Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
14/07/2023, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
2456675bfe2e68d6149c840b1d11dd61.exe
Resource
win7-20230712-en
General
-
Target
2456675bfe2e68d6149c840b1d11dd61.exe
-
Size
268KB
-
MD5
2456675bfe2e68d6149c840b1d11dd61
-
SHA1
6c22b191eeaed5024ce6e09c598ea9457865d9d7
-
SHA256
6db833ede0af9d00bf80c1fe134e947b1ec44bff55713251669021af1d8dac20
-
SHA512
41390fb091301277526729f8b8e7f93f277365fe5d5bfbe02e42c776d0ae0ab0cb250aef61d44c262c54026937d77e52dc2c58669b212d5188e2e37d40de981f
-
SSDEEP
6144:vC27B0fQe1+5BMWxix39ri0vCb8aiIxJMiDmd/GnsRrsgot3W:jw0fLi/i0qbBxJh6dOn9ga3W
Malware Config
Extracted
formbook
4.1
al05
becapmuiu.xyz
wearerp.com
beautychannel.world
kuwiti.com
vex5678.com
pecanbayouwoodworks.com
lrsconcrete.com
emgje.buzz
haorizi.net
tradingbattle.net
growgram.info
zuolide.com
poliedriconsulting.com
persjateng.com
pseudlifelif.com
tgteletg.top
33changing.com
jayagrandcounty.com
thegopigirls.com
c8685.top
cyberkracken.com
8451555.xyz
internationalabn.com
blackbeardbar.com
vetnymtravde.xyz
sevenmilehillsanctuary.com
haah1vjv3ml7yf.xyz
kimberlyquinterorealtor.net
dokumenty-ohrana-77.net
llmnissan439.vip
japanesesake.top
kuoli.xyz
tratamentoseficazes.com
mailkaski.com
alsaudidaily.com
zfjisumk.com
vrijtsnudge.xyz
smallcanberraweddings.com
plaketcad.cfd
lng-i.pro
jaschatfashion.com
synapsereferrals.com
exploringfrontiers.com
uutv201.xyz
ballbocce.com
dihai.net
panemeventsandentertainment.com
newmuny.com
onlinestorageservice.com
cannaglobe.website
minhw.shop
bradcred.com
thwys802.xyz
crictirshs.net
valutazioneimpatto.com
blackoutbundles.com
hnnhf7j4378rq5.xyz
oudfactoryom.com
lazydaisygiftstores.net
firstchoiceassistants.com
wincash88.info
grelion.com
qinyekeji.com
words2watch.com
panzerapish.cfd
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2860-69-0x0000000000400000-0x0000000001462000-memory.dmp formbook -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 2456675bfe2e68d6149c840b1d11dd61.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 2456675bfe2e68d6149c840b1d11dd61.exe -
Loads dropped DLL 1 IoCs
pid Process 2596 2456675bfe2e68d6149c840b1d11dd61.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2860 2456675bfe2e68d6149c840b1d11dd61.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2596 2456675bfe2e68d6149c840b1d11dd61.exe 2860 2456675bfe2e68d6149c840b1d11dd61.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2596 set thread context of 2860 2596 2456675bfe2e68d6149c840b1d11dd61.exe 30 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\sansningerne.Unc 2456675bfe2e68d6149c840b1d11dd61.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\Katje\falsebenet\Bike\Angivende.ini 2456675bfe2e68d6149c840b1d11dd61.exe File opened for modification C:\Windows\resources\0409\Hovedgaarde.For 2456675bfe2e68d6149c840b1d11dd61.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2860 2456675bfe2e68d6149c840b1d11dd61.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2596 2456675bfe2e68d6149c840b1d11dd61.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2860 2596 2456675bfe2e68d6149c840b1d11dd61.exe 30 PID 2596 wrote to memory of 2860 2596 2456675bfe2e68d6149c840b1d11dd61.exe 30 PID 2596 wrote to memory of 2860 2596 2456675bfe2e68d6149c840b1d11dd61.exe 30 PID 2596 wrote to memory of 2860 2596 2456675bfe2e68d6149c840b1d11dd61.exe 30 PID 2596 wrote to memory of 2860 2596 2456675bfe2e68d6149c840b1d11dd61.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2456675bfe2e68d6149c840b1d11dd61.exe"C:\Users\Admin\AppData\Local\Temp\2456675bfe2e68d6149c840b1d11dd61.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2456675bfe2e68d6149c840b1d11dd61.exe"C:\Users\Admin\AppData\Local\Temp\2456675bfe2e68d6149c840b1d11dd61.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5375e8a08471dc6f85f3828488b1147b3
SHA11941484ac710fc301a7d31d6f1345e32a21546af
SHA2564c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
SHA5125ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8