Analysis
-
max time kernel
290s -
max time network
303s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
08-02-2023 02:25
Static task
static1
Behavioral task
behavioral1
Sample
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe
Resource
win10-20220901-en
General
-
Target
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe
-
Size
390KB
-
MD5
2469f8893f0b33e769b1a8cdb84baa57
-
SHA1
d64d31c1312ce383bcfe24714309a1bd0fa63067
-
SHA256
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8
-
SHA512
af1fdd170170f1b59571d1a4a5b2d8cc66bb002c76eaa92ea540591a18a0225d47a6015cf94976edb544de96625c0eebd54f39ddb401d9fc024026f2773e40ad
-
SSDEEP
6144:wY2Celn4yXJReJ9hoFVZv/qeYDPM17by0A3J2V5eIU2k1XziFLq+E:3yXJM5oFVZv/rKMbyDgVxsF
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe -
Loads dropped DLL 1 IoCs
Processes:
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exepid process 520 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
Processes:
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Vehikel\Unitternes.ini 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exepid process 520 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe 1996 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exedescription pid process target process PID 520 set thread context of 1996 520 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe -
Drops file in Windows directory 1 IoCs
Processes:
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exedescription ioc process File opened for modification C:\Windows\Wiros\Slippages\Propyls.ini 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exepid process 520 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exedescription pid process target process PID 520 wrote to memory of 1996 520 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe PID 520 wrote to memory of 1996 520 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe PID 520 wrote to memory of 1996 520 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe PID 520 wrote to memory of 1996 520 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe 48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe"C:\Users\Admin\AppData\Local\Temp\48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe"C:\Users\Admin\AppData\Local\Temp\48b07fec2d947bc75df7b3f4af67f51ceeb1a5956097442d9bafc7ee027237e8.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1996
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nstAA8E.tmp\System.dllFilesize
11KB
MD5b8992e497d57001ddf100f9c397fcef5
SHA1e26ddf101a2ec5027975d2909306457c6f61cfbd
SHA25698bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
SHA5128823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c
-
memory/520-120-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-121-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-122-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-123-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-124-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-125-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-126-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-127-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-128-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-129-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-130-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-131-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-132-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-133-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-134-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-135-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-137-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-136-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-138-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-139-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-140-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-141-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-142-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-143-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-144-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-145-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-146-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-147-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-148-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-149-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-150-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-151-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-152-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-153-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-154-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-155-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-156-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-157-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-158-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-159-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-160-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-161-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-162-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-164-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-163-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-165-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-166-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-167-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-168-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-169-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-170-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-171-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-173-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-174-0x0000000005140000-0x0000000005BCD000-memory.dmpFilesize
10.6MB
-
memory/520-175-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-176-0x0000000005140000-0x0000000005BCD000-memory.dmpFilesize
10.6MB
-
memory/520-177-0x00007FF8FE8F0000-0x00007FF8FEACB000-memory.dmpFilesize
1.9MB
-
memory/520-178-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-179-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-180-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-181-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-185-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/1996-182-0x00000000004030D9-mapping.dmp
-
memory/1996-183-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/1996-184-0x0000000000400000-0x0000000001783000-memory.dmpFilesize
19.5MB
-
memory/1996-187-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/1996-189-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/1996-188-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/1996-190-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/1996-208-0x0000000001790000-0x000000000221D000-memory.dmpFilesize
10.6MB
-
memory/1996-210-0x0000000001790000-0x000000000221D000-memory.dmpFilesize
10.6MB
-
memory/1996-211-0x00007FF8FE8F0000-0x00007FF8FEACB000-memory.dmpFilesize
1.9MB
-
memory/1996-222-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/1996-254-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB