Analysis

  • max time kernel
    145s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    05/08/2023, 12:53

General

  • Target

    6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe

  • Size

    807KB

  • MD5

    165aeead5b51d96bc4d9942f03b93fee

  • SHA1

    566023603abdbc5e1ef024103b85c565e538b55a

  • SHA256

    6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506

  • SHA512

    bde6a00a02c39d10a5b55351a85d5125b7a5475922c136d6ef2e8aa9b41bd326ca73edc788eb792d26d43e01a42d435c949f8ef84b21d0f4052baa5023cbf45f

  • SSDEEP

    12288:obB5Oh7BMTQ+s9x4xizOn2YKX79rni2bTx9H8hSbuaOkcoNutQynIEqFY2VdxY5B:obW7b+s9xEnkxnvTx1b/Okw2sOYn5B

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3008

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\nst7725.tmp\System.dll

          Filesize

          11KB

          MD5

          75ed96254fbf894e42058062b4b4f0d1

          SHA1

          996503f1383b49021eb3427bc28d13b5bbd11977

          SHA256

          a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

          SHA512

          58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

        • memory/1196-65-0x00000000777E0000-0x0000000077989000-memory.dmp

          Filesize

          1.7MB

        • memory/1196-66-0x00000000779D0000-0x0000000077AA6000-memory.dmp

          Filesize

          856KB

        • memory/1196-67-0x00000000751A0000-0x00000000751A6000-memory.dmp

          Filesize

          24KB

        • memory/3008-68-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/3008-69-0x00000000777E0000-0x0000000077989000-memory.dmp

          Filesize

          1.7MB

        • memory/3008-70-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/3008-92-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/3008-93-0x0000000001470000-0x0000000004889000-memory.dmp

          Filesize

          52.1MB

        • memory/3008-94-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/3008-96-0x0000000034D50000-0x0000000035053000-memory.dmp

          Filesize

          3.0MB

        • memory/3008-95-0x0000000001470000-0x0000000004889000-memory.dmp

          Filesize

          52.1MB