Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 09:58
Static task
static1
Behavioral task
behavioral1
Sample
7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe
-
Size
254KB
-
MD5
ab5050f0b4b71352722a6122c8107f83
-
SHA1
10c6429825adaba12c34696a8ff00879b2abbb88
-
SHA256
7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edba
-
SHA512
ad2608ab646b697504286a909b1f3f454195ba527baa3a27f293f74464a0ca81aac635251f9c8cda2cf9f08650377026f5f7d1fddaa21f4573938c0f2671b8d0
-
SSDEEP
6144:QQLFhcSHzlojz8oz64NGsj7y78a/YstUX:1FaSRcWCGJz/tW
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe -
Loads dropped DLL 1 IoCs
pid Process 4956 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4956 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe 4512 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4956 set thread context of 4512 4956 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe 90 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\alfaquins.ini 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4956 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4512 4956 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe 90 PID 4956 wrote to memory of 4512 4956 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe 90 PID 4956 wrote to memory of 4512 4956 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe 90 PID 4956 wrote to memory of 4512 4956 7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\7da5b2207cf789cf6807b6cc3373048cbc951d7fd09ca8fb858693cfa5f5edbaexe_JC.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD50063d48afe5a0cdc02833145667b6641
SHA1e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA256ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
SHA51271cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
-
Filesize
42B
MD50f9aaea120fd9352cf55694c9500e138
SHA1bc89504eadbd05cd616470145910a1d5b66c631e
SHA25624966d03a28e75c5f10be3d0a75a6a2469d88a82cb32c9c8272657f096a89244
SHA5121f21aa429773c03679d3593c5c3983ac3e4c57c8041a9e6b320bfff4330ac2bcff7bf246481c0a05e27966d24e410eaa3555041eb35036c9bb0ed120831811b6