9e6cf2b57d1e96bced0f7742e883a8fdf94847fcf3344ae55f05324b59fde328

General

Target
69f08249c05b79adf3c7327cb8270205.exe
Size 100KB
Sample201109-bjmebfbw36
SHA256 9e6cf2b57d1e96bced0f7742e883a8fdf94847fcf3344ae55f05324b59fde328
MD5 69f08249c05b79adf3c7327cb8270205
SHA1 6a267e60f97f2358c205cf6e163f7317c2acd3e9
SHA512 a286a3e2ea9e55572e98b81c3ab0bb0a78f253eee63003dc664f41ac338cc91a8ab1313bbdf190b98ff32217340c136815d35bad036b4e1795b62b54d635d3f3
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3792	GENN.exe

Checks QEMU agent state file 2 TTPs 4 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	69f08249c05b79adf3c7327cb8270205.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	69f08249c05b79adf3c7327cb8270205.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	GENN.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	GENN.exe

Loads dropped DLL 1 IoCs

pid	Process
1392	GENN.exe

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	69f08249c05b79adf3c7327cb8270205.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Mantu3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bambusflj\\GENN.vbs"	69f08249c05b79adf3c7327cb8270205.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	GENN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Mantu3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bambusflj\\GENN.vbs"	GENN.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 2952	580	69f08249c05b79adf3c7327cb8270205.exe	78
PID 3792 set thread context of 1392	3792	GENN.exe	80

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
580	69f08249c05b79adf3c7327cb8270205.exe
3792	GENN.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
580	69f08249c05b79adf3c7327cb8270205.exe
3792	GENN.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 2952	580	69f08249c05b79adf3c7327cb8270205.exe	78
PID 580 wrote to memory of 2952	580	69f08249c05b79adf3c7327cb8270205.exe	78
PID 580 wrote to memory of 2952	580	69f08249c05b79adf3c7327cb8270205.exe	78
PID 580 wrote to memory of 2952	580	69f08249c05b79adf3c7327cb8270205.exe	78
PID 2952 wrote to memory of 3792	2952	69f08249c05b79adf3c7327cb8270205.exe	79
PID 2952 wrote to memory of 3792	2952	69f08249c05b79adf3c7327cb8270205.exe	79
PID 2952 wrote to memory of 3792	2952	69f08249c05b79adf3c7327cb8270205.exe	79
PID 3792 wrote to memory of 1392	3792	GENN.exe	80
PID 3792 wrote to memory of 1392	3792	GENN.exe	80
PID 3792 wrote to memory of 1392	3792	GENN.exe	80
PID 3792 wrote to memory of 1392	3792	GENN.exe	80