Windows Analysis Report G47wmLn8uy

ID:	539603
Product:	CloudBasic
Start time:	15:54:22
Start date:	14.12.2021
Sample:	G47wmLn8uy
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	9a1518ed709f916360e56b5ac7d76995
SHA1:	7c85312d66edf5b02ebd6c25cfe9c036a3471263
SHA256:	2a0878c196278384aab473c92977d236680c788b4e5ae0cc1f415a075a6fa9e2
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\~DFAFA5F207726209AF.TMP	Composite Document File V2 Document, Cannot read section info	E8C98D07896778A7A68D9895386FC8A0	734F506C412CAFA5BF6680E7C1EBBE939CE63773	DCEDB0D3B75126360C0556DC3310ACBBB97ADAD114F518DF8C65E84C0E6BED51

AV Detection:

Found malware configuration

Source: 00000000.00000002.1190265703.0000000004D10000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1rvzmbX5uh5o/"}

Multi AV Scanner detection for submitted file

Source: G47wmLn8uy.exe	Virustotal: Detection: 26%			Perma Link
Source: G47wmLn8uy.exe	ReversingLabs: Detection: 15%

Machine Learning detection for sample

Source: G47wmLn8uy.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: G47wmLn8uy.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1rvzmbX5uh5o/

System Summary:

Uses 32bit PE files

Source: G47wmLn8uy.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Sample file is different than original file name gathered from version info

Source: G47wmLn8uy.exe, 00000000.00000000.667550110.000000000042B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFort.exe vs G47wmLn8uy.exe
Source: G47wmLn8uy.exe, 00000000.00000002.1190054948.00000000020C0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFort.exeFE2X vs G47wmLn8uy.exe
Source: G47wmLn8uy.exe	Binary or memory string: OriginalFilenameFort.exe vs G47wmLn8uy.exe

PE file contains strange resources

Source: G47wmLn8uy.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Detected potential crypto function

Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1841D		0_2_04D1841D
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1D38F		0_2_04D1D38F
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D104CA		0_2_04D104CA
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18498		0_2_04D18498
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1749D		0_2_04D1749D
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C4BD		0_2_04D1C4BD
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C45D		0_2_04D1C45D
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18441		0_2_04D18441
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D105C3		0_2_04D105C3
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D165C9		0_2_04D165C9
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16589		0_2_04D16589
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D10549		0_2_04D10549
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1057D		0_2_04D1057D
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D10517		0_2_04D10517
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C509		0_2_04D1C509
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D136F8		0_2_04D136F8
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C66C		0_2_04D1C66C
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1663D		0_2_04D1663D
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16759		0_2_04D16759
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C70E		0_2_04D1C70E
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D160CA		0_2_04D160CA
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D160F6		0_2_04D160F6
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D19085		0_2_04D19085
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C052		0_2_04D1C052
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1706B		0_2_04D1706B
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16005		0_2_04D16005
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18180		0_2_04D18180
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C2E9		0_2_04D1C2E9
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18255		0_2_04D18255
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C259		0_2_04D1C259
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16214		0_2_04D16214
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C226		0_2_04D1C226
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C3D1		0_2_04D1C3D1
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D163ED		0_2_04D163ED
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1838C		0_2_04D1838C
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C37D		0_2_04D1C37D
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1632E		0_2_04D1632E
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16C93		0_2_04D16C93
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D17C39		0_2_04D17C39
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16DC9		0_2_04D16DC9
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16EE9		0_2_04D16EE9
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D15F92		0_2_04D15F92
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16F8D		0_2_04D16F8D
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D168D1		0_2_04D168D1
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D169B1		0_2_04D169B1
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D159A7		0_2_04D159A7
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D189A8		0_2_04D189A8
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16951		0_2_04D16951
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1595B		0_2_04D1595B
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18A90		0_2_04D18A90
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16A75		0_2_04D16A75
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18A15		0_2_04D18A15
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18BD1		0_2_04D18BD1
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D15BF0		0_2_04D15BF0
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D15BB1		0_2_04D15BB1
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18B59		0_2_04D18B59
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D16B4E		0_2_04D16B4E

Contains functionality to call native functions

Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1841D NtAllocateVirtualMemory,		0_2_04D1841D
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D184D9 NtAllocateVirtualMemory,		0_2_04D184D9
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18498 NtAllocateVirtualMemory,		0_2_04D18498
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18441 NtAllocateVirtualMemory,		0_2_04D18441
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18551 NtAllocateVirtualMemory,		0_2_04D18551
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18663 NtAllocateVirtualMemory,		0_2_04D18663
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18621 NtAllocateVirtualMemory,		0_2_04D18621
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D18255 NtAllocateVirtualMemory,		0_2_04D18255
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1838C NtAllocateVirtualMemory,		0_2_04D1838C

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: G47wmLn8uy.exe	Virustotal: Detection: 26%
Source: G47wmLn8uy.exe	ReversingLabs: Detection: 15%

PE file has an executable .text section and no other executable section

Source: G47wmLn8uy.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

File created: C:\Users\user\AppData\Local\Temp\~DFAFA5F207726209AF.TMP

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/1@0/0

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1190265703.0000000004D10000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_00406471 push edi; iretd		0_2_00406472
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_00409011 push esp; retf		0_2_00409013
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_0040682F push esi; retf		0_2_00406830
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_0040A490 push ds; iretd		0_2_0040A491
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_004079F6 push eax; retf		0_2_00407A10
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_004055BF push ds; ret		0_2_004055D9
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_00405ECC push ebp; ret		0_2_00405ED8
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_00407F27 push edi; ret		0_2_00407F28
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_00407FBA push eax; iretd		0_2_00407FBB
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1747D pushfd ; iretd		0_2_04D19C58
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D17404 pushfd ; iretd		0_2_04D19C58
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D100CA push 5D54C3DCh; ret		0_2_04D10116
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D19157 push E8BBB633h; retf 001Bh		0_2_04D1915F
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D14344 push 8122E3ECh; ret		0_2_04D14349
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D17371 pushfd ; iretd		0_2_04D19C58
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D17368 pushfd ; iretd		0_2_04D19C58
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D11F01 push esi; ret		0_2_04D11F02
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D19B93 pushfd ; iretd		0_2_04D19C58

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.15645216813

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

RDTSC instruction interceptor: First address: 0000000004D17C16 second address: 0000000004D17C16 instructions: 0x00000000 rdtsc 0x00000002 mov eax, B4901491h 0x00000007 sub eax, 05E3F0C7h 0x0000000c xor eax, 8F9A272Fh 0x00000011 sub eax, 213604E4h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F65F4CB431Dh 0x0000001e lfence 0x00000021 mov edx, 238EE826h 0x00000026 sub edx, 0388C43Eh 0x0000002c xor edx, E448541Bh 0x00000032 xor edx, BBB077E7h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 add edi, edx 0x00000044 dec ecx 0x00000045 mov dword ptr [ebp+00000229h], AD8B339Ah 0x0000004f xor dword ptr [ebp+00000229h], 22419229h 0x00000059 xor dword ptr [ebp+00000229h], 3996C157h 0x00000063 sub dword ptr [ebp+00000229h], B65C60E4h 0x0000006d cmp ecx, dword ptr [ebp+00000229h] 0x00000073 jne 00007F65F4CB4237h 0x00000075 cmp cx, ax 0x00000078 mov dword ptr [ebp+0000020Bh], ebx 0x0000007e mov ebx, ecx 0x00000080 push ebx 0x00000081 mov ebx, dword ptr [ebp+0000020Bh] 0x00000087 jmp 00007F65F4CB42DEh 0x00000089 cmp dl, bl 0x0000008b call 00007F65F4CB4321h 0x00000090 call 00007F65F4CB433Eh 0x00000095 lfence 0x00000098 mov edx, 238EE826h 0x0000009d sub edx, 0388C43Eh 0x000000a3 xor edx, E448541Bh 0x000000a9 xor edx, BBB077E7h 0x000000af mov edx, dword ptr [edx] 0x000000b1 lfence 0x000000b4 ret 0x000000b5 mov esi, edx 0x000000b7 pushad 0x000000b8 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

Code function: 0_2_04D17C0E rdtsc

0_2_04D17C0E

Anti Debugging:

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1B2F5 mov eax, dword ptr fs:[00000030h]		0_2_04D1B2F5
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C259 mov eax, dword ptr fs:[00000030h]		0_2_04D1C259
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1C226 mov eax, dword ptr fs:[00000030h]		0_2_04D1C226
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D1ACF0 mov eax, dword ptr fs:[00000030h]		0_2_04D1ACF0
Source: C:\Users\user\Desktop\G47wmLn8uy.exe	Code function: 0_2_04D17A41 mov eax, dword ptr fs:[00000030h]		0_2_04D17A41

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

Code function: 0_2_04D17C0E rdtsc

0_2_04D17C0E

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\G47wmLn8uy.exe

Code function: 0_2_04D1D38F RtlAddVectoredExceptionHandler,

0_2_04D1D38F

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: G47wmLn8uy.exe, 00000000.00000002.1189999307.0000000000C40000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: G47wmLn8uy.exe, 00000000.00000002.1189999307.0000000000C40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: G47wmLn8uy.exe, 00000000.00000002.1189999307.0000000000C40000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: G47wmLn8uy.exe, 00000000.00000002.1189999307.0000000000C40000.00000002.00020000.sdmp	Binary or memory string: Progmanlock