Analysis
-
max time kernel
147s -
max time network
195s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 10:56
Static task
static1
Behavioral task
behavioral1
Sample
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe
Resource
win10v20210408
General
-
Target
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe
-
Size
293KB
-
MD5
f3ec2ac5f8cd8dfb46f3a4d14acc4c84
-
SHA1
45cc84a525944b49a77bb693e2cc6f9e38e7d27c
-
SHA256
de2346e7683a4ed34d62a2954a38949335e6c1b27085a1cc82c08b0c6aec514e
-
SHA512
890a5881861259344ae46ac43edffaf86a203604175da1c85b6b5964c61b9dff7b68d7c5191689913ac9adb11332b7c085ac5ca317124bea309641e7a702cbc3
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
ieinstal.exeSerfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ieinstal.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run ieinstal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\erelong = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tusindbenets\\FORFJAMSKETS.exe" ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exeieinstal.exepid process 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe 612 ieinstal.exe 612 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exedescription pid process target process PID 1208 set thread context of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exepid process 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exeieinstal.exepid process 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe 612 ieinstal.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exeieinstal.execmd.exedescription pid process target process PID 1208 wrote to memory of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 1208 wrote to memory of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 1208 wrote to memory of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 1208 wrote to memory of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 1208 wrote to memory of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 1208 wrote to memory of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 1208 wrote to memory of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 1208 wrote to memory of 612 1208 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 612 wrote to memory of 1680 612 ieinstal.exe cmd.exe PID 612 wrote to memory of 1680 612 ieinstal.exe cmd.exe PID 612 wrote to memory of 1680 612 ieinstal.exe cmd.exe PID 612 wrote to memory of 1680 612 ieinstal.exe cmd.exe PID 1680 wrote to memory of 1656 1680 cmd.exe reg.exe PID 1680 wrote to memory of 1656 1680 cmd.exe reg.exe PID 1680 wrote to memory of 1656 1680 cmd.exe reg.exe PID 1680 wrote to memory of 1656 1680 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe"C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-79-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-64-0x0000000000090000-0x0000000000190000-memory.dmpFilesize
1024KB
-
memory/612-78-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-65-0x0000000000090000-mapping.dmp
-
memory/612-92-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-91-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-90-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-72-0x0000000077730000-0x0000000077806000-memory.dmpFilesize
856KB
-
memory/612-71-0x0000000077540000-0x00000000776E9000-memory.dmpFilesize
1.7MB
-
memory/612-73-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-76-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-75-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-77-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-80-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-93-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-89-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-74-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-81-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-88-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-87-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-85-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-84-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/612-86-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/1208-63-0x0000000076661000-0x0000000076663000-memory.dmpFilesize
8KB
-
memory/1208-66-0x0000000077540000-0x00000000776E9000-memory.dmpFilesize
1.7MB
-
memory/1208-68-0x0000000077730000-0x0000000077806000-memory.dmpFilesize
856KB
-
memory/1208-67-0x0000000077720000-0x00000000778A0000-memory.dmpFilesize
1.5MB
-
memory/1208-61-0x00000000003E0000-0x00000000003F6000-memory.dmpFilesize
88KB
-
memory/1656-83-0x0000000000000000-mapping.dmp
-
memory/1680-82-0x0000000000000000-mapping.dmp