Analysis
-
max time kernel
582s -
max time network
407s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 18:53
Static task
static1
Behavioral task
behavioral1
Sample
hypoc.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
hypoc.exe
Resource
win10-en-20210920
General
-
Target
hypoc.exe
-
Size
104KB
-
MD5
916c42dbafbbaa9d7f5208494710c354
-
SHA1
952c4314cadc08ca01a1227e999f645c12760aeb
-
SHA256
5eab33aa65a63135b926cad2766fd657c092c2704cc5155462d119053285cda8
-
SHA512
0d95757ba0bacc5bd43a58048afb66c74b07d5252ce99e78efa0f1fbe7da4baa3e5e3adf1d53422ba9225a3ea1a2a40a1083fed69b6220132d28bf8f840fef61
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
hypoc.exeieinstal.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe hypoc.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ieinstal.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run ieinstal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Afstig2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\muml\\hypoc.exe" ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
hypoc.exeieinstal.exepid process 3704 hypoc.exe 4180 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hypoc.exedescription pid process target process PID 3704 set thread context of 4180 3704 hypoc.exe ieinstal.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4604 4180 WerFault.exe ieinstal.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe 4604 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
hypoc.exepid process 3704 hypoc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4604 WerFault.exe Token: SeBackupPrivilege 4604 WerFault.exe Token: SeDebugPrivilege 4604 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
hypoc.exepid process 3704 hypoc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
hypoc.exedescription pid process target process PID 3704 wrote to memory of 4180 3704 hypoc.exe ieinstal.exe PID 3704 wrote to memory of 4180 3704 hypoc.exe ieinstal.exe PID 3704 wrote to memory of 4180 3704 hypoc.exe ieinstal.exe PID 3704 wrote to memory of 4180 3704 hypoc.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hypoc.exe"C:\Users\Admin\AppData\Local\Temp\hypoc.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\hypoc.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 16963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3704-117-0x0000000002190000-0x000000000219F000-memory.dmpFilesize
60KB
-
memory/3704-121-0x00000000772D0000-0x000000007745E000-memory.dmpFilesize
1.6MB
-
memory/3704-122-0x00000000772D0000-0x000000007745E000-memory.dmpFilesize
1.6MB
-
memory/3704-120-0x00007FFC161A0000-0x00007FFC1637B000-memory.dmpFilesize
1.9MB
-
memory/4180-118-0x0000000002EB0000-0x0000000002FB0000-memory.dmpFilesize
1024KB
-
memory/4180-119-0x0000000002EB0000-mapping.dmp
-
memory/4180-124-0x00000000772D0000-0x000000007745E000-memory.dmpFilesize
1.6MB
-
memory/4180-125-0x00000000772D0000-0x000000007745E000-memory.dmpFilesize
1.6MB
-
memory/4180-123-0x00007FFC161A0000-0x00007FFC1637B000-memory.dmpFilesize
1.9MB