Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 10:36
Static task
static1
Behavioral task
behavioral1
Sample
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe
Resource
win10v2004-20220812-en
General
-
Target
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe
-
Size
689KB
-
MD5
ceba3a31aeda8eea8efc26bb787ec690
-
SHA1
b3a8b39e8438984ba680fe597df728940ed09a66
-
SHA256
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406
-
SHA512
139ce4a7e0fc91450beb6ab7a29711081db0e033902b5c385bc6408e65dbbcbd35e0621bdd4c2010ff15e91a818311f314d4f15e8f5d636e9d9994f3922a7e5f
-
SSDEEP
12288:2cMkhWAEQ0J6rpEretKUjQ0kKSMtpSe2Tahcjd/1FhUxsBPGtVppPNF:czQ0J+EreVFkKSekehm/1FuxsetrhX
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
caspol.exe1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe caspol.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe -
Loads dropped DLL 1 IoCs
Processes:
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exepid process 3836 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.execaspol.exepid process 3836 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe 4708 caspol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exedescription pid process target process PID 3836 set thread context of 4708 3836 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe caspol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exepid process 3836 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exedescription pid process target process PID 3836 wrote to memory of 4708 3836 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe caspol.exe PID 3836 wrote to memory of 4708 3836 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe caspol.exe PID 3836 wrote to memory of 4708 3836 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe caspol.exe PID 3836 wrote to memory of 4708 3836 1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe caspol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe"C:\Users\Admin\AppData\Local\Temp\1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Users\Admin\AppData\Local\Temp\1430fc7b02d27de2472ec82b085e6c12a1c9a236bf9f10607d39cff2cfcf3406.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsq7C89.tmp\System.dllFilesize
12KB
MD58cf2ac271d7679b1d68eefc1ae0c5618
SHA17cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA2566950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
-
memory/3836-133-0x0000000003280000-0x0000000004A06000-memory.dmpFilesize
23.5MB
-
memory/3836-134-0x0000000003280000-0x0000000004A06000-memory.dmpFilesize
23.5MB
-
memory/3836-135-0x00007FF93BAB0000-0x00007FF93BCA5000-memory.dmpFilesize
2.0MB
-
memory/3836-137-0x0000000077CF0000-0x0000000077E93000-memory.dmpFilesize
1.6MB
-
memory/4708-136-0x0000000000000000-mapping.dmp
-
memory/4708-138-0x0000000001300000-0x0000000002A86000-memory.dmpFilesize
23.5MB
-
memory/4708-139-0x00007FF93BAB0000-0x00007FF93BCA5000-memory.dmpFilesize
2.0MB
-
memory/4708-140-0x0000000001300000-0x0000000002A86000-memory.dmpFilesize
23.5MB
-
memory/4708-141-0x0000000077CF0000-0x0000000077E93000-memory.dmpFilesize
1.6MB
-
memory/4708-142-0x00007FF93BAB0000-0x00007FF93BCA5000-memory.dmpFilesize
2.0MB
-
memory/4708-143-0x0000000077CF0000-0x0000000077E93000-memory.dmpFilesize
1.6MB