Windows Analysis Report pago12_14299038859.exe

ID:	539535
Product:	CloudBasic
Start time:	13:59:26
Start date:	14.12.2021
Sample:	pago12_14299038859.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	9a1518ed709f916360e56b5ac7d76995
SHA1:	7c85312d66edf5b02ebd6c25cfe9c036a3471263
SHA256:	2a0878c196278384aab473c92977d236680c788b4e5ae0cc1f415a075a6fa9e2
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\~DF56158A8C389C0AF7.TMP	Composite Document File V2 Document, Cannot read section info	E8C98D07896778A7A68D9895386FC8A0	734F506C412CAFA5BF6680E7C1EBBE939CE63773	DCEDB0D3B75126360C0556DC3310ACBBB97ADAD114F518DF8C65E84C0E6BED51

AV Detection:

Found malware configuration

Source: 00000000.00000002.1196997646.0000000004D20000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1rvzmbX5uh5o/"}

Multi AV Scanner detection for submitted file

Source: pago12_14299038859.exe

ReversingLabs: Detection: 15%

Machine Learning detection for sample

Source: pago12_14299038859.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: pago12_14299038859.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1rvzmbX5uh5o/

System Summary:

Uses 32bit PE files

Source: pago12_14299038859.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Sample file is different than original file name gathered from version info

Source: pago12_14299038859.exe, 00000000.00000002.1196818293.0000000002930000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFort.exeFE2X vs pago12_14299038859.exe
Source: pago12_14299038859.exe, 00000000.00000000.669780195.000000000042B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFort.exe vs pago12_14299038859.exe
Source: pago12_14299038859.exe	Binary or memory string: OriginalFilenameFort.exe vs pago12_14299038859.exe

PE file contains strange resources

Source: pago12_14299038859.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Detected potential crypto function

Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2841D		0_2_04D2841D
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2D38F		0_2_04D2D38F
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D204CA		0_2_04D204CA
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28498		0_2_04D28498
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2749D		0_2_04D2749D
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C4BD		0_2_04D2C4BD
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C45D		0_2_04D2C45D
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28441		0_2_04D28441
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D205C3		0_2_04D205C3
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D265C9		0_2_04D265C9
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26589		0_2_04D26589
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D20549		0_2_04D20549
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2057D		0_2_04D2057D
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D20517		0_2_04D20517
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C509		0_2_04D2C509
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D236F8		0_2_04D236F8
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C66C		0_2_04D2C66C
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2663D		0_2_04D2663D
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26759		0_2_04D26759
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C70E		0_2_04D2C70E
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D260CA		0_2_04D260CA
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D260F6		0_2_04D260F6
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D29085		0_2_04D29085
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C052		0_2_04D2C052
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2706B		0_2_04D2706B
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26005		0_2_04D26005
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28180		0_2_04D28180
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C2E9		0_2_04D2C2E9
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28255		0_2_04D28255
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C259		0_2_04D2C259
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26214		0_2_04D26214
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C226		0_2_04D2C226
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C3D1		0_2_04D2C3D1
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D263ED		0_2_04D263ED
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2838C		0_2_04D2838C
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C37D		0_2_04D2C37D
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2632E		0_2_04D2632E
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26C93		0_2_04D26C93
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D27C39		0_2_04D27C39
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26DC9		0_2_04D26DC9
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26EE9		0_2_04D26EE9
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D25F92		0_2_04D25F92
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26F8D		0_2_04D26F8D
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D268D1		0_2_04D268D1
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D269B1		0_2_04D269B1
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D259A7		0_2_04D259A7
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D289A8		0_2_04D289A8
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26951		0_2_04D26951
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2595B		0_2_04D2595B
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28A90		0_2_04D28A90
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26A75		0_2_04D26A75
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28A15		0_2_04D28A15
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28BD1		0_2_04D28BD1
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D25BF0		0_2_04D25BF0
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D25BB1		0_2_04D25BB1
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28B59		0_2_04D28B59
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D26B4E		0_2_04D26B4E

Contains functionality to call native functions

Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2841D NtAllocateVirtualMemory,		0_2_04D2841D
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D284D9 NtAllocateVirtualMemory,		0_2_04D284D9
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28498 NtAllocateVirtualMemory,		0_2_04D28498
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28441 NtAllocateVirtualMemory,		0_2_04D28441
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28551 NtAllocateVirtualMemory,		0_2_04D28551
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28663 NtAllocateVirtualMemory,		0_2_04D28663
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28621 NtAllocateVirtualMemory,		0_2_04D28621
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D28255 NtAllocateVirtualMemory,		0_2_04D28255
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2838C NtAllocateVirtualMemory,		0_2_04D2838C

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\pago12_14299038859.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: pago12_14299038859.exe

ReversingLabs: Detection: 15%

PE file has an executable .text section and no other executable section

Source: pago12_14299038859.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\pago12_14299038859.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\pago12_14299038859.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\pago12_14299038859.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\pago12_14299038859.exe

File created: C:\Users\user\AppData\Local\Temp\~DF56158A8C389C0AF7.TMP

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/1@0/0

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1196997646.0000000004D20000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_00406471 push edi; iretd		0_2_00406472
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_00409011 push esp; retf		0_2_00409013
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_0040682F push esi; retf		0_2_00406830
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_0040A490 push ds; iretd		0_2_0040A491
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_004079F6 push eax; retf		0_2_00407A10
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_004055BF push ds; ret		0_2_004055D9
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_00405ECC push ebp; ret		0_2_00405ED8
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_00407F27 push edi; ret		0_2_00407F28
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_00407FBA push eax; iretd		0_2_00407FBB
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2747D pushfd ; iretd		0_2_04D29C58
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D27404 pushfd ; iretd		0_2_04D29C58
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D200CA push 5D54C3DCh; ret		0_2_04D20116
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D29157 push E8BBB633h; retf 001Bh		0_2_04D2915F
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D24344 push 8122E3ECh; ret		0_2_04D24349
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D27371 pushfd ; iretd		0_2_04D29C58
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D27368 pushfd ; iretd		0_2_04D29C58
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D21F01 push esi; ret		0_2_04D21F02
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D29B93 pushfd ; iretd		0_2_04D29C58

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.15645216813

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\pago12_14299038859.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\pago12_14299038859.exe

RDTSC instruction interceptor: First address: 0000000004D27C16 second address: 0000000004D27C16 instructions: 0x00000000 rdtsc 0x00000002 mov eax, B4901491h 0x00000007 sub eax, 05E3F0C7h 0x0000000c xor eax, 8F9A272Fh 0x00000011 sub eax, 213604E4h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F6BBC38AE6Dh 0x0000001e lfence 0x00000021 mov edx, 238EE826h 0x00000026 sub edx, 0388C43Eh 0x0000002c xor edx, E448541Bh 0x00000032 xor edx, BBB077E7h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 add edi, edx 0x00000044 dec ecx 0x00000045 mov dword ptr [ebp+00000229h], AD8B339Ah 0x0000004f xor dword ptr [ebp+00000229h], 22419229h 0x00000059 xor dword ptr [ebp+00000229h], 3996C157h 0x00000063 sub dword ptr [ebp+00000229h], B65C60E4h 0x0000006d cmp ecx, dword ptr [ebp+00000229h] 0x00000073 jne 00007F6BBC38AD87h 0x00000075 cmp cx, ax 0x00000078 mov dword ptr [ebp+0000020Bh], ebx 0x0000007e mov ebx, ecx 0x00000080 push ebx 0x00000081 mov ebx, dword ptr [ebp+0000020Bh] 0x00000087 jmp 00007F6BBC38AE2Eh 0x00000089 cmp dl, bl 0x0000008b call 00007F6BBC38AE71h 0x00000090 call 00007F6BBC38AE8Eh 0x00000095 lfence 0x00000098 mov edx, 238EE826h 0x0000009d sub edx, 0388C43Eh 0x000000a3 xor edx, E448541Bh 0x000000a9 xor edx, BBB077E7h 0x000000af mov edx, dword ptr [edx] 0x000000b1 lfence 0x000000b4 ret 0x000000b5 mov esi, edx 0x000000b7 pushad 0x000000b8 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\pago12_14299038859.exe

Code function: 0_2_04D27C0E rdtsc

0_2_04D27C0E

Anti Debugging:

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2B2F5 mov eax, dword ptr fs:[00000030h]		0_2_04D2B2F5
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C259 mov eax, dword ptr fs:[00000030h]		0_2_04D2C259
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2C226 mov eax, dword ptr fs:[00000030h]		0_2_04D2C226
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D2ACF0 mov eax, dword ptr fs:[00000030h]		0_2_04D2ACF0
Source: C:\Users\user\Desktop\pago12_14299038859.exe	Code function: 0_2_04D27A41 mov eax, dword ptr fs:[00000030h]		0_2_04D27A41

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\pago12_14299038859.exe

Code function: 0_2_04D27C0E rdtsc

0_2_04D27C0E

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\pago12_14299038859.exe

Code function: 0_2_04D2D38F RtlAddVectoredExceptionHandler,

0_2_04D2D38F

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: pago12_14299038859.exe, 00000000.00000002.1196704342.0000000000C40000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: pago12_14299038859.exe, 00000000.00000002.1196704342.0000000000C40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: pago12_14299038859.exe, 00000000.00000002.1196704342.0000000000C40000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: pago12_14299038859.exe, 00000000.00000002.1196704342.0000000000C40000.00000002.00020000.sdmp	Binary or memory string: Progmanlock