Windows Analysis Report
dlawt.exe

Overview

General Information

Sample Name: dlawt.exe
Analysis ID: 711461
MD5: cf313a27bceba36c7fa863ba1e935676
SHA1: 4ff90062880efe58e6e26ded7f166c5786e201db
SHA256: d4fba0fc4c7c1335a5b6be72e575a2a9a400a5fd9b0aed69389d4bba8fac7527
Tags: exe
Infos:

Detection

GuLoader
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
Uses 32bit PE files
Antivirus or Machine Learning detection for unpacked file
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
PE / OLE file has an invalid certificate
Contains functionality to call native functions
Abnormal high CPU Usage
Contains functionality for read data from the clipboard

Classification

Source: 0.2.dlawt.exe.410ea0.1.unpack Avira: Label: ADWARE/Adware.Gen7
Source: dlawt.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: dlawt.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_004065C7 FindFirstFileW,FindClose, 0_2_004065C7
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405996
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: dlawt.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: dlawt.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: dlawt.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: folder-download.png.0.dr String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: dlawt.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: dlawt.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: dlawt.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: text-x-generic.png.0.dr String found in binary or memory: http://jimmac.musichall.czif
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: dlawt.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: dlawt.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: dlawt.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: dlawt.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/chart
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/datastyle
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/drawing
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/help
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/meta
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/office
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/style
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/table
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://openoffice.org/2000/text
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://sun.com/2000/XMLSearch
Source: dlawt.exe, 00000000.00000003.243677360.0000000002953000.00000004.00000800.00020000.00000000.sdmp, idxcaption.xsl.0.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_0040542B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_0040542B
Source: dlawt.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: dlawt.exe, 00000000.00000002.763269116.0000000000459000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSerian.exeDVarFileInfo$ vs dlawt.exe
Source: dlawt.exe Binary or memory string: OriginalFilenameSerian.exeDVarFileInfo$ vs dlawt.exe
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403359
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00404C68 0_2_00404C68
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_0040698E 0_2_0040698E
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_6F561B63 0_2_6F561B63
Source: dlawt.exe Static PE information: invalid certificate
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_6F562A74 NtProtectVirtualMemory,GetLastError, 0_2_6F562A74
Source: C:\Users\user\Desktop\dlawt.exe Process Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\dlawt.exe File read: C:\Users\user\Desktop\dlawt.exe Jump to behavior
Source: dlawt.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\dlawt.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\dlawt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403359
Source: C:\Users\user\Desktop\dlawt.exe File created: C:\Users\user\AppData\Local\Temp\nsk8C3A.tmp Jump to behavior
Source: classification engine Classification label: mal52.troj.evad.winEXE@1/24@0/0
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00402104 CoCreateInstance, 0_2_00402104
Source: C:\Users\user\Desktop\dlawt.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_004046EC GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004046EC
Source: dlawt.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

barindex
Source: Yara match File source: 00000000.00000002.764563797.0000000003208000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_6F562FD0 push eax; ret 0_2_6F562FFE
Source: C:\Users\user\Desktop\dlawt.exe File created: C:\Users\user\AppData\Local\Temp\nsq995B.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\dlawt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Users\user\Desktop\dlawt.exe RDTSC instruction interceptor: First address: 00000000032092DD second address: 00000000032092DD instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FF7ECC6D189h 0x00000006 inc ebp 0x00000007 clc 0x00000008 inc ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_004065C7 FindFirstFileW,FindClose, 0_2_004065C7
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405996
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00402868 FindFirstFileW, 0_2_00402868
Source: C:\Users\user\Desktop\dlawt.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\dlawt.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\dlawt.exe Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403359
No contacted IP infos