Analysis
-
max time kernel
84s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b.exe
Resource
win10v2004-20230703-en
General
-
Target
5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b.exe
-
Size
108KB
-
MD5
a15007ab4ce4561cfe6964390ebc51e3
-
SHA1
d9918a5eab5401a31262852ff20af66e98925389
-
SHA256
5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b
-
SHA512
6092f4b3c3d68cd2565a212cedad3e7a5b4a0fb9aff01267c9bb85ebf248c4924e9fe4974e2e9062d4c325ebecb830b97d5bf37f7ee9c893f9a7425cbed03757
-
SSDEEP
1536:TPDg2HUAJO69D2lKROYxTiBlzB6PPR25Lnr:h0AJO69D2lKoMTelzB6hY
Malware Config
Extracted
guloader
http://hosseinsoltani.ir/legacy_hwYFIzpwb106.bin
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent state file 2 TTPs 1 IoCs
Checks state file used by QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\ProgramData\qemu-ga\qga.state 5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4220 5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4220 5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b.exe"C:\Users\Admin\AppData\Local\Temp\5f01c5f1f3fcf770ba41f23d251bb1ad40fbb537661d4516674d3abb63774e3b.exe"1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4220