Analysis

  • max time kernel
    147s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2023, 12:53

General

  • Target

    6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe

  • Size

    807KB

  • MD5

    165aeead5b51d96bc4d9942f03b93fee

  • SHA1

    566023603abdbc5e1ef024103b85c565e538b55a

  • SHA256

    6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506

  • SHA512

    bde6a00a02c39d10a5b55351a85d5125b7a5475922c136d6ef2e8aa9b41bd326ca73edc788eb792d26d43e01a42d435c949f8ef84b21d0f4052baa5023cbf45f

  • SSDEEP

    12288:obB5Oh7BMTQ+s9x4xizOn2YKX79rni2bTx9H8hSbuaOkcoNutQynIEqFY2VdxY5B:obW7b+s9xEnkxnvTx1b/Okw2sOYn5B

Score
7/10

Malware Config

Signatures

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:580
    • C:\Users\Admin\AppData\Local\Temp\6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\6f61121924dbe1b34c6af8af8ee78528ca9d839856c9fd8ffe8a3a2e48cae506exe_JC.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3472

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsvD330.tmp\System.dll

          Filesize

          11KB

          MD5

          75ed96254fbf894e42058062b4b4f0d1

          SHA1

          996503f1383b49021eb3427bc28d13b5bbd11977

          SHA256

          a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

          SHA512

          58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

        • memory/580-143-0x0000000077011000-0x0000000077131000-memory.dmp

          Filesize

          1.1MB

        • memory/580-144-0x00000000744E0000-0x00000000744E6000-memory.dmp

          Filesize

          24KB

        • memory/3472-145-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3472-146-0x0000000077011000-0x0000000077131000-memory.dmp

          Filesize

          1.1MB

        • memory/3472-147-0x0000000077098000-0x0000000077099000-memory.dmp

          Filesize

          4KB

        • memory/3472-160-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3472-161-0x0000000001660000-0x0000000004A79000-memory.dmp

          Filesize

          52.1MB

        • memory/3472-162-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3472-163-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3472-164-0x0000000035120000-0x000000003546A000-memory.dmp

          Filesize

          3.3MB

        • memory/3472-165-0x0000000001660000-0x0000000004A79000-memory.dmp

          Filesize

          52.1MB

        • memory/3472-167-0x0000000077011000-0x0000000077131000-memory.dmp

          Filesize

          1.1MB