Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2023, 07:43

General

  • Target

    kobee951587.exe

  • Size

    476KB

  • MD5

    f9523a569eaa47e6ce6dc10c9b07117b

  • SHA1

    01859c3360b613e1d8663b8edb702bea32ef65cc

  • SHA256

    2e97f4d6bf16c0c918f48301129830bf11639ac0090c6eb937b126345fcc2185

  • SHA512

    453345710c0cb4f047e05f4b4af112866b9355f885b3d257c83cd75ed4943050d90a7c85b3d186bf81860a2e43d0ebde5b8cbcb7f315d19aee11b81484a9311b

  • SSDEEP

    6144:AmOPUVI5v8AiOEUi4+9Ret/+qw0iTOMeH/ThI3E8pEu77jKsU4kyvzvDlMh/BlUn:n+8dOluU/+qw0XBb4vvzTks5Mh7wo+

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Checks QEMU agent file 2 TTPs 1 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\kobee951587.exe
    "C:\Users\Admin\AppData\Local\Temp\kobee951587.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1100
      2⤵
      • Program crash
      PID:4104
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3760 -ip 3760
    1⤵
      PID:4544

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsh7FFE.tmp\System.dll

            Filesize

            11KB

            MD5

            9625d5b1754bc4ff29281d415d27a0fd

            SHA1

            80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

            SHA256

            c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

            SHA512

            dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

          • C:\Users\Admin\AppData\Local\Temp\nsh7FFE.tmp\System.dll

            Filesize

            11KB

            MD5

            9625d5b1754bc4ff29281d415d27a0fd

            SHA1

            80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

            SHA256

            c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

            SHA512

            dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

          • C:\Users\Admin\AppData\Local\Temp\nsh7FFE.tmp\System.dll

            Filesize

            11KB

            MD5

            9625d5b1754bc4ff29281d415d27a0fd

            SHA1

            80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

            SHA256

            c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

            SHA512

            dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

          • memory/3760-145-0x0000000003260000-0x0000000005886000-memory.dmp

            Filesize

            38.1MB

          • memory/3760-146-0x0000000003260000-0x0000000005886000-memory.dmp

            Filesize

            38.1MB

          • memory/3760-147-0x0000000077CE1000-0x0000000077E01000-memory.dmp

            Filesize

            1.1MB

          • memory/3760-148-0x0000000003260000-0x0000000005886000-memory.dmp

            Filesize

            38.1MB