Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-09-2021 08:33
Static task
static1
Behavioral task
behavioral1
Sample
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe
Resource
win10v20210408
General
-
Target
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe
-
Size
112KB
-
MD5
547612a9ff746063a74c71b009230500
-
SHA1
c04b0adc612addc701e3a0336a4e8a23fbd331c4
-
SHA256
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a
-
SHA512
545b74192e076e46a960a05e5281dedfd00c7fc002aeec60f04f55543eb79beaa2866ab20e16903e2d1601275e28be73fa0a5ef5abe23fd2e13c38805cdd9402
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exepid process 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exebf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Loads dropped DLL 1 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exepid process 2868 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exebf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exepid process 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe 2868 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exedescription pid process target process PID 424 set thread context of 2868 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Drops file in Program Files directory 55 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exedescription ioc process File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Temp\GUM18A1.tmp\GOFB2B~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Drops file in Windows directory 1 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exedescription ioc process File opened for modification C:\Windows\svchost.com bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exepid process 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exepid process 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exebf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exedescription pid process target process PID 664 wrote to memory of 424 664 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe PID 664 wrote to memory of 424 664 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe PID 664 wrote to memory of 424 664 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe PID 424 wrote to memory of 2868 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe PID 424 wrote to memory of 2868 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe PID 424 wrote to memory of 2868 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe PID 424 wrote to memory of 2868 424 bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe"C:\Users\Admin\AppData\Local\Temp\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe"2⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\3582-490\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exe"3⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exeMD5
6ce7cc1f376f6bd9d090eaf04ef72dfe
SHA1fb2693061f91f2c9fa4480edac7cae0fa7602ec7
SHA2562e87815522531721634be2ef071b1292612fc7a8a07e785645c37eaf56e0a6e9
SHA5123d10aa247c8953d20a00af5d46e1e720a14967ff3306d9009c87c8c0754a5d6f924517882503e422513b54b51de0187769fa9f7c0abf3b3f773d5ef6243c2042
-
C:\Users\Admin\AppData\Local\Temp\3582-490\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exeMD5
6ce7cc1f376f6bd9d090eaf04ef72dfe
SHA1fb2693061f91f2c9fa4480edac7cae0fa7602ec7
SHA2562e87815522531721634be2ef071b1292612fc7a8a07e785645c37eaf56e0a6e9
SHA5123d10aa247c8953d20a00af5d46e1e720a14967ff3306d9009c87c8c0754a5d6f924517882503e422513b54b51de0187769fa9f7c0abf3b3f773d5ef6243c2042
-
C:\Users\Admin\AppData\Local\Temp\3582-490\bf99b231b81ab2ba895c0cbf395a5fdb5fc18d3465592150e365f31302c8250a.exeMD5
6ce7cc1f376f6bd9d090eaf04ef72dfe
SHA1fb2693061f91f2c9fa4480edac7cae0fa7602ec7
SHA2562e87815522531721634be2ef071b1292612fc7a8a07e785645c37eaf56e0a6e9
SHA5123d10aa247c8953d20a00af5d46e1e720a14967ff3306d9009c87c8c0754a5d6f924517882503e422513b54b51de0187769fa9f7c0abf3b3f773d5ef6243c2042
-
memory/424-119-0x0000000002340000-0x000000000234F000-memory.dmpFilesize
60KB
-
memory/424-114-0x0000000000000000-mapping.dmp
-
memory/424-125-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/424-126-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/424-124-0x00007FFAEC5A0000-0x00007FFAEC77B000-memory.dmpFilesize
1.9MB
-
memory/2868-120-0x000000000040135C-mapping.dmp
-
memory/2868-122-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/2868-123-0x0000000000401000-0x00000000004FD000-memory.dmpFilesize
1008KB
-
memory/2868-127-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/2868-129-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/2868-128-0x00007FFAEC5A0000-0x00007FFAEC77B000-memory.dmpFilesize
1.9MB