c8edfb818e8a68ef4c127122bf9ae430d6d43ece8c9e70627cccb44e486f2827

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2023, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solostemmes249.exe
Size 291KB
Sample230511-pqletafb41
SHA256 c8edfb818e8a68ef4c127122bf9ae430d6d43ece8c9e70627cccb44e486f2827
MD5 7ad378979a95ed85e5bc3c31fd947727
SHA1 bc5ad33e6d8eeb3565b3be5c604d0b92d457bf5e
SHA512 e7aa57342e1199bc24b58b81af99caac9369c9c3e9405b0a43231368cbbed771ce81dd36b4ab3da993338162b8cbf4a748e9d8b9cdbd83d9e7bbe5f4efcf17e8
SSDEEP 6144:ex4veGehjmwGl36FROJyjD3yfUUyD8+yN/R8a/koagY3:o4GGRlqFmyjDSR3ggQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Solostemmes249.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Solostemmes249.exe

Loads dropped DLL 1 IoCs

pid	Process
2028	Solostemmes249.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2028	Solostemmes249.exe
4240	Solostemmes249.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 4240	2028	Solostemmes249.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2028	Solostemmes249.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 4240	2028	Solostemmes249.exe	90
PID 2028 wrote to memory of 4240	2028	Solostemmes249.exe	90
PID 2028 wrote to memory of 4240	2028	Solostemmes249.exe	90
PID 2028 wrote to memory of 4240	2028	Solostemmes249.exe	90

C:\Users\Admin\AppData\Local\Temp\Solostemmes249.exe
"C:\Users\Admin\AppData\Local\Temp\Solostemmes249.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\Solostemmes249.exe
  "C:\Users\Admin\AppData\Local\Temp\Solostemmes249.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7620.tmp\System.dll
Size 11KB
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4240-162-0x0000000000400000-0x0000000001654000-memory.dmp

Download

memory/4240-169-0x0000000000400000-0x0000000001654000-memory.dmp