Analysis
-
max time kernel
297s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
12/07/2023, 10:04
Static task
static1
Behavioral task
behavioral1
Sample
pdf.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
pdf.exe
Resource
win10v2004-20230703-en
General
-
Target
pdf.exe
-
Size
357KB
-
MD5
8a2b59ddaa578f5f6b37af39a0bb9aab
-
SHA1
52a0a411c1e53c0f082515fb551d20f9dd9b51a1
-
SHA256
dcd849401b6834b4c36006567cbf2e9bcc2093849432a104ff43d178867d397d
-
SHA512
0e5de1a81c045b9dc1265ffa14c84781976a49fb569858646c3101c92721a535e0d8136b8b973fbfb8a6be043c029cbcff87bbe9079ced202b31368764858ec4
-
SSDEEP
6144:1spNjls8PZVheNA+ff0CpelHQi+lhlSECXIm8feVrAKt:1c9nhe2evpelHQXhNC4N7Kt
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe pdf.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe pdf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Control Panel\International\Geo\Nation pdf.exe -
Loads dropped DLL 1 IoCs
pid Process 1496 pdf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Mdelokalernes72\Oscillators\Burghbote\Orwellian.Pro pdf.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2268 pdf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1496 pdf.exe 2268 pdf.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1496 set thread context of 2268 1496 pdf.exe 28 PID 2268 set thread context of 1496 2268 pdf.exe 27 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Bismark\Salaamed\Bundgarnsfiskernes\appelret.ini pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe 2268 pdf.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1496 pdf.exe 2268 pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2268 pdf.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2268 1496 pdf.exe 28 PID 1496 wrote to memory of 2268 1496 pdf.exe 28 PID 1496 wrote to memory of 2268 1496 pdf.exe 28 PID 1496 wrote to memory of 2268 1496 pdf.exe 28 PID 1496 wrote to memory of 2268 1496 pdf.exe 28 PID 1496 wrote to memory of 896 1496 pdf.exe 30 PID 1496 wrote to memory of 896 1496 pdf.exe 30 PID 1496 wrote to memory of 896 1496 pdf.exe 30 PID 1496 wrote to memory of 896 1496 pdf.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\pdf.exe"C:\Users\Admin\AppData\Local\Temp\pdf.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\pdf.exe"C:\Users\Admin\AppData\Local\Temp\pdf.exe"2⤵
- Checks QEMU agent file
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵PID:896
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5