Windows Analysis Report
FRACCIONAMIENTO 1722403906461L.exe

Overview

General Information

Sample Name: FRACCIONAMIENTO 1722403906461L.exe
Analysis ID: 612103
MD5: 04e8c57a5df1834c590c49ccc8734d6e
SHA1: b53b20975776cc58ed77d8bfff905303aa84391e
SHA256: 345aa66f6945c8fadee442f115591eaa694196c3ec207246814b5c90ab39df0a
Tags: exeguloadersigned
Infos:

Detection

GuLoader
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
PE / OLE file has an invalid certificate
Contains functionality to dynamically determine API calls
Abnormal high CPU Usage
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000000.00000002.801228236.000000000325C000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E"}
Multi AV Scanner detection for submitted file
Source: FRACCIONAMIENTO 1722403906461L.exe Virustotal: Detection: 27% Perma Link
Source: FRACCIONAMIENTO 1722403906461L.exe ReversingLabs: Detection: 12%
Uses 32bit PE files
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Finlandsrejserne Jump to behavior
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405D74
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_0040290B FindFirstFileW, 0_2_0040290B
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_0040699E FindFirstFileW,FindClose, 0_2_0040699E

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://drive.google.com/uc?export=download&id=1p1TrvkFKYHzlCDSRi8V2K0EcN7S0sk7E
Source: FRACCIONAMIENTO 1722403906461L.exe String found in binary or memory: http://aia.mesince.com/ms-tsa.cer02
Source: FRACCIONAMIENTO 1722403906461L.exe String found in binary or memory: http://aia.mesince.com/ms.cer0
Source: media-removable.png.0.dr String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: FRACCIONAMIENTO 1722403906461L.exe String found in binary or memory: http://crl.mesince.com/ms-tsa.crl0F
Source: FRACCIONAMIENTO 1722403906461L.exe String found in binary or memory: http://crl.mesince.com/ms.crl0
Source: emblem-unreadable.png.0.dr String found in binary or memory: http://jimmac.musichall.czif
Source: FRACCIONAMIENTO 1722403906461L.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: FRACCIONAMIENTO 1722403906461L.exe String found in binary or memory: http://ocsp.mesince.com0)
Source: FRACCIONAMIENTO 1722403906461L.exe String found in binary or memory: http://ocsp.mesince.com0-
Source: FRACCIONAMIENTO 1722403906461L.exe String found in binary or memory: http://www.mesince.com/policy/0
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405809
Uses 32bit PE files
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
PE file contains strange resources
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Section loaded: usp10.dll Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403640
Detected potential crypto function
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_00406D5F 0_2_00406D5F
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_72E61BFF 0_2_72E61BFF
PE / OLE file has an invalid certificate
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: invalid certificate
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Process Stats: CPU usage > 98%
Source: FRACCIONAMIENTO 1722403906461L.exe Virustotal: Detection: 27%
Source: FRACCIONAMIENTO 1722403906461L.exe ReversingLabs: Detection: 12%
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe File read: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Jump to behavior
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403640
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe File created: C:\Users\user\AppData\Local\Temp\nsk7954.tmp Jump to behavior
Source: classification engine Classification label: mal72.troj.evad.winEXE@1/11@0/0
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_004021AA CoCreateInstance, 0_2_004021AA
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404AB5
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Finlandsrejserne Jump to behavior
Source: FRACCIONAMIENTO 1722403906461L.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.801228236.000000000325C000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_72E630C0 push eax; ret 0_2_72E630EE
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_72E61BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_72E61BFF
Drops PE files
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe File created: C:\Users\user\AppData\Local\Temp\nsa7A50.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe RDTSC instruction interceptor: First address: 000000000325D967 second address: 000000000325D967 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F4F9CE53618h 0x00000006 cmp edx, ebx 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405D74
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_0040290B FindFirstFileW, 0_2_0040290B
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_0040699E FindFirstFileW,FindClose, 0_2_0040699E
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe API call chain: ExitProcess graph end node
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_72E61BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_72E61BFF
Source: C:\Users\user\Desktop\FRACCIONAMIENTO 1722403906461L.exe Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403640
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 612103 Sample: FRACCIONAMIENTO 17224039064... Startdate: 20/04/2022 Architecture: WINDOWS Score: 72 10 Found malware configuration 2->10 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected GuLoader 2->14 16 2 other signatures 2->16 5 FRACCIONAMIENTO 1722403906461L.exe 1 28 2->5         started        process3 file4 8 C:\Users\user\AppData\Local\...\System.dll, PE32 5->8 dropped
⊘No contacted IP infos