Overview

overview

10

Static

static

0a42672ca9...37.exe

windows7-x64

10

0a42672ca9...37.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2023 03:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe

  • Size

    1.3MB

  • MD5

    c57990d44e934775deb9fec1dfe4985f

  • SHA1

    94353ec497c61edf40af619df3597e2c4cd25add

  • SHA256

    0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37

  • SHA512

    6d32f9803c62b901667025b98a16bbb4e7d5cf29f03f396ca335905a5d55c607f51bc5dd68cbc316ce9cdbee5060d6024ca0d15bc741560a140dd8cd4b533c93

  • SSDEEP

    24576:qut3xb/w8FHrbRhK2537ZQ9JR3uYfYsl3yNStYKc1pMZpDoGhi8+fAO/s8Cnv:rFLO237ZW4YfYslistYHrMNiN5s3v

Score
10/10
guloaderdiscoverydownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe
    "C:\Users\Admin\AppData\Local\Temp\0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
      "C:\Users\Admin\AppData\Local\Temp\0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe"
      2⤵
        PID:1576
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
        "C:\Users\Admin\AppData\Local\Temp\0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe"
        2⤵
          PID:1060
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
          "C:\Users\Admin\AppData\Local\Temp\0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe"
          2⤵
            PID:4464
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
            "C:\Users\Admin\AppData\Local\Temp\0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe"
            2⤵
              PID:1912
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
              "C:\Users\Admin\AppData\Local\Temp\0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe"
              2⤵
                PID:4520
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
                "C:\Users\Admin\AppData\Local\Temp\0a42672ca92fc042efc43ed753c21bf10d56d1a2b2cd03928ea55ff3eb2d7b37.exe"
                2⤵
                • Checks QEMU agent file
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:404

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Persistence

            Privilege Escalation

            Defense Evasion

            Credential Access

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\nsq7D26.tmp\System.dll
              Filesize

              11KB

              MD5

              75ed96254fbf894e42058062b4b4f0d1

              SHA1

              996503f1383b49021eb3427bc28d13b5bbd11977

              SHA256

              a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

              SHA512

              58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

              Download Submit
            • memory/404-137-0x0000000000000000-mapping.dmp
              Download
            • memory/404-139-0x0000000001230000-0x0000000001330000-memory.dmp
              Filesize

              1024KB

              Download
            • memory/404-140-0x0000000001230000-0x0000000001330000-memory.dmp
              Filesize

              1024KB

              Download
            • memory/404-141-0x00007FF93BAB0000-0x00007FF93BCA5000-memory.dmp
              Filesize

              2.0MB

              Download
            • memory/404-142-0x0000000077CF0000-0x0000000077E93000-memory.dmp
              Filesize

              1.6MB

              Download
            • memory/2236-133-0x00000000049A0000-0x0000000004AA1000-memory.dmp
              Filesize

              1.0MB

              Download
            • memory/2236-134-0x00000000049A0000-0x0000000004AA1000-memory.dmp
              Filesize

              1.0MB

              Download
            • memory/2236-135-0x00007FF93BAB0000-0x00007FF93BCA5000-memory.dmp
              Filesize

              2.0MB

              Download
            • memory/2236-136-0x0000000077CF0000-0x0000000077E93000-memory.dmp
              Filesize

              1.6MB

              Download
            • memory/2236-138-0x0000000077CF0000-0x0000000077E93000-memory.dmp
              Filesize

              1.6MB

              Download
            • memory/2236-143-0x00000000049A0000-0x0000000004AA1000-memory.dmp
              Filesize

              1.0MB

              Download