10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821

General

Target
SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
Size 96KB
Sample201109-35prymxdfn
SHA256 10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821
MD5 70a0b87fc879c0ccd3c47d740b5c93dd
SHA1 c4a3309609d4a0794084d7efe55c78cfdad046bf
SHA512 0b499e5924d7a67da322ee5dda6a0ed78ac2d78e622808be8aecafea72c6c5baf3047447ee4ad4a70736cf5b4c7a205b478d45cb444f268730c214cae6ea22e6
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1532	Nongr1.exe

Checks QEMU agent state file 2 TTPs 4 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	Nongr1.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	Nongr1.exe

Loads dropped DLL 4 IoCs

pid	Process
1820	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
1820	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
1532	Nongr1.exe
848	Nongr1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ruche3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\margenstr\\Nongr1.vbs"	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	Nongr1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ruche3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\margenstr\\Nongr1.vbs"	Nongr1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
1820	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
1532	Nongr1.exe
848	Nongr1.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1820	1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	29
PID 1532 set thread context of 848	1532	Nongr1.exe	31

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
1532	Nongr1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
1532	Nongr1.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1820	1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	29
PID 1688 wrote to memory of 1820	1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	29
PID 1688 wrote to memory of 1820	1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	29
PID 1688 wrote to memory of 1820	1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	29
PID 1688 wrote to memory of 1820	1688	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	29
PID 1820 wrote to memory of 1532	1820	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	30
PID 1820 wrote to memory of 1532	1820	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	30
PID 1820 wrote to memory of 1532	1820	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	30
PID 1820 wrote to memory of 1532	1820	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	30
PID 1532 wrote to memory of 848	1532	Nongr1.exe	31
PID 1532 wrote to memory of 848	1532	Nongr1.exe	31
PID 1532 wrote to memory of 848	1532	Nongr1.exe	31
PID 1532 wrote to memory of 848	1532	Nongr1.exe	31
PID 1532 wrote to memory of 848	1532	Nongr1.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe"
1⤵
- Checks QEMU agent state file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe"
  2⤵
  - Checks QEMU agent state file
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Users\Admin\AppData\Local\Temp\margenstr\Nongr1.exe
    "C:\Users\Admin\AppData\Local\Temp\margenstr\Nongr1.exe"
    3⤵
    - Executes dropped EXE
    - Checks QEMU agent state file
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\margenstr\Nongr1.exe
      "C:\Users\Admin\AppData\Local\Temp\margenstr\Nongr1.exe"
      4⤵
      Checks QEMU agent state file
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:848