Analysis
-
max time kernel
137s -
max time network
45s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 07:07
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and packing list.jpg.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Shipment Document BL,INV and packing list.jpg.exe
Resource
win10v20210408
General
-
Target
Shipment Document BL,INV and packing list.jpg.exe
-
Size
128KB
-
MD5
df2413a552334b77e540bb8c69bf9763
-
SHA1
453f88a44b3966a97fc4005a0b6edf894cdc8d41
-
SHA256
434e6827ed58ffd66a28619822626816559605a4e5d7c7cfe8770d3af043527d
-
SHA512
de9fdb8b874bc68820be7cd0421d23265fc8127b4ed274461f48fcdb9efd3b374a4900b8b6ed6e741ca1e965d9093f6a8b05dbed3989a6ac26c985cded212f9d
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
Shipment Document BL,INV and packing list.jpg.exeShipment Document BL,INV and packing list.jpg.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Shipment Document BL,INV and packing list.jpg.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Shipment Document BL,INV and packing list.jpg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exeShipment Document BL,INV and packing list.jpg.exepid process 1840 Shipment Document BL,INV and packing list.jpg.exe 1600 Shipment Document BL,INV and packing list.jpg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exedescription pid process target process PID 1840 set thread context of 1600 1840 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exepid process 1840 Shipment Document BL,INV and packing list.jpg.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exepid process 1840 Shipment Document BL,INV and packing list.jpg.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exedescription pid process target process PID 1840 wrote to memory of 1600 1840 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 1840 wrote to memory of 1600 1840 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 1840 wrote to memory of 1600 1840 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 1840 wrote to memory of 1600 1840 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 1840 wrote to memory of 1600 1840 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1600-65-0x0000000000401574-mapping.dmp
-
memory/1600-66-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/1600-70-0x00000000001B0000-0x00000000002B0000-memory.dmpFilesize
1024KB
-
memory/1600-73-0x00000000777B0000-0x0000000077959000-memory.dmpFilesize
1.7MB
-
memory/1840-62-0x0000000000360000-0x0000000000371000-memory.dmpFilesize
68KB
-
memory/1840-64-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/1840-67-0x00000000777B0000-0x0000000077959000-memory.dmpFilesize
1.7MB
-
memory/1840-68-0x0000000077990000-0x0000000077B10000-memory.dmpFilesize
1.5MB
-
memory/1840-69-0x00000000779A0000-0x0000000077A76000-memory.dmpFilesize
856KB