47bd044b43d50313e7cb86aa0ab8e63cbbb1673ea0813657fa4fcac76947caaf

Analysis

max time kernel
144s
max time network
146s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO#A807.com.exe
Size 88KB
Sample201109-pab95q4e8e
SHA256 47bd044b43d50313e7cb86aa0ab8e63cbbb1673ea0813657fa4fcac76947caaf
MD5 65ff743be053a02f46c93a11ddc6b429
SHA1 83a540f1c8f82196c9527a2dcd4da925076c937e
SHA512 b6afbc84f8148c07ad0422a048dccf420572f8403a69a652c4a389cafe9e64530f8c039f815441ea53c76704a8b5dbe105e6aa6a21d03fa7a5cd02b4ac2cba79
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks QEMU agent state file 2 TTPs 1 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	PO#A807.com.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
580	PO#A807.com.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
580	PO#A807.com.exe

C:\Users\Admin\AppData\Local\Temp\PO#A807.com.exe
"C:\Users\Admin\AppData\Local\Temp\PO#A807.com.exe"
1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads