Analysis
- max time kernel
126s - max time network
87s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
15/02/2022, 19:21
General
- Target AudioAppZEXAQQHUTE.exe
- Size 352KB
- Sample220215-x2m2saaffl
- SHA256 b57d7de33914f91073e29ac243cc026716b4b4a2ffd3ad9235e407c73fdb4be8
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AudioAppZEXAQQHUTE.exe"C:\Users\Admin\AppData\Local\Temp\AudioAppZEXAQQHUTE.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AudioAppZEXAQQHUTE.exe"C:\Users\Admin\AppData\Local\Temp\AudioAppZEXAQQHUTE.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1728-131-0x0000000004190000-0x0000000004290000-memory.dmp
memory/1728-135-0x00007FFEA9171000-0x00007FFEA928A000-memory.dmp
memory/1728-136-0x0000000077981000-0x0000000077AA1000-memory.dmp
memory/3692-137-0x0000000000400000-0x0000000001654000-memory.dmp
memory/3692-138-0x0000000001660000-0x0000000001760000-memory.dmp
memory/3692-140-0x0000000000431000-0x0000000000432000-memory.dmp
memory/3692-139-0x0000000000430000-0x0000000000431000-memory.dmp
memory/3692-142-0x0000000000435000-0x0000000000436000-memory.dmp
memory/3692-141-0x0000000000452000-0x0000000000453000-memory.dmp
memory/3692-143-0x0000000000436000-0x0000000000437000-memory.dmp
memory/3692-144-0x000000000040E000-0x000000000040F000-memory.dmp
memory/3692-146-0x000000000044B000-0x000000000044C000-memory.dmp
memory/3692-145-0x000000000043F000-0x0000000000440000-memory.dmp
memory/3692-148-0x0000000000438000-0x0000000000439000-memory.dmp
memory/3692-147-0x000000000043E000-0x000000000043F000-memory.dmp
memory/3692-149-0x0000000000444000-0x0000000000445000-memory.dmp
memory/3692-150-0x0000000000403000-0x0000000000404000-memory.dmp
memory/3692-151-0x0000000000441000-0x0000000000442000-memory.dmp
memory/3692-152-0x0000000000443000-0x0000000000444000-memory.dmp
memory/3692-154-0x0000000000442000-0x0000000000443000-memory.dmp
memory/3692-153-0x000000000044C000-0x000000000044D000-memory.dmp
memory/3692-156-0x000000000044A000-0x000000000044B000-memory.dmp
memory/3692-155-0x0000000000445000-0x0000000000446000-memory.dmp
memory/3692-158-0x0000000000453000-0x0000000000454000-memory.dmp
memory/3692-157-0x0000000000433000-0x0000000000434000-memory.dmp
memory/3692-160-0x000000000040D000-0x000000000040E000-memory.dmp
memory/3692-159-0x0000000000432000-0x0000000000433000-memory.dmp
memory/3692-162-0x000000000044E000-0x000000000044F000-memory.dmp
memory/3692-161-0x000000000040B000-0x000000000040C000-memory.dmp
memory/3692-164-0x000000000043D000-0x000000000043E000-memory.dmp
memory/3692-163-0x0000000000440000-0x0000000000441000-memory.dmp
memory/3692-166-0x0000000000439000-0x000000000043A000-memory.dmp
memory/3692-165-0x0000000000411000-0x0000000000412000-memory.dmp
memory/3692-168-0x0000000000451000-0x0000000000452000-memory.dmp
memory/3692-167-0x0000000000448000-0x0000000000449000-memory.dmp
memory/3692-170-0x0000000000402000-0x0000000000403000-memory.dmp
memory/3692-169-0x0000000000401000-0x0000000000402000-memory.dmp
memory/3692-172-0x0000000000418000-0x0000000000419000-memory.dmp
memory/3692-171-0x0000000000404000-0x0000000000405000-memory.dmp
memory/3692-173-0x0000000000405000-0x0000000000406000-memory.dmp
memory/3692-174-0x0000000000408000-0x0000000000409000-memory.dmp
memory/3692-175-0x000000000040C000-0x000000000040D000-memory.dmp
memory/3692-176-0x0000000000417000-0x0000000000418000-memory.dmp
memory/3692-178-0x0000000000407000-0x0000000000408000-memory.dmp
memory/3692-177-0x0000000000419000-0x000000000041A000-memory.dmp
memory/3692-179-0x0000000000406000-0x0000000000407000-memory.dmp
memory/3692-180-0x0000000000434000-0x0000000000435000-memory.dmp
memory/3692-181-0x000000000041A000-0x000000000041B000-memory.dmp
memory/3692-184-0x000000000042D000-0x000000000042E000-memory.dmp
memory/3692-183-0x000000000041F000-0x0000000000420000-memory.dmp
memory/3692-182-0x0000000000421000-0x0000000000422000-memory.dmp
memory/3692-186-0x000000000041B000-0x000000000041C000-memory.dmp
memory/3692-187-0x0000000000414000-0x0000000000415000-memory.dmp
memory/3692-189-0x0000000000409000-0x000000000040A000-memory.dmp
memory/3692-190-0x0000000000437000-0x0000000000438000-memory.dmp
memory/3692-188-0x0000000000410000-0x0000000000411000-memory.dmp
memory/3692-185-0x000000000042E000-0x000000000042F000-memory.dmp
memory/3692-191-0x0000000000412000-0x0000000000413000-memory.dmp
memory/3692-192-0x000000000041D000-0x000000000041E000-memory.dmp
memory/3692-194-0x000000000042F000-0x0000000000430000-memory.dmp
memory/3692-193-0x0000000000420000-0x0000000000421000-memory.dmp
memory/3692-195-0x000000000041E000-0x000000000041F000-memory.dmp
memory/3692-196-0x0000000000424000-0x0000000000425000-memory.dmp
memory/3692-197-0x0000000000427000-0x0000000000428000-memory.dmp
memory/3692-198-0x0000000000425000-0x0000000000426000-memory.dmp
memory/5036-132-0x00000205CF760000-0x00000205CF770000-memory.dmp
memory/5036-133-0x00000205CFD20000-0x00000205CFD30000-memory.dmp
memory/5036-134-0x00000205D23C0000-0x00000205D23C4000-memory.dmp