3718ecafddb6b2fcf35611ec2b060d06de6243ca971124177f8dab5c0dfbbe0f

Analysis

max time kernel
150s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
848f9d51768421eb1154394b2ad32466.exe
Size 96KB
Sample201109-t63namdyr6
SHA256 3718ecafddb6b2fcf35611ec2b060d06de6243ca971124177f8dab5c0dfbbe0f
MD5 848f9d51768421eb1154394b2ad32466
SHA1 bc03d9bc88741c334a8c77fe679433993dd313df
SHA512 7bdb13f7d1dd05a2fbfc79de29ffca674a0214bd9288b6b21333ba68df200eba6978bae341e0dc4eb5756d5315c20ddd4d72b5e57739f6b38c232a9a5975870f
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks QEMU agent state file 2 TTPs 2 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	848f9d51768421eb1154394b2ad32466.exe
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	848f9d51768421eb1154394b2ad32466.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1304	848f9d51768421eb1154394b2ad32466.exe
2576	848f9d51768421eb1154394b2ad32466.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 2576	1304	848f9d51768421eb1154394b2ad32466.exe	77

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1304	848f9d51768421eb1154394b2ad32466.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1304	848f9d51768421eb1154394b2ad32466.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2576	1304	848f9d51768421eb1154394b2ad32466.exe	77
PID 1304 wrote to memory of 2576	1304	848f9d51768421eb1154394b2ad32466.exe	77
PID 1304 wrote to memory of 2576	1304	848f9d51768421eb1154394b2ad32466.exe	77
PID 1304 wrote to memory of 2576	1304	848f9d51768421eb1154394b2ad32466.exe	77

C:\Users\Admin\AppData\Local\Temp\848f9d51768421eb1154394b2ad32466.exe
"C:\Users\Admin\AppData\Local\Temp\848f9d51768421eb1154394b2ad32466.exe"
1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\848f9d51768421eb1154394b2ad32466.exe
  "C:\Users\Admin\AppData\Local\Temp\848f9d51768421eb1154394b2ad32466.exe"
  2⤵
  - Checks QEMU agent state file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads