10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821

General

Target
SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
Size 96KB
Sample201109-35prymxdfn
SHA256 10a4f9b83eb6a7b8ba130f7a9c8c813dee4bfde798f4c7cc539bc35ca18c5821
MD5 70a0b87fc879c0ccd3c47d740b5c93dd
SHA1 c4a3309609d4a0794084d7efe55c78cfdad046bf
SHA512 0b499e5924d7a67da322ee5dda6a0ed78ac2d78e622808be8aecafea72c6c5baf3047447ee4ad4a70736cf5b4c7a205b478d45cb444f268730c214cae6ea22e6
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3300	Nongr1.exe

Checks QEMU agent state file 2 TTPs 4 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	Nongr1.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	Nongr1.exe

Loads dropped DLL 1 IoCs

pid	Process
860	Nongr1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ruche3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\margenstr\\Nongr1.vbs"	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	Nongr1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ruche3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\margenstr\\Nongr1.vbs"	Nongr1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4768	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
4168	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
3300	Nongr1.exe
860	Nongr1.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 4168	4768	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	78
PID 3300 set thread context of 860	3300	Nongr1.exe	80

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4768	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
3300	Nongr1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4768	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
3300	Nongr1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4168	4768	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	78
PID 4768 wrote to memory of 4168	4768	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	78
PID 4768 wrote to memory of 4168	4768	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	78
PID 4768 wrote to memory of 4168	4768	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	78
PID 4168 wrote to memory of 3300	4168	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	79
PID 4168 wrote to memory of 3300	4168	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	79
PID 4168 wrote to memory of 3300	4168	SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe	79
PID 3300 wrote to memory of 860	3300	Nongr1.exe	80
PID 3300 wrote to memory of 860	3300	Nongr1.exe	80
PID 3300 wrote to memory of 860	3300	Nongr1.exe	80
PID 3300 wrote to memory of 860	3300	Nongr1.exe	80

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe"
1⤵
- Checks QEMU agent state file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.GenKryptik.EJUR.18396.exe"
  2⤵
  - Checks QEMU agent state file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\margenstr\Nongr1.exe
    "C:\Users\Admin\AppData\Local\Temp\margenstr\Nongr1.exe"
    3⤵
    - Executes dropped EXE
    - Checks QEMU agent state file
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\margenstr\Nongr1.exe
      "C:\Users\Admin\AppData\Local\Temp\margenstr\Nongr1.exe"
      4⤵
      Checks QEMU agent state file
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:860