488.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: FACTURAS.exe, 00000000.00000002.861049488.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	Input Capture1	Security Software Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	System Information Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report FACTURAS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails