Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-09-2021 07:32
Static task
static1
Behavioral task
behavioral1
Sample
Order List from Dunen Enterprise Corporation.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
Order List from Dunen Enterprise Corporation.exe
Resource
win10v20210408
General
-
Target
Order List from Dunen Enterprise Corporation.exe
-
Size
128KB
-
MD5
744d832006910318b2826e4cc8db4b11
-
SHA1
b58f485d5153dc4cb1a608091e1174d6fc966a4a
-
SHA256
e015835dd69bbd384cb9b347984b648562281ba9e532ca110b6962bce9262251
-
SHA512
2ef7a81389e03fe8cdaa42e39e9df842d811b87b97d50e915e01d8fa35e3eaa49f7aaa03aa5a534e3413a636d3bf011ff9774a4b5b2553fbecef24aa8425deb4
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
Order List from Dunen Enterprise Corporation.exeOrder List from Dunen Enterprise Corporation.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Order List from Dunen Enterprise Corporation.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Order List from Dunen Enterprise Corporation.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Order List from Dunen Enterprise Corporation.exeOrder List from Dunen Enterprise Corporation.exepid process 808 Order List from Dunen Enterprise Corporation.exe 3248 Order List from Dunen Enterprise Corporation.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order List from Dunen Enterprise Corporation.exedescription pid process target process PID 808 set thread context of 3248 808 Order List from Dunen Enterprise Corporation.exe Order List from Dunen Enterprise Corporation.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Order List from Dunen Enterprise Corporation.exepid process 808 Order List from Dunen Enterprise Corporation.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Order List from Dunen Enterprise Corporation.exepid process 808 Order List from Dunen Enterprise Corporation.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Order List from Dunen Enterprise Corporation.exedescription pid process target process PID 808 wrote to memory of 3248 808 Order List from Dunen Enterprise Corporation.exe Order List from Dunen Enterprise Corporation.exe PID 808 wrote to memory of 3248 808 Order List from Dunen Enterprise Corporation.exe Order List from Dunen Enterprise Corporation.exe PID 808 wrote to memory of 3248 808 Order List from Dunen Enterprise Corporation.exe Order List from Dunen Enterprise Corporation.exe PID 808 wrote to memory of 3248 808 Order List from Dunen Enterprise Corporation.exe Order List from Dunen Enterprise Corporation.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order List from Dunen Enterprise Corporation.exe"C:\Users\Admin\AppData\Local\Temp\Order List from Dunen Enterprise Corporation.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order List from Dunen Enterprise Corporation.exe"C:\Users\Admin\AppData\Local\Temp\Order List from Dunen Enterprise Corporation.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/808-116-0x0000000004A30000-0x0000000004A41000-memory.dmpFilesize
68KB
-
memory/808-117-0x00007FFA1CD60000-0x00007FFA1CF3B000-memory.dmpFilesize
1.9MB
-
memory/808-118-0x0000000077240000-0x00000000773CE000-memory.dmpFilesize
1.6MB
-
memory/808-122-0x0000000077240000-0x00000000773CE000-memory.dmpFilesize
1.6MB
-
memory/3248-119-0x0000000000401574-mapping.dmp
-
memory/3248-120-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/3248-121-0x0000000000401000-0x00000000004FD000-memory.dmpFilesize
1008KB
-
memory/3248-123-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/3248-125-0x0000000077240000-0x00000000773CE000-memory.dmpFilesize
1.6MB
-
memory/3248-124-0x00007FFA1CD60000-0x00007FFA1CF3B000-memory.dmpFilesize
1.9MB