Loading ...

Play interactive tourEdit tour

Windows Analysis Report PKO_TRANS_DETAILS_20211216_0809521.exe

Overview

General Information

Sample Name:PKO_TRANS_DETAILS_20211216_0809521.exe
Analysis ID:540990
MD5:1823b507e96d8138bada7c65d424abcc
SHA1:e5d7884da7d17ba0ae592ff787e84ae665e21c3a
SHA256:99b81b452d173986229ed512383e05214f35c819aa9da4c2a972bb05c880d536
Tags:exe
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to call native functions
Program does not show much activity (idle)
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1byST7nT"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1byST7nT"}
    Multi AV Scanner detection for submitted fileShow sources
    Source: PKO_TRANS_DETAILS_20211216_0809521.exeVirustotal: Detection: 20%Perma Link
    Source: PKO_TRANS_DETAILS_20211216_0809521.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: https://drive.google.com/uc?export=download&id=1byST7nT
    Source: PKO_TRANS_DETAILS_20211216_0809521.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameDagins.exe vs PKO_TRANS_DETAILS_20211216_0809521.exe
    Source: PKO_TRANS_DETAILS_20211216_0809521.exeBinary or memory string: OriginalFilenameDagins.exe vs PKO_TRANS_DETAILS_20211216_0809521.exe
    Source: PKO_TRANS_DETAILS_20211216_0809521.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_00401E860_2_00401E86
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C884B30_2_04C884B3
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8D3CE0_2_04C8D3CE
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C880CC0_2_04C880CC
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C88CCE0_2_04C88CCE
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C860C10_2_04C860C1
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C804D30_2_04C804D3
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C868E80_2_04C868E8
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C86CE30_2_04C86CE3
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C804E60_2_04C804E6
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C890E60_2_04C890E6
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C884F40_2_04C884F4
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C894A00_2_04C894A0
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C884B60_2_04C884B6
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C86C560_2_04C86C56
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C860690_2_04C86069
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C868780_2_04C86878
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8587D0_2_04C8587D
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8647E0_2_04C8647E
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C88C060_2_04C88C06
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C860140_2_04C86014
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C865D80_2_04C865D8
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C805DA0_2_04C805DA
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C865DE0_2_04C865DE
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C869D60_2_04C869D6
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C865E90_2_04C865E9
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C865800_2_04C86580
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C805840_2_04C80584
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C869850_2_04C86985
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C86D950_2_04C86D95
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C869A00_2_04C869A0
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C861BE0_2_04C861BE
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C891540_2_04C89154
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C865010_2_04C86501
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8051E0_2_04C8051E
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C88D150_2_04C88D15
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C869280_2_04C86928
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8613F0_2_04C8613F
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C862E20_2_04C862E2
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C866F50_2_04C866F5
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C88AF50_2_04C88AF5
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C88A8F0_2_04C88A8F
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8C2850_2_04C8C285
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C882970_2_04C88297
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C85EB90_2_04C85EB9
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C862490_2_04C86249
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C85A550_2_04C85A55
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C866610_2_04C86661
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C86A650_2_04C86A65
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C86E280_2_04C86E28
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C85E2C0_2_04C85E2C
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C85A310_2_04C85A31
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C863F60_2_04C863F6
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C86B840_2_04C86B84
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C85FA40_2_04C85FA4
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C88BBA0_2_04C88BBA
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C86BB10_2_04C86BB1
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8674D0_2_04C8674D
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C85F460_2_04C85F46
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8637E0_2_04C8637E
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C86B090_2_04C86B09
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C884B3 NtAllocateVirtualMemory,0_2_04C884B3
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C880CC NtAllocateVirtualMemory,0_2_04C880CC
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C884F4 NtAllocateVirtualMemory,0_2_04C884F4
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C884B6 NtAllocateVirtualMemory,0_2_04C884B6
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C885B2 NtAllocateVirtualMemory,0_2_04C885B2
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8855C NtAllocateVirtualMemory,0_2_04C8855C
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C886AA NtAllocateVirtualMemory,0_2_04C886AA
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C88631 NtAllocateVirtualMemory,0_2_04C88631
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeProcess Stats: CPU usage > 98%
    Source: PKO_TRANS_DETAILS_20211216_0809521.exeVirustotal: Detection: 20%
    Source: PKO_TRANS_DETAILS_20211216_0809521.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeFile created: C:\Users\user\AppData\Local\Temp\~DF4AE55F204BB0FB8A.TMPJump to behavior
    Source: classification engineClassification label: mal72.troj.evad.winEXE@1/1@0/0

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_00406A78 push ebp; ret 0_2_00406A79
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_004081F5 push eax; ret 0_2_004081F6
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C89595 push es; ret 0_2_04C89597
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8B11A push FFFFFFB9h; retf 0_2_04C8B126
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8293C push ebp; iretd 0_2_04C8293D
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C83EA4 push ebx; ret 0_2_04C83EA7
    Source: initial sampleStatic PE information: section name: .text entropy: 6.98717798783
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C87CFD rdtsc 0_2_04C87CFD

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8A906 mov eax, dword ptr fs:[00000030h]0_2_04C8A906
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C87AD4 mov eax, dword ptr fs:[00000030h]0_2_04C87AD4
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8C285 mov eax, dword ptr fs:[00000030h]0_2_04C8C285
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8B397 mov eax, dword ptr fs:[00000030h]0_2_04C8B397
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C87CFD rdtsc 0_2_04C87CFD
    Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exeCode function: 0_2_04C8D3CE RtlAddVectoredExceptionHandler,0_2_04C8D3CE
    Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmpBinary or memory string: Program Manager
    Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
    Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmpBinary or memory string: Progman
    Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery11Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsSoftware Packing1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information2NTDSSystem Information Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.