Analysis
-
max time kernel
297s -
max time network
294s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2023, 10:04
Static task
static1
Behavioral task
behavioral1
Sample
pdf.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
pdf.exe
Resource
win10v2004-20230703-en
General
-
Target
pdf.exe
-
Size
357KB
-
MD5
8a2b59ddaa578f5f6b37af39a0bb9aab
-
SHA1
52a0a411c1e53c0f082515fb551d20f9dd9b51a1
-
SHA256
dcd849401b6834b4c36006567cbf2e9bcc2093849432a104ff43d178867d397d
-
SHA512
0e5de1a81c045b9dc1265ffa14c84781976a49fb569858646c3101c92721a535e0d8136b8b973fbfb8a6be043c029cbcff87bbe9079ced202b31368764858ec4
-
SSDEEP
6144:1spNjls8PZVheNA+ff0CpelHQi+lhlSECXIm8feVrAKt:1c9nhe2evpelHQXhNC4N7Kt
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe pdf.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe pdf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation pdf.exe -
Loads dropped DLL 1 IoCs
pid Process 4220 pdf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Mdelokalernes72\Oscillators\Burghbote\Orwellian.Pro pdf.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3220 pdf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4220 pdf.exe 3220 pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4220 set thread context of 3220 4220 pdf.exe 94 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Bismark\Salaamed\Bundgarnsfiskernes\appelret.ini pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe 3220 pdf.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4220 pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3220 pdf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4220 wrote to memory of 3220 4220 pdf.exe 94 PID 4220 wrote to memory of 3220 4220 pdf.exe 94 PID 4220 wrote to memory of 3220 4220 pdf.exe 94 PID 4220 wrote to memory of 3220 4220 pdf.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\pdf.exe"C:\Users\Admin\AppData\Local\Temp\pdf.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\pdf.exe"C:\Users\Admin\AppData\Local\Temp\pdf.exe"2⤵
- Checks QEMU agent file
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5