Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2023 10:37
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
285KB
-
MD5
a413d04a39c86bd0b4ca116227d20a30
-
SHA1
0d88f2cca0aae58c31add82851c42fa1702cd4cf
-
SHA256
9d5019cef8a6bc52d94e6b4becf6249f2d202ac90204bbf508f9e62454f2f2fd
-
SHA512
e6d1662c7f389da0016b338185d4c4c3aae6240759641f8f8b62c07f534fbc956fa213cbd0ed37f607b67e0e38fb4635ee1031ada73c7913da921823284e3318
-
SSDEEP
6144:36dmbMKjUztT0dAxqLjd07V8y/6+8DXDQ9NA6igSOyxRVMvM:h4AUzt0dAxq/ky+8nGig3yxRuM
Malware Config
Extracted
formbook
4.1
gtt8
42taijijian.com
rehnimiyanales.com
cst247.shop
usdt09.tech
lennartjahn.com
aaabestcbd.com
marketing-digital-france-2.xyz
be4time.com
slotyfly.com
parimaladragonflywellness.life
phonereda.com
01076.win
thehoundlounge.info
high-vent.co.uk
14thfeb.com
onlyforks.info
joseeandtim.com
mylegoclub.com
iuser-findmy.info
uninassaupolopinheiro.com
tgomubira.shop
nebulanurseries.com
userfirstinteractive.com
jttobrands.com
e-pasport.com
xfinity-emailreconfirm.com
flora-block.com
crsplife.com
yourtechhousecall.com
lorrainedavistraining.com
thrivixcollection.com
quetthesieure.com
enrysisland.tech
himedya1.shop
luteblush.shop
caishen2.top
bestsellernouveau.com
casnation.com
shesurfbyronbay.com
cm98g0.com
continuumgblsupport.com
indianrailways.tech
findfetishcams.com
terracarepropertyservices.com
sav-client-chronopost.info
kedaionline250.shop
FORUM-ROMANUM.NET
dico-live.com
cabanaatthepointe.com
kuendubeachresort.com
biodigitalhealthcare.net
terompa.site
yongbangsd.com
hana-life2525.com
vmagaz.fun
meuble-chaussure-entree.site
bibaha.live
mocktailmasters.fun
shielings-unmusical.click
plane-jaynes.com
miracle-island.com
tilescitybd.com
respondaquiz.online
municipiodesombrerete.com
housy.host
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4532-145-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/1968-155-0x0000000000590000-0x00000000005BF000-memory.dmp formbook behavioral2/memory/4532-156-0x0000000000400000-0x0000000001654000-memory.dmp formbook behavioral2/memory/1968-158-0x0000000000590000-0x00000000005BF000-memory.dmp formbook -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
tmp.exetmp.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe tmp.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe tmp.exe -
Loads dropped DLL 1 IoCs
Processes:
tmp.exepid process 1788 tmp.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
tmp.exepid process 4532 tmp.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
tmp.exetmp.exepid process 1788 tmp.exe 4532 tmp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exesvchost.exedescription pid process target process PID 1788 set thread context of 4532 1788 tmp.exe tmp.exe PID 4532 set thread context of 3156 4532 tmp.exe Explorer.EXE PID 1968 set thread context of 3156 1968 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
tmp.exesvchost.exepid process 4532 tmp.exe 4532 tmp.exe 4532 tmp.exe 4532 tmp.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe 1968 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3156 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
tmp.exetmp.exesvchost.exepid process 1788 tmp.exe 4532 tmp.exe 4532 tmp.exe 4532 tmp.exe 1968 svchost.exe 1968 svchost.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
tmp.exeExplorer.EXEsvchost.exedescription pid process Token: SeDebugPrivilege 4532 tmp.exe Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE Token: SeDebugPrivilege 1968 svchost.exe Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
tmp.exeExplorer.EXEsvchost.exedescription pid process target process PID 1788 wrote to memory of 4532 1788 tmp.exe tmp.exe PID 1788 wrote to memory of 4532 1788 tmp.exe tmp.exe PID 1788 wrote to memory of 4532 1788 tmp.exe tmp.exe PID 1788 wrote to memory of 4532 1788 tmp.exe tmp.exe PID 3156 wrote to memory of 1968 3156 Explorer.EXE svchost.exe PID 3156 wrote to memory of 1968 3156 Explorer.EXE svchost.exe PID 3156 wrote to memory of 1968 3156 Explorer.EXE svchost.exe PID 1968 wrote to memory of 4388 1968 svchost.exe cmd.exe PID 1968 wrote to memory of 4388 1968 svchost.exe cmd.exe PID 1968 wrote to memory of 4388 1968 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsiF67B.tmp\System.dllFilesize
11KB
MD50063d48afe5a0cdc02833145667b6641
SHA1e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA256ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
SHA51271cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
-
memory/1788-140-0x0000000003220000-0x0000000006158000-memory.dmpFilesize
47.2MB
-
memory/1788-141-0x0000000003220000-0x0000000006158000-memory.dmpFilesize
47.2MB
-
memory/1968-151-0x0000000000FB0000-0x0000000000FBE000-memory.dmpFilesize
56KB
-
memory/1968-160-0x0000000000EA0000-0x0000000000F33000-memory.dmpFilesize
588KB
-
memory/1968-158-0x0000000000590000-0x00000000005BF000-memory.dmpFilesize
188KB
-
memory/1968-157-0x0000000001400000-0x000000000174A000-memory.dmpFilesize
3.3MB
-
memory/1968-155-0x0000000000590000-0x00000000005BF000-memory.dmpFilesize
188KB
-
memory/1968-153-0x0000000000FB0000-0x0000000000FBE000-memory.dmpFilesize
56KB
-
memory/3156-173-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-176-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-183-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-182-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-181-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-180-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-179-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-178-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-177-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-150-0x0000000007CF0000-0x0000000007E28000-memory.dmpFilesize
1.2MB
-
memory/3156-161-0x0000000007F00000-0x000000000802F000-memory.dmpFilesize
1.2MB
-
memory/3156-163-0x0000000007F00000-0x000000000802F000-memory.dmpFilesize
1.2MB
-
memory/3156-164-0x0000000007F00000-0x000000000802F000-memory.dmpFilesize
1.2MB
-
memory/3156-166-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-167-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-168-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-170-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-172-0x0000000002760000-0x0000000002770000-memory.dmpFilesize
64KB
-
memory/3156-175-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-171-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/3156-174-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/4532-142-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4532-143-0x0000000001660000-0x0000000004598000-memory.dmpFilesize
47.2MB
-
memory/4532-144-0x0000000001660000-0x0000000004598000-memory.dmpFilesize
47.2MB
-
memory/4532-145-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4532-156-0x0000000000400000-0x0000000001654000-memory.dmpFilesize
18.3MB
-
memory/4532-154-0x0000000001660000-0x0000000004598000-memory.dmpFilesize
47.2MB
-
memory/4532-147-0x0000000001660000-0x0000000004598000-memory.dmpFilesize
47.2MB
-
memory/4532-148-0x00000000349E0000-0x0000000034D2A000-memory.dmpFilesize
3.3MB
-
memory/4532-149-0x0000000034830000-0x0000000034844000-memory.dmpFilesize
80KB