Overview

overview

10

Static

static

VAN DE WER...pg.exe

windows7-x64

10

VAN DE WER...pg.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2022 14:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VAN DE WERT - po240975_jpg.exe

  • Size

    445KB

  • MD5

    e5fdfc2e819712600c1cf79d4f274022

  • SHA1

    bc947ca0dc25f1ba54ccbe5a14d84f53f22feb9d

  • SHA256

    7c54b7d54c409f3eee45a1ed7e7eee5da5c0577c2fcf974defa989d75a9ef9aa

  • SHA512

    aec8f7481909206169cc7f51b6fb7747e214f237db71ba7ec523a495256179412a17eab91346e9d04b6c622743a4b7693b5bc64a6c3e0ece9f9b4b63c47ddf21

  • SSDEEP

    12288:SzgOyj6Yd/6W48bLL+NVkOb/wZKpYgIgfC:jOyvd/zLLAVkObosW

Score
10/10
guloaderdownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe
    "C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
      "C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
      2⤵
        PID:1440
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
        "C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
        2⤵
          PID:1340
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
          "C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
          2⤵
            PID:4704
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
            "C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
            2⤵
              PID:3724
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
              "C:\Users\Admin\AppData\Local\Temp\VAN DE WERT - po240975_jpg.exe"
              2⤵
              • Checks QEMU agent file
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:4740

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsfC73F.tmp\System.dll
            Filesize

            11KB

            MD5

            17ed1c86bd67e78ade4712be48a7d2bd

            SHA1

            1cc9fe86d6d6030b4dae45ecddce5907991c01a0

            SHA256

            bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

            SHA512

            0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

            Download Submit
          • memory/3992-145-0x0000000003350000-0x0000000003451000-memory.dmp
            Filesize

            1.0MB

            Download
          • memory/3992-133-0x0000000003350000-0x0000000003451000-memory.dmp
            Filesize

            1.0MB

            Download
          • memory/3992-134-0x0000000003350000-0x0000000003451000-memory.dmp
            Filesize

            1.0MB

            Download
          • memory/3992-135-0x00007FFBF3B70000-0x00007FFBF3D65000-memory.dmp
            Filesize

            2.0MB

            Download
          • memory/3992-136-0x0000000077380000-0x0000000077523000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/3992-137-0x0000000077380000-0x0000000077523000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/3992-146-0x0000000077380000-0x0000000077523000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4740-138-0x0000000000000000-mapping.dmp
            Download
          • memory/4740-141-0x00007FFBF3B70000-0x00007FFBF3D65000-memory.dmp
            Filesize

            2.0MB

            Download
          • memory/4740-142-0x0000000077380000-0x0000000077523000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4740-143-0x00007FFBF3B70000-0x00007FFBF3D65000-memory.dmp
            Filesize

            2.0MB

            Download
          • memory/4740-144-0x0000000077380000-0x0000000077523000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4740-140-0x0000000000D00000-0x0000000000E00000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/4740-139-0x0000000000D00000-0x0000000000E00000-memory.dmp
            Filesize

            1024KB

            Download