Windows Analysis Report
Order_002376662-579588_Date 24082022.exe

Overview

General Information

Sample Name:	Order_002376662-579588_Date 24082022.exe
Analysis ID:	694559
MD5:	8c2a59bd88b7e2c26045a604ed544288
SHA1:	7efb014d57608ff6a2805baf4dd7c150792e6eb4
SHA256:	0d4b100e641aad426a916cb326d20f8fe44e32ca38f7a85c505135036c6b44af
Tags:	exesigned
Infos:

Detection

GuLoader

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Initial sample is a PE file and has a suspicious name

Tries to detect virtualization through RDTSC time measurements

Uses 32bit PE files

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Stores files to the Windows start menu directory

PE / OLE file has an invalid certificate

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: Order_002376662-579588_Date 24082022.exe	Metadefender: Detection: 27%			Perma Link
Source: Order_002376662-579588_Date 24082022.exe	ReversingLabs: Detection: 65%

Uses 32bit PE files

Source: Order_002376662-579588_Date 24082022.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Platooned\Ananthropism

Jump to behavior

Source: Order_002376662-579588_Date 24082022.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\SourceCode\GC3.GPUPowerSaving\production_V4.2.12.3\Service\ConfigEditorCS\obj\Release\GPUPowerSavingConfigEditor.pdb source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	Code function: 2_2_00405861 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	2_2_00405861
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	Code function: 2_2_0040639C FindFirstFileA,FindClose,	2_2_0040639C
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	Code function: 2_2_004026F8 FindFirstFileA,	2_2_004026F8

Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: Order_002376662-579588_Date 24082022.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp, GPUPowerSavingConfigEditor.dll.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Code function: 2_2_004052FE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_004052FE

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Order_002376662-579588_Date 24082022.exe

Uses 32bit PE files

Source: Order_002376662-579588_Date 24082022.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

PE file does not import any functions

Source: GPUPowerSavingConfigEditor.dll.2.dr

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: Order_002376662-579588_Date 24082022.exe, 00000002.00000002.829004548.000000000277A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameGPUPowerSavingConfigEditor.dll< vs Order_002376662-579588_Date 24082022.exe

PE file contains strange resources

Source: Order_002376662-579588_Date 24082022.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Order_002376662-579588_Date 24082022.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Code function: 2_2_0040330D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

2_2_0040330D

Creates files inside the system directory

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

File created: C:\Windows\resources\0409

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	Code function: 2_2_00406725		2_2_00406725
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	Code function: 2_2_00404B3D		2_2_00404B3D

PE / OLE file has an invalid certificate

Source: Order_002376662-579588_Date 24082022.exe

Static PE information: invalid certificate

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Process Stats: CPU usage > 98%

Source: Order_002376662-579588_Date 24082022.exe	Metadefender: Detection: 27%
Source: Order_002376662-579588_Date 24082022.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

File read: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Jump to behavior

Source: Order_002376662-579588_Date 24082022.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

2_2_0040330D

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens

Jump to behavior

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

File created: C:\Users\user\AppData\Local\Temp\nsn2719.tmp

Jump to behavior

Source: classification engine

Classification label: mal64.troj.evad.winEXE@1/7@0/0

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Code function: 2_2_004020CB CoCreateInstance,MultiByteToWideChar,

2_2_004020CB

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Code function: 2_2_004045CA GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_004045CA

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Platooned\Ananthropism

Jump to behavior

Source: Order_002376662-579588_Date 24082022.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.829249266.00000000030C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Code function: 2_2_10002D20 push eax; ret

2_2_10002D4E

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Code function: 2_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

2_2_10001A5D

Drops PE files

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\GPUPowerSavingConfigEditor.dll			Jump to dropped file
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Local\Temp\nsb3C99.tmp\System.dll			Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Noneffervescently.Cre	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Kalligraferendes	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Kalligraferendes\Quantisers	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Kalligraferendes\Quantisers\Aqua_20.bmp	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Forhaanet.Nab	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\GPUPowerSavingConfigEditor.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\face-cool.png	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Tilegnelserne	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Tilegnelserne\Suppegrydernes79	Jump to behavior
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Tilegnelserne\Suppegrydernes79\iso_3166-1.json	Jump to behavior

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

RDTSC instruction interceptor: First address: 00000000030C2A2F second address: 00000000030C2A2F instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007EFC0CCA9B97h 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 test dx, dx 0x0000000b rdtsc

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\GPUPowerSavingConfigEditor.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	Code function: 2_2_00405861 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	2_2_00405861
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	Code function: 2_2_0040639C FindFirstFileA,FindClose,	2_2_0040639C
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	Code function: 2_2_004026F8 FindFirstFileA,	2_2_004026F8

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe	API call chain: ExitProcess graph end node

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

Code function: 2_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

2_2_10001A5D

Source: C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe

2_2_0040330D

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	694559
Product:	CloudBasic
Start time:	23:50:13
Start date:	31.08.2022
Sample:	Order_002376662-579588_Date 24082022.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	8c2a59bd88b7e2c26045a604ed544288
SHA1:	7efb014d57608ff6a2805baf4dd7c150792e6eb4
SHA256:	0d4b100e641aad426a916cb326d20f8fe44e32ca38f7a85c505135036c6b44af
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\nsb3C99.tmp\System.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	C9473CB90D79A374B2BA6040CA16E45C	AB95B54F12796DCE57210D65F05124A6ED81234A	B80A5CBA69D1853ED5979B0CA0352437BF368A5CFB86CB4528EDADD410E11352
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Forhaanet.Nab	ASCII text, with very long lines, with no line terminators	61F8A1615921DA63C2609B90984F1D32	D188A91A6745481BB830704854FE61E2A41E0B9A	DF023F32CE51FF8BA14F1147B1D7644D734AC9EF0FB5CF024A88A495E153EFF0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\GPUPowerSavingConfigEditor.dll	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows	6213DFF7A0CE2E52FD61EC4097DF93E7	4087C8D803EE9E4298AA51EC05E18D020A0A2728	D12DC4BBDACDE8FC92DCFB384807D793C67B9B7E88D52EE0240E8A1901B80071
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\face-cool.png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	EFB6B9E41A0DAAB0088A365317A4F635	5D5B2C92BB5870B15BFB383A4C749EE1B71E21AB	40A5B74A33F7372AC62EC82CA65097B2BF411E6CAF2667C87DA374A06834AD05
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Kalligraferendes\Quantisers\Aqua_20.bmp	JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3	EF9954E2C8A46E6F0BB6AAF1E0A7F499	F1639B6632F6B4B472A4A0AD653B82A48B008F6B	6550954EBF87A006EDA7C80EA5EB26CD51753540C159DEA36E506C811D5261DD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Noneffervescently.Cre	data	34957562BCFF2DAE97F8009F22642EA5	F22431D76E12B5E4AC240E96F6856165C70A01EE	69823BE330A7C9B93750E25AFB3BC29DC33F7DE4CA7935D787BE29DD80E711D1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Tilegnelserne\Suppegrydernes79\iso_3166-1.json	UTF-8 Unicode text	062FC6431BF0FF5F8E7E62587FCBD686	06E2BF1BB06CE408EC2AAE8D9F7A8ABC0371B57D	78FB090F4A54C8B5970EC04C7511F17EB767275A8D5358604A1E335440678617

Windows Analysis Report
Order_002376662-579588_Date 24082022.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report Order_002376662-579588_Date 24082022.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Order_002376662-579588_Date 24082022.exe