Analysis
-
max time kernel
1800s -
max time network
1599s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
10-07-2023 17:26
General
-
Target
invoice4346.exe
-
Size
377KB
-
MD5
f166d6ae311679fb81b13c340d0e7738
-
SHA1
2692590176abf1deaba1ffe4ce6b2e5255a0af64
-
SHA256
fed0556f87884c7d40eadd3e2f22d432da0b5854edda4404a936f5b66e00b534
-
SHA512
2600a76c99b758fd381a09aaeeb681f08d909447d40b3fcb8e7b7780dc03feb95884a59ee0b1203cfad86ca39bd3cd6f5f32576e859c5fa8955356ebd050ae0f
-
SSDEEP
6144:/oShfEPZVheNA+ff03IvTWR1wHa98hU3DHCMf6rbZX:QqCnhe2e42Czw69kgH3fuX
Malware Config
Signatures
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice4346.exe"C:\Users\Admin\AppData\Local\Temp\invoice4346.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice4346.exe"C:\Users\Admin\AppData\Local\Temp\invoice4346.exe"2⤵
- Checks QEMU agent file
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD56ad39193ed20078aa1b23c33a1e48859
SHA195e70e4f47aa1689cc08afbdaef3ec323b5342fa
SHA256b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2
SHA51278c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
94.3MB
-
Filesize
3.0MB
-
Filesize
16.4MB
-
Filesize
780KB
-
Filesize
780KB