Analysis
-
max time kernel
154s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2023 13:49
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
285KB
-
MD5
a413d04a39c86bd0b4ca116227d20a30
-
SHA1
0d88f2cca0aae58c31add82851c42fa1702cd4cf
-
SHA256
9d5019cef8a6bc52d94e6b4becf6249f2d202ac90204bbf508f9e62454f2f2fd
-
SHA512
e6d1662c7f389da0016b338185d4c4c3aae6240759641f8f8b62c07f534fbc956fa213cbd0ed37f607b67e0e38fb4635ee1031ada73c7913da921823284e3318
-
SSDEEP
6144:36dmbMKjUztT0dAxqLjd07V8y/6+8DXDQ9NA6igSOyxRVMvM:h4AUzt0dAxq/ky+8nGig3yxRuM
Malware Config
Extracted
formbook
4.1
gtt8
42taijijian.com
rehnimiyanales.com
cst247.shop
usdt09.tech
lennartjahn.com
aaabestcbd.com
marketing-digital-france-2.xyz
be4time.com
slotyfly.com
parimaladragonflywellness.life
phonereda.com
01076.win
thehoundlounge.info
high-vent.co.uk
14thfeb.com
onlyforks.info
joseeandtim.com
mylegoclub.com
iuser-findmy.info
uninassaupolopinheiro.com
tgomubira.shop
nebulanurseries.com
userfirstinteractive.com
jttobrands.com
e-pasport.com
xfinity-emailreconfirm.com
flora-block.com
crsplife.com
yourtechhousecall.com
lorrainedavistraining.com
thrivixcollection.com
quetthesieure.com
enrysisland.tech
himedya1.shop
luteblush.shop
caishen2.top
bestsellernouveau.com
casnation.com
shesurfbyronbay.com
cm98g0.com
continuumgblsupport.com
indianrailways.tech
findfetishcams.com
terracarepropertyservices.com
sav-client-chronopost.info
kedaionline250.shop
FORUM-ROMANUM.NET
dico-live.com
cabanaatthepointe.com
kuendubeachresort.com
biodigitalhealthcare.net
terompa.site
yongbangsd.com
hana-life2525.com
vmagaz.fun
meuble-chaussure-entree.site
bibaha.live
mocktailmasters.fun
shielings-unmusical.click
plane-jaynes.com
miracle-island.com
tilescitybd.com
respondaquiz.online
municipiodesombrerete.com
housy.host
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4688-146-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/1900-155-0x0000000000170000-0x000000000019F000-memory.dmp formbook behavioral2/memory/4688-156-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/1900-176-0x0000000000170000-0x000000000019F000-memory.dmp formbook -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
file.exefile.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe file.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe file.exe -
Loads dropped DLL 1 IoCs
Processes:
file.exepid process 4508 file.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
file.exepid process 4688 file.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
file.exefile.exepid process 4508 file.exe 4688 file.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
file.exefile.exewlanext.exedescription pid process target process PID 4508 set thread context of 4688 4508 file.exe file.exe PID 4688 set thread context of 3184 4688 file.exe Explorer.EXE PID 1900 set thread context of 3184 1900 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
file.exewlanext.exepid process 4688 file.exe 4688 file.exe 4688 file.exe 4688 file.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe 1900 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3184 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
file.exefile.exewlanext.exepid process 4508 file.exe 4688 file.exe 4688 file.exe 4688 file.exe 1900 wlanext.exe 1900 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
file.exeExplorer.EXEwlanext.exedescription pid process Token: SeDebugPrivilege 4688 file.exe Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeDebugPrivilege 1900 wlanext.exe Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
file.exeExplorer.EXEwlanext.exedescription pid process target process PID 4508 wrote to memory of 4688 4508 file.exe file.exe PID 4508 wrote to memory of 4688 4508 file.exe file.exe PID 4508 wrote to memory of 4688 4508 file.exe file.exe PID 4508 wrote to memory of 4688 4508 file.exe file.exe PID 3184 wrote to memory of 1900 3184 Explorer.EXE wlanext.exe PID 3184 wrote to memory of 1900 3184 Explorer.EXE wlanext.exe PID 3184 wrote to memory of 1900 3184 Explorer.EXE wlanext.exe PID 1900 wrote to memory of 2816 1900 wlanext.exe cmd.exe PID 1900 wrote to memory of 2816 1900 wlanext.exe cmd.exe PID 1900 wrote to memory of 2816 1900 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nslD5E4.tmp\System.dllFilesize
11KB
MD50063d48afe5a0cdc02833145667b6641
SHA1e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA256ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
SHA51271cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
-
memory/1900-153-0x0000000000D50000-0x0000000000D67000-memory.dmpFilesize
92KB
-
memory/1900-180-0x0000000000930000-0x00000000009C3000-memory.dmpFilesize
588KB
-
memory/1900-176-0x0000000000170000-0x000000000019F000-memory.dmpFilesize
188KB
-
memory/1900-157-0x0000000000D70000-0x00000000010BA000-memory.dmpFilesize
3.3MB
-
memory/1900-155-0x0000000000170000-0x000000000019F000-memory.dmpFilesize
188KB
-
memory/1900-151-0x0000000000D50000-0x0000000000D67000-memory.dmpFilesize
92KB
-
memory/3184-194-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-165-0x0000000003640000-0x0000000003650000-memory.dmpFilesize
64KB
-
memory/3184-209-0x0000000003160000-0x000000000316A000-memory.dmpFilesize
40KB
-
memory/3184-208-0x0000000003150000-0x0000000003152000-memory.dmpFilesize
8KB
-
memory/3184-150-0x0000000008A60000-0x0000000008B98000-memory.dmpFilesize
1.2MB
-
memory/3184-207-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-206-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-205-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-204-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-203-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-202-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-158-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-159-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-160-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-161-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-162-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-163-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-164-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-166-0x0000000003660000-0x0000000003670000-memory.dmpFilesize
64KB
-
memory/3184-178-0x0000000003660000-0x0000000003670000-memory.dmpFilesize
64KB
-
memory/3184-167-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-168-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-169-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-170-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-171-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-173-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-172-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-175-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-174-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-201-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-200-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-177-0x0000000003660000-0x0000000003670000-memory.dmpFilesize
64KB
-
memory/3184-199-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-181-0x0000000009080000-0x00000000091C4000-memory.dmpFilesize
1.3MB
-
memory/3184-182-0x0000000003660000-0x0000000003670000-memory.dmpFilesize
64KB
-
memory/3184-183-0x0000000009080000-0x00000000091C4000-memory.dmpFilesize
1.3MB
-
memory/3184-184-0x0000000003660000-0x0000000003670000-memory.dmpFilesize
64KB
-
memory/3184-185-0x0000000003660000-0x0000000003670000-memory.dmpFilesize
64KB
-
memory/3184-187-0x0000000009080000-0x00000000091C4000-memory.dmpFilesize
1.3MB
-
memory/3184-192-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-193-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-198-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-195-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-196-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/3184-197-0x0000000003630000-0x0000000003640000-memory.dmpFilesize
64KB
-
memory/4508-140-0x0000000003220000-0x0000000006158000-memory.dmpFilesize
47.2MB
-
memory/4508-141-0x0000000003220000-0x0000000006158000-memory.dmpFilesize
47.2MB
-
memory/4688-147-0x0000000001660000-0x0000000004598000-memory.dmpFilesize
47.2MB
-
memory/4688-145-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4688-143-0x0000000001660000-0x0000000004598000-memory.dmpFilesize
47.2MB
-
memory/4688-156-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4688-154-0x0000000001660000-0x0000000004598000-memory.dmpFilesize
47.2MB
-
memory/4688-144-0x0000000001660000-0x0000000004598000-memory.dmpFilesize
47.2MB
-
memory/4688-142-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4688-146-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4688-149-0x0000000034830000-0x0000000034844000-memory.dmpFilesize
80KB
-
memory/4688-148-0x00000000349E0000-0x0000000034D2A000-memory.dmpFilesize
3.3MB