Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
08-02-2023 18:21
General
-
Target
78092b8a72d068f981f3db3edd29ac6b.exe
-
Size
955KB
-
MD5
78092b8a72d068f981f3db3edd29ac6b
-
SHA1
55b22dbfb28a63564b4f5d227e1ddfc144119846
-
SHA256
61878427cd1d8ae10265dc16cfa10444838db931e19429339fb5b7f44add7db4
-
SHA512
67d19190f7203140280a3fdeeb8d4ea0a511e8fa8449e320f67d0f589ff5bb4fda7c23171449b66698115b07e0ec00e73dc872809287ccc133cf0c5fe41f31ae
-
SSDEEP
24576:YuHL2plae9FplbpCsVQB2Qz8kSSyIrKcMB:telaeznVev8kJrKc2
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78092b8a72d068f981f3db3edd29ac6b.exe"C:\Users\Admin\AppData\Local\Temp\78092b8a72d068f981f3db3edd29ac6b.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\78092b8a72d068f981f3db3edd29ac6b.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsd9C48.tmp\System.dllFilesize
11KB
MD59625d5b1754bc4ff29281d415d27a0fd
SHA180e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA256c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
SHA512dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
-
memory/3532-141-0x0000000077A80000-0x0000000077C23000-memory.dmpFilesize
1.6MB
-
memory/3532-137-0x0000000000000000-mapping.dmp
-
memory/3532-138-0x0000000001200000-0x00000000032E4000-memory.dmpFilesize
32.9MB
-
memory/3532-140-0x00007FFB7C710000-0x00007FFB7C905000-memory.dmpFilesize
2.0MB
-
memory/3532-142-0x0000000001200000-0x00000000032E4000-memory.dmpFilesize
32.9MB
-
memory/3532-143-0x00007FFB7C710000-0x00007FFB7C905000-memory.dmpFilesize
2.0MB
-
memory/3532-144-0x0000000077A80000-0x0000000077C23000-memory.dmpFilesize
1.6MB
-
memory/4996-134-0x0000000004AF0000-0x0000000006BD4000-memory.dmpFilesize
32.9MB
-
memory/4996-135-0x00007FFB7C710000-0x00007FFB7C905000-memory.dmpFilesize
2.0MB
-
memory/4996-136-0x0000000077A80000-0x0000000077C23000-memory.dmpFilesize
1.6MB
-
memory/4996-139-0x0000000077A80000-0x0000000077C23000-memory.dmpFilesize
1.6MB
-
memory/4996-133-0x0000000004AF0000-0x0000000006BD4000-memory.dmpFilesize
32.9MB