Analysis
-
max time kernel
89s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 18:35
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENT.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SHIPPING DOCUMENT.scr
Resource
win10v2004-20220414-en
General
-
Target
SHIPPING DOCUMENT.scr
-
Size
84KB
-
MD5
413d2dbeb92babc91dee4688dff52642
-
SHA1
0efb2c7c544d774709504c94bb4cdc469ff8e367
-
SHA256
08954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
-
SHA512
9a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
Malware Config
Extracted
guloader
https://drive.google.com/uc?export=download&id=1_oth8C6SFfuRuHZpRwX3CHrHvH7H3Cwv
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Executes dropped EXE 1 IoCs
Processes:
Tipbartsl.scrpid process 4788 Tipbartsl.scr -
Checks QEMU agent state file 2 TTPs 4 IoCs
Checks state file used by QEMU agent, possibly to detect virtualization.
Processes:
SHIPPING DOCUMENT.scrSHIPPING DOCUMENT.scrTipbartsl.scrTipbartsl.scrdescription ioc process File opened (read-only) C:\ProgramData\qemu-ga\qga.state SHIPPING DOCUMENT.scr File opened (read-only) C:\ProgramData\qemu-ga\qga.state SHIPPING DOCUMENT.scr File opened (read-only) C:\ProgramData\qemu-ga\qga.state Tipbartsl.scr File opened (read-only) C:\ProgramData\qemu-ga\qga.state Tipbartsl.scr -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SHIPPING DOCUMENT.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation SHIPPING DOCUMENT.scr -
Loads dropped DLL 1 IoCs
Processes:
Tipbartsl.scrpid process 4772 Tipbartsl.scr -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
SHIPPING DOCUMENT.scrTipbartsl.scrdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce SHIPPING DOCUMENT.scr Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Disas = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SCAP\\Tipbartsl.vbs" SHIPPING DOCUMENT.scr Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce Tipbartsl.scr Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Disas = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SCAP\\Tipbartsl.vbs" Tipbartsl.scr -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
SHIPPING DOCUMENT.scrSHIPPING DOCUMENT.scrTipbartsl.scrTipbartsl.scrpid process 4328 SHIPPING DOCUMENT.scr 4648 SHIPPING DOCUMENT.scr 4788 Tipbartsl.scr 4772 Tipbartsl.scr -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SHIPPING DOCUMENT.scrTipbartsl.scrdescription pid process target process PID 4328 set thread context of 4648 4328 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 4788 set thread context of 4772 4788 Tipbartsl.scr Tipbartsl.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
SHIPPING DOCUMENT.scrTipbartsl.scrpid process 4328 SHIPPING DOCUMENT.scr 4788 Tipbartsl.scr -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
SHIPPING DOCUMENT.scrTipbartsl.scrpid process 4328 SHIPPING DOCUMENT.scr 4788 Tipbartsl.scr -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
SHIPPING DOCUMENT.scrSHIPPING DOCUMENT.scrTipbartsl.scrdescription pid process target process PID 4328 wrote to memory of 4648 4328 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 4328 wrote to memory of 4648 4328 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 4328 wrote to memory of 4648 4328 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 4328 wrote to memory of 4648 4328 SHIPPING DOCUMENT.scr SHIPPING DOCUMENT.scr PID 4648 wrote to memory of 4788 4648 SHIPPING DOCUMENT.scr Tipbartsl.scr PID 4648 wrote to memory of 4788 4648 SHIPPING DOCUMENT.scr Tipbartsl.scr PID 4648 wrote to memory of 4788 4648 SHIPPING DOCUMENT.scr Tipbartsl.scr PID 4788 wrote to memory of 4772 4788 Tipbartsl.scr Tipbartsl.scr PID 4788 wrote to memory of 4772 4788 Tipbartsl.scr Tipbartsl.scr PID 4788 wrote to memory of 4772 4788 Tipbartsl.scr Tipbartsl.scr PID 4788 wrote to memory of 4772 4788 Tipbartsl.scr Tipbartsl.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.scr"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.scr" /S1⤵
- Checks QEMU agent state file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.scr"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.scr" /S2⤵
- Checks QEMU agent state file
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scr"C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scr" /S3⤵
- Executes dropped EXE
- Checks QEMU agent state file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scr"C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scr" /S4⤵
- Checks QEMU agent state file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
C:\Users\Admin\AppData\Local\Temp\SCAP\Tipbartsl.scrFilesize
84KB
MD5413d2dbeb92babc91dee4688dff52642
SHA10efb2c7c544d774709504c94bb4cdc469ff8e367
SHA25608954829f50d1aade435fefd5e50e2aee86283ab378a54243892152eded51db8
SHA5129a443289dc15e13993e41412fd8461bd207912a92cc71d79c88be59b8eea572525bb7d9469d9c739b967513b69467d71ef4a68ee51aa4e41f3e8147856aa4f59
-
memory/4328-138-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/4328-133-0x00007FFD6AC30000-0x00007FFD6AE25000-memory.dmpFilesize
2.0MB
-
memory/4328-132-0x00000000021D0000-0x00000000021DD000-memory.dmpFilesize
52KB
-
memory/4648-135-0x0000000000400000-0x000000000055D000-memory.dmpFilesize
1.4MB
-
memory/4648-140-0x00007FFD6AC30000-0x00007FFD6AE25000-memory.dmpFilesize
2.0MB
-
memory/4648-141-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/4648-142-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/4648-139-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/4648-137-0x0000000000401000-0x0000000000506000-memory.dmpFilesize
1.0MB
-
memory/4648-134-0x0000000000000000-mapping.dmp
-
memory/4772-150-0x0000000000000000-mapping.dmp
-
memory/4772-156-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/4772-157-0x00007FFD6AC30000-0x00007FFD6AE25000-memory.dmpFilesize
2.0MB
-
memory/4772-158-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB
-
memory/4788-149-0x00007FFD6AC30000-0x00007FFD6AE25000-memory.dmpFilesize
2.0MB
-
memory/4788-148-0x00000000005F0000-0x00000000005FD000-memory.dmpFilesize
52KB
-
memory/4788-143-0x0000000000000000-mapping.dmp
-
memory/4788-154-0x0000000077DD0000-0x0000000077F73000-memory.dmpFilesize
1.6MB