Windows Analysis Report PKO_TRANS_DETAILS_20211216_0809521.exe

ID:	540990
Product:	CloudBasic
Start time:	13:10:15
Start date:	16.12.2021
Sample:	PKO_TRANS_DETAILS_20211216_0809521.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	1823b507e96d8138bada7c65d424abcc
SHA1:	e5d7884da7d17ba0ae592ff787e84ae665e21c3a
SHA256:	99b81b452d173986229ed512383e05214f35c819aa9da4c2a972bb05c880d536
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\~DF4AE55F204BB0FB8A.TMP	Composite Document File V2 Document, Cannot read section info	9635DCB06D1E14BE1BB3D7D4B4CEA9F0	CCE17243F4FDB2A218D4185E75715E67AE7E219C	D40FDC94A7E2F1C30434803A370E8881BF493D506000C27178A79CF02ECAB2D6

AV Detection:

Found malware configuration

Source: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1byST7nT"}

Multi AV Scanner detection for submitted file

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Virustotal: Detection: 20%

Perma Link

Compliance:

Uses 32bit PE files

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1byST7nT

System Summary:

Uses 32bit PE files

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Sample file is different than original file name gathered from version info

Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDagins.exe vs PKO_TRANS_DETAILS_20211216_0809521.exe
Source: PKO_TRANS_DETAILS_20211216_0809521.exe	Binary or memory string: OriginalFilenameDagins.exe vs PKO_TRANS_DETAILS_20211216_0809521.exe

PE file contains strange resources

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Detected potential crypto function

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_00401E86		0_2_00401E86
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884B3		0_2_04C884B3
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8D3CE		0_2_04C8D3CE
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C880CC		0_2_04C880CC
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88CCE		0_2_04C88CCE
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C860C1		0_2_04C860C1
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C804D3		0_2_04C804D3
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C868E8		0_2_04C868E8
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86CE3		0_2_04C86CE3
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C804E6		0_2_04C804E6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C890E6		0_2_04C890E6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884F4		0_2_04C884F4
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C894A0		0_2_04C894A0
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884B6		0_2_04C884B6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86C56		0_2_04C86C56
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86069		0_2_04C86069
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86878		0_2_04C86878
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8587D		0_2_04C8587D
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8647E		0_2_04C8647E
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88C06		0_2_04C88C06
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86014		0_2_04C86014
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C865D8		0_2_04C865D8
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C805DA		0_2_04C805DA
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C865DE		0_2_04C865DE
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C869D6		0_2_04C869D6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C865E9		0_2_04C865E9
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86580		0_2_04C86580
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C80584		0_2_04C80584
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86985		0_2_04C86985
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86D95		0_2_04C86D95
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C869A0		0_2_04C869A0
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C861BE		0_2_04C861BE
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C89154		0_2_04C89154
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86501		0_2_04C86501
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8051E		0_2_04C8051E
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88D15		0_2_04C88D15
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86928		0_2_04C86928
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8613F		0_2_04C8613F
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C862E2		0_2_04C862E2
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C866F5		0_2_04C866F5
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88AF5		0_2_04C88AF5
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88A8F		0_2_04C88A8F
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8C285		0_2_04C8C285
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88297		0_2_04C88297
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85EB9		0_2_04C85EB9
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86249		0_2_04C86249
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85A55		0_2_04C85A55
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86661		0_2_04C86661
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86A65		0_2_04C86A65
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86E28		0_2_04C86E28
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85E2C		0_2_04C85E2C
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85A31		0_2_04C85A31
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C863F6		0_2_04C863F6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86B84		0_2_04C86B84
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85FA4		0_2_04C85FA4
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88BBA		0_2_04C88BBA
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86BB1		0_2_04C86BB1
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8674D		0_2_04C8674D
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85F46		0_2_04C85F46
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8637E		0_2_04C8637E
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86B09		0_2_04C86B09

Contains functionality to call native functions

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884B3 NtAllocateVirtualMemory,		0_2_04C884B3
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C880CC NtAllocateVirtualMemory,		0_2_04C880CC
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884F4 NtAllocateVirtualMemory,		0_2_04C884F4
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884B6 NtAllocateVirtualMemory,		0_2_04C884B6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C885B2 NtAllocateVirtualMemory,		0_2_04C885B2
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8855C NtAllocateVirtualMemory,		0_2_04C8855C
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C886AA NtAllocateVirtualMemory,		0_2_04C886AA
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88631 NtAllocateVirtualMemory,		0_2_04C88631

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Virustotal: Detection: 20%

PE file has an executable .text section and no other executable section

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

File created: C:\Users\user\AppData\Local\Temp\~DF4AE55F204BB0FB8A.TMP

Jump to behavior

Classification label

Source: classification engine

Classification label: mal72.troj.evad.winEXE@1/1@0/0

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_00406A78 push ebp; ret		0_2_00406A79
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_004081F5 push eax; ret		0_2_004081F6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C89595 push es; ret		0_2_04C89597
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8B11A push FFFFFFB9h; retf		0_2_04C8B126
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8293C push ebp; iretd		0_2_04C8293D
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C83EA4 push ebx; ret		0_2_04C83EA7

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 6.98717798783

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Code function: 0_2_04C87CFD rdtsc

0_2_04C87CFD

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Process Stats: CPU usage > 90% for more than 60s

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8A906 mov eax, dword ptr fs:[00000030h]		0_2_04C8A906
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C87AD4 mov eax, dword ptr fs:[00000030h]		0_2_04C87AD4
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8C285 mov eax, dword ptr fs:[00000030h]		0_2_04C8C285
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8B397 mov eax, dword ptr fs:[00000030h]		0_2_04C8B397

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Code function: 0_2_04C87CFD rdtsc

0_2_04C87CFD

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Code function: 0_2_04C8D3CE RtlAddVectoredExceptionHandler,

0_2_04C8D3CE

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Progmanlock