3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f

Analysis

max time kernel
164s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
24/03/2022, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe
Size 463KB
Sample220324-vgvvsagdel
SHA256 3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f
MD5 a781a01bfff6c0648192f32cdcd2ebe8
SHA1 586d0bd97d1996749531127dd9a406aa186ae7ab
SHA512 ea925a413709f04443c92779f736a6bfcee0a0d6653709cf0fb952fde2d72f2fa7aa0880031bd3c3da396afab462b1c5b8492618ea9ab0ac6ec2b83e643c91d0
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 1 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe

Loads dropped DLL 2 IoCs

pid	Process
1532	3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe
1532	3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1532	3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe
"C:\Users\Admin\AppData\Local\Temp\3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-136-0x00007FFB5EB70000-0x00007FFB5ED65000-memory.dmp

Download

memory/1532-137-0x00000000779C0000-0x0000000077B63000-memory.dmp