| File name: | sample.exe |
| Full analysis: | https://app.any.run/tasks/f169c62e-260c-4c68-8077-79861d5e964b |
| Verdict: | Malicious activity |
| Threats: | GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities. |
| Analysis date: | August 30, 2024, 10:53:26 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 7BA6D75DD85F7C2F4D44CD3283CE29A3 |
| SHA1: | 37409813BD1157D18B4C90B75FF4508F4FCE4467 |
| SHA256: | F5CE6BB282696366F3653859273DAE91890FAAD6D36E863D79AA00233757ABFD |
| SSDEEP: | 49152:D3CpOUWxasRAa9DufdO2F9IbmTAcOVqGMfgUBOslBzuTn2FUaayckEEaIntSufF:DS/WxaQS/F9UmpOVqdfn1lBzgg1FEvWF |
| .exe | | | NSIS - Nullsoft Scriptable Install System (91.9) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (3.3) |
| .exe | | | Win64 Executable (generic) (3) |
| .dll | | | Win32 Dynamic Link Library (generic) (0.7) |
| .exe | | | Win32 Executable (generic) (0.4) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2013:12:25 05:01:35+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 23552 |
| InitializedDataSize: | 117760 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x3219 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.0.0.0 |
| ProductVersionNumber: | 2.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| FileVersion: | 2.0.0.0 |
| InternalName: | drikningerne tanica.exe |
| LegalTrademarks: | nonhallucinated |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" | C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Imaging Devices Control Panel Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 232 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 236 | "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" | C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Imaging Devices Control Panel Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 320 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 360 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 400 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 448 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 508 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 568 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 608 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (7040) sample.exe | Key: | HKEY_CURRENT_USER\signify\Uninstall\Dermatophony137\modfaserne |
| Operation: | write | Name: | depositumbeviset |
Value: 1 | |||
| (PID) Process: | (7040) sample.exe | Key: | HKEY_CURRENT_USER\unremarried\iotization\durnedest |
| Operation: | write | Name: | concealing |
Value: 858096 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7040 | sample.exe | C:\Users\admin\AppData\Roaming\boggler\glaga\kolumnens\Rrledningen.Spi | binary | |
MD5:16B6B2F6E030D72054DDBDB698EEC3BF | SHA256:8658E298F51A5C4D5C3B169073B022B6AEA969E0B1FE827BDB788AC820D79E2E | |||
| 7040 | sample.exe | C:\Users\admin\AppData\Roaming\boggler\glaga\kolumnens\catchwork.bri | binary | |
MD5:334F8B0EA37920C7FAAB36DD953D9B60 | SHA256:3DB32C6F36EF3F1356D88ED109806889FE5A1FD10CE721E96D3D39F9F052D19D | |||
| 7040 | sample.exe | C:\Users\admin\AppData\Roaming\boggler\glaga\kolumnens\Sulphocarbanilide\murasakite.bur | binary | |
MD5:71057DE1B421ECFCDA53575FE17277F5 | SHA256:02EF498012A15CC4A3CFD445BDC1DBFE296A03CDFCAEB3BE6FFDEECDA3312FD3 | |||
| 4604 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uodhjqoy.3s2.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7040 | sample.exe | C:\Users\admin\AppData\Roaming\boggler\glaga\kolumnens\Marinbiologiskes.Bag | text | |
MD5:FF6625D36FCE95CDDA4A2FD917D417F8 | SHA256:41FD539F990EB17F21C09A887F5EAA00BED462A4796D6B11C8583240343E71AF | |||
| 7040 | sample.exe | C:\Users\admin\Mellemstatsligt.ini | text | |
MD5:7A8DCACDF45F3639D1796CCAE2B0A72F | SHA256:7C57AAB9130E81292738529F124F903E6FDE98F9E9035508B33D46DB1EA63CFC | |||
| 7040 | sample.exe | C:\Users\admin\AppData\Local\Temp\nsm9CF5.tmp | binary | |
MD5:1D086C6A08D07AE00733E68FA9681E2D | SHA256:1C73F3EDBB7775F4C0AF21E3048B55BFA1DC4B590F5909D78B6C335B070BC35E | |||
| 4604 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ggixqseb.vth.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4604 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache | binary | |
MD5:8E7D26D71A1CAF822C338431F0651251 | SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084 | |||
| 7040 | sample.exe | C:\Users\admin\AppData\Roaming\boggler\glaga\kolumnens\Fibrilled.txt | text | |
MD5:441A96E9BB115D3708B1E6831591FBB3 | SHA256:B1D82B6E21E414D5E4EF160B28792EF73E771F89F3B21BD4E682A7386C247F35 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1828 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5492 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5492 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6876 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2400 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1828 | svchost.exe | 40.126.31.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1828 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5492 | SIHClient.exe | 40.68.123.157:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5336 | SearchApp.exe | 184.86.251.10:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
fp.msedge.net |
| whitelisted |