Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 18:22
Static task
static1
Behavioral task
behavioral1
Sample
78092b8a72d068f981f3db3edd29ac6b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
78092b8a72d068f981f3db3edd29ac6b.exe
Resource
win10v2004-20221111-en
General
-
Target
78092b8a72d068f981f3db3edd29ac6b.exe
-
Size
955KB
-
MD5
78092b8a72d068f981f3db3edd29ac6b
-
SHA1
55b22dbfb28a63564b4f5d227e1ddfc144119846
-
SHA256
61878427cd1d8ae10265dc16cfa10444838db931e19429339fb5b7f44add7db4
-
SHA512
67d19190f7203140280a3fdeeb8d4ea0a511e8fa8449e320f67d0f589ff5bb4fda7c23171449b66698115b07e0ec00e73dc872809287ccc133cf0c5fe41f31ae
-
SSDEEP
24576:YuHL2plae9FplbpCsVQB2Qz8kSSyIrKcMB:telaeznVev8kJrKc2
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
ieinstal.exe78092b8a72d068f981f3db3edd29ac6b.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 78092b8a72d068f981f3db3edd29ac6b.exe -
Loads dropped DLL 1 IoCs
Processes:
78092b8a72d068f981f3db3edd29ac6b.exepid process 4920 78092b8a72d068f981f3db3edd29ac6b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ieinstal.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce ieinstal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Sabbatic = "C:\\Users\\Admin\\AppData\\Roaming\\Nontautomeric\\Anaphylatoxin141.exe" ieinstal.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
ieinstal.exepid process 2328 ieinstal.exe 2328 ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
78092b8a72d068f981f3db3edd29ac6b.exeieinstal.exepid process 4920 78092b8a72d068f981f3db3edd29ac6b.exe 2328 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
78092b8a72d068f981f3db3edd29ac6b.exedescription pid process target process PID 4920 set thread context of 2328 4920 78092b8a72d068f981f3db3edd29ac6b.exe ieinstal.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
78092b8a72d068f981f3db3edd29ac6b.exepid process 4920 78092b8a72d068f981f3db3edd29ac6b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ieinstal.exepid process 2328 ieinstal.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
78092b8a72d068f981f3db3edd29ac6b.exedescription pid process target process PID 4920 wrote to memory of 2328 4920 78092b8a72d068f981f3db3edd29ac6b.exe ieinstal.exe PID 4920 wrote to memory of 2328 4920 78092b8a72d068f981f3db3edd29ac6b.exe ieinstal.exe PID 4920 wrote to memory of 2328 4920 78092b8a72d068f981f3db3edd29ac6b.exe ieinstal.exe PID 4920 wrote to memory of 2328 4920 78092b8a72d068f981f3db3edd29ac6b.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78092b8a72d068f981f3db3edd29ac6b.exe"C:\Users\Admin\AppData\Local\Temp\78092b8a72d068f981f3db3edd29ac6b.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\78092b8a72d068f981f3db3edd29ac6b.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2328
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nss7641.tmp\System.dllFilesize
11KB
MD59625d5b1754bc4ff29281d415d27a0fd
SHA180e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA256c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
SHA512dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
-
memory/2328-141-0x0000000077770000-0x0000000077913000-memory.dmpFilesize
1.6MB
-
memory/2328-145-0x0000000077770000-0x0000000077913000-memory.dmpFilesize
1.6MB
-
memory/2328-144-0x00007FFBECE30000-0x00007FFBED025000-memory.dmpFilesize
2.0MB
-
memory/2328-143-0x0000000000C00000-0x0000000002CE4000-memory.dmpFilesize
32.9MB
-
memory/2328-137-0x0000000000000000-mapping.dmp
-
memory/2328-142-0x0000000077770000-0x0000000077913000-memory.dmpFilesize
1.6MB
-
memory/2328-138-0x0000000000C00000-0x0000000002CE4000-memory.dmpFilesize
32.9MB
-
memory/2328-140-0x00007FFBECE30000-0x00007FFBED025000-memory.dmpFilesize
2.0MB
-
memory/4920-135-0x00007FFBECE30000-0x00007FFBED025000-memory.dmpFilesize
2.0MB
-
memory/4920-139-0x0000000077770000-0x0000000077913000-memory.dmpFilesize
1.6MB
-
memory/4920-136-0x0000000077770000-0x0000000077913000-memory.dmpFilesize
1.6MB
-
memory/4920-134-0x0000000004AF0000-0x0000000006BD4000-memory.dmpFilesize
32.9MB
-
memory/4920-133-0x0000000004AF0000-0x0000000006BD4000-memory.dmpFilesize
32.9MB