Analysis
-
max time kernel
149s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:35
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENT.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SHIPPING DOCUMENT.scr
Resource
win10v2004-20220414-en
General
-
Target
SHIPPING DOCUMENT.scr
-
Size
84KB
-
MD5
413d2dbeb92babc91dee4688dff52642
-
SHA1
0efb2c7c544d774709504c94bb4cdc469ff8e367
-
SHA256
08954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
-
SHA512
9a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
Malware Config
Extracted
guloader
https://drive.google.com/uc?export=download&id=1_oth8C6SFfuRuHZpRwX3CHrHvH7H3Cwv
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Executes dropped EXE 1 IoCs
Processes:
Tipbartsl.scrpid process 2028 Tipbartsl.scr -
Checks QEMU agent state file 2 TTPs 4 IoCs
Checks state file used by QEMU agent, possibly to detect virtualization.
Processes:
SHIPPING DOCUMENT.scrSHIPPING DOCUMENT.scrTipbartsl.scrTipbartsl.scrdescription ioc process File opened (read-only) C:\ProgramData\qemu-ga\qga.state SHIPPING DOCUMENT.scr File opened (read-only) C:\ProgramData\qemu-ga\qga.state SHIPPING DOCUMENT.scr File opened (read-only) C:\ProgramData\qemu-ga\qga.state Tipbartsl.scr File opened (read-only) C:\ProgramData\qemu-ga\qga.state Tipbartsl.scr -
Loads dropped DLL 4 IoCs
Processes:
SHIPPING DOCUMENT.scrTipbartsl.scrTipbartsl.scrpid process 2040 SHIPPING DOCUMENT.scr 2040 SHIPPING DOCUMENT.scr 2028 Tipbartsl.scr 1872 Tipbartsl.scr -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Tipbartsl.scrSHIPPING DOCUMENT.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Disas = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SCAP\\Tipbartsl.vbs" Tipbartsl.scr Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce SHIPPING DOCUMENT.scr Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Disas = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SCAP\\Tipbartsl.vbs" SHIPPING DOCUMENT.scr Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce Tipbartsl.scr -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
SHIPPING DOCUMENT.scrSHIPPING DOCUMENT.scrTipbartsl.scrTipbartsl.scrpid process 1468 SHIPPING DOCUMENT.scr 2040 SHIPPING DOCUMENT.scr 2028 Tipbartsl.scr 1872 Tipbartsl.scr -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SHIPPING DOCUMENT.scrTipbartsl.scrdescription pid process target process PID 1468 set thread context of 2040 1468 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 2028 set thread context of 1872 2028 Tipbartsl.scr Tipbartsl.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
SHIPPING DOCUMENT.scrTipbartsl.scrpid process 1468 SHIPPING DOCUMENT.scr 2028 Tipbartsl.scr -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
SHIPPING DOCUMENT.scrTipbartsl.scrpid process 1468 SHIPPING DOCUMENT.scr 2028 Tipbartsl.scr -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SHIPPING DOCUMENT.scrSHIPPING DOCUMENT.scrTipbartsl.scrdescription pid process target process PID 1468 wrote to memory of 2040 1468 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 1468 wrote to memory of 2040 1468 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 1468 wrote to memory of 2040 1468 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 1468 wrote to memory of 2040 1468 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 1468 wrote to memory of 2040 1468 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 2040 wrote to memory of 2028 2040 SHIPPING DOCUMENT.scr Tipbartsl.scr PID 2040 wrote to memory of 2028 2040 SHIPPING DOCUMENT.scr Tipbartsl.scr PID 2040 wrote to memory of 2028 2040 SHIPPING DOCUMENT.scr Tipbartsl.scr PID 2040 wrote to memory of 2028 2040 SHIPPING DOCUMENT.scr Tipbartsl.scr PID 2028 wrote to memory of 1872 2028 Tipbartsl.scr Tipbartsl.scr PID 2028 wrote to memory of 1872 2028 Tipbartsl.scr Tipbartsl.scr PID 2028 wrote to memory of 1872 2028 Tipbartsl.scr Tipbartsl.scr PID 2028 wrote to memory of 1872 2028 Tipbartsl.scr Tipbartsl.scr PID 2028 wrote to memory of 1872 2028 Tipbartsl.scr Tipbartsl.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.scr"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.scr" /S1⤵
- Checks QEMU agent state file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.scr"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.scr" /S2⤵
- Checks QEMU agent state file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scr"C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scr" /S3⤵
- Executes dropped EXE
- Checks QEMU agent state file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scr"C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scr" /S4⤵
- Checks QEMU agent state file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
memory/1468-57-0x0000000077BA0000-0x0000000077D49000-memory.dmpFilesize
1.7MB
-
memory/1468-59-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1468-62-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/1468-56-0x00000000001D0000-0x00000000001DD000-memory.dmpFilesize
52KB
-
memory/1872-80-0x00000000004015B0-mapping.dmp
-
memory/1872-87-0x00000000001B0000-0x00000000002B0000-memory.dmpFilesize
1024KB
-
memory/1872-88-0x0000000077BA0000-0x0000000077D49000-memory.dmpFilesize
1.7MB
-
memory/1872-91-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/2028-71-0x0000000000000000-mapping.dmp
-
memory/2028-84-0x0000000000240000-0x000000000024D000-memory.dmpFilesize
52KB
-
memory/2028-85-0x0000000077BA0000-0x0000000077D49000-memory.dmpFilesize
1.7MB
-
memory/2028-86-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/2040-75-0x0000000077D80000-0x0000000077F00000-memory.dmpFilesize
1.5MB
-
memory/2040-65-0x0000000077BA0000-0x0000000077D49000-memory.dmpFilesize
1.7MB
-
memory/2040-64-0x00000000001B0000-0x00000000002B0000-memory.dmpFilesize
1024KB
-
memory/2040-61-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/2040-60-0x00000000004015B0-mapping.dmp