Windows Analysis Report
AEAT-Notificaci#U00f3n..rar

Overview

General Information

Sample Name: AEAT-Notificaci#U00f3n..rar
Analysis ID: 830334
MD5: dd05bf773b3d290ef4925014d0bd6e12
SHA1: a26d39292e8d88b4c3efc90ea759d8a68980847e
SHA256: c00e9a2a34c6b7a69d2ed42b92f07bfcd35134dd39fd19334b233c23da3118c6
Infos:

Detection

GuLoader
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
Queries the volume information (name, serial number etc) of a device
Found dropped PE file which has not been started or loaded
Drops PE files

Classification

Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Replyingly\Avnbgen\Spisekamrenes
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.8.45
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.88.191
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.88.191
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.8.45
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe File created: C:\Users\alfredo\AppData\Local\Temp\nsqC93E.tmp
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: classification engine Classification label: mal52.troj.evad.winRAR@3/16@0/19
Source: unknown Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\alfredo\Desktop\" -an -ai#7zMap6823:108:7zEvent2591
Source: unknown Process created: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe "C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe"
Source: C:\Windows\System32\OpenWith.exe File read: C:\Users\desktop.ini
Source: C:\Windows\System32\OpenWith.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
Source: C:\Windows\System32\OpenWith.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6736:120:WilError_02
Source: C:\Program Files\7-Zip\7zG.exe File created: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Replyingly\Avnbgen\Spisekamrenes

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000008.00000002.2683502888.0000000004633000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Drops PE files
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe File created: C:\Users\alfredo\AppData\Local\Temp\nslCA0A.tmp\System.dll Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe File created: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe Jump to dropped file
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe File created: C:\Users\alfredo\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\ftre\Peroba\Udviklers\Unsingableness\System.Reflection.TypeExtensions.dll Jump to dropped file
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe File created: C:\Users\alfredo\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\ftre\Peroba\Udviklers\Unsingableness\System.Reflection.Primitives.dll Jump to dropped file
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe File created: C:\Users\alfredo\AppData\Local\Temp\nslCA0A.tmp\AdvSplash.dll Jump to dropped file
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3C9CFD6Fh 0x00000009 jmp 00007FDD3C9CFDDEh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3C79F2DFh 0x00000009 jmp 00007FDD3C79F34Eh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3C9C61AFh 0x00000009 jmp 00007FDD3C9C621Eh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3CE58F7Fh 0x00000009 jmp 00007FDD3CE58FEEh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3C9CFDAFh 0x00000009 jmp 00007FDD3C9CFE1Eh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3CDF74BFh 0x00000009 jmp 00007FDD3CDF752Eh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3C9CD92Fh 0x00000009 jmp 00007FDD3C9CD99Eh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3C9C61FFh 0x00000009 jmp 00007FDD3C9C626Eh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe RDTSC instruction interceptor: First address: 00000000049967E4 second address: 00000000049967E4 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, 00000034h 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FDD3C9C5EEFh 0x00000009 jmp 00007FDD3C9C5F5Eh 0x0000000b cmp dx, F1B8h 0x00000010 cmp dx, cx 0x00000013 inc ebp 0x00000014 inc ebx 0x00000015 cmp edx, ebx 0x00000017 rdtsc
Found dropped PE file which has not been started or loaded
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe Dropped PE file which has not been started: C:\Users\alfredo\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\ftre\Peroba\Udviklers\Unsingableness\System.Reflection.TypeExtensions.dll Jump to dropped file
Source: C:\Users\alfredo\Desktop\AEAT-Notificaci n..exe Dropped PE file which has not been started: C:\Users\alfredo\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\ftre\Peroba\Udviklers\Unsingableness\System.Reflection.Primitives.dll Jump to dropped file
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
52.109.8.45
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
192.229.221.95
 unknown United States
15133 EDGECASTUS false
52.109.88.191
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false