Edit tour
Windows
Analysis Report
CONTRACT_REVISED-SHIPMENT-DOCUMENTS_EXPORTS_REFERENCE-QT63637-02993900299348.exe
Overview
General Information
| Sample Name: | CONTRACT_REVISED-SHIPMENT-DOCUMENTS_EXPORTS_REFERENCE-QT63637-02993900299348.exe |
| Analysis ID: | 736949 |
| MD5: | 045f22ce9be3d33b07a00780ee66fcfd |
| SHA1: | 91b74e75d55c33d8d82b10bed51ca7d3ad80147c |
| SHA256: | e05ec32c2edc10b6917a3cbcac9d823cb37db908cc51f3ec459800992e2b8b37 |
| Infos: |  |
 | |
Detection
GuLoader
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected GuLoader
Initial sample is a PE file and has a suspicious name
Tries to detect Any.run
Executable has a suspicious name (potential lure to open the executable)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses 32bit PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Queries the volume information (name, serial number etc) of a device
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Checks if the current process is being debugged
Sleep loop found (likely to delay execution)
Detected potential crypto function
PE / OLE file has an invalid certificate
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Creates a process in suspended mode (likely to inject code)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard
Classification
- System is w10x64native
CONTRACT_REVISED-SHIPMENT-DOCUMENTS_EXPORTS_REFERENCE-QT63637-02993900299348.exe (PID: 4848 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 045F22CE9BE3D33B07A00780EE66FCFD) 
dllhost.exe (PID: 2364 cmdline: C:\Windows \system32\ DllHost.ex e /Process id:{AB8902 B4-09CA-4B B6-B78D-A8 F59079A8D5 } MD5: 08EB78E5BE019DF044C26B14703BD1FA) - backgroundTaskHost.exe (PID: 4408 cmdline:
"C:\WINDOW S\system32 \backgroun dTaskHost. exe" -Serv erName:App .AppXmtcan 0h2tfbfy7k 9kn8hbxb6d mzz1zh0.mc a MD5: DA7063B17DBB8BBB3015351016868006) - dllhost.exe (PID: 4508 cmdline:
C:\Windows \system32\ DllHost.ex e /Process id:{AB8902 B4-09CA-4B B6-B78D-A8 F59079A8D5 } MD5: 08EB78E5BE019DF044C26B14703BD1FA) - BackgroundTransferHost.exe (PID: 4480 cmdline:
"Backgroun dTransferH ost.exe" - ServerName :Backgroun dTransferH ost.1 MD5: C5D813D92E83CDE3FECD9343933E3421) - BackgroundTransferHost.exe (PID: 5560 cmdline:
"Backgroun dTransferH ost.exe" - ServerName :Backgroun dTransferH ost.1 MD5: C5D813D92E83CDE3FECD9343933E3421) 
ieinstal.exe (PID: 5400 cmdline: C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 1820 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 6908 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 1396 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 4268 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 4772 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 7620 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 6588 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 3156 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 5924 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ieinstal.exe (PID: 3988 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 7871873BABCEA94FBA13900B561C7C55) - ielowutil.exe (PID: 7732 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 4760 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 7756 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 4612 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 3852 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 6596 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 6516 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 7348 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 7808 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ielowutil.exe (PID: 7380 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 650FE7460630188008BF8C8153526CEB) - ExtExport.exe (PID: 5404 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - ExtExport.exe (PID: 7588 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - ExtExport.exe (PID: 5708 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - ExtExport.exe (PID: 8104 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - ExtExport.exe (PID: 1160 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - ExtExport.exe (PID: 6700 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - ExtExport.exe (PID: 6248 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - ExtExport.exe (PID: 5524 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - ExtExport.exe (PID: 5904 cmdline:
C:\Users\u ser\Deskto p\CONTRACT _REVISED-S HIPMENT-DO CUMENTS_EX PORTS_REFE RENCE-QT63 637-029939 00299348.e xe MD5: 3253FD643C51C133C3489A146781913B) - backgroundTaskHost.exe (PID: 5840 cmdline:
"C:\WINDOW S\system32 \backgroun dTaskHost. exe" -Serv erName:App .AppXmtcan 0h2tfbfy7k 9kn8hbxb6d mzz1zh0.mc a MD5: DA7063B17DBB8BBB3015351016868006)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security |
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
| Source: | Static PE information: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | File opened: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Code function: | ||
System Summary |   |
|---|
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||