84c2a497bbd52bd276480ff8aca4028bbabd0f6d3eb896453115afd49001b940

General

Target

82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe
Size

421KB
MD5

92b8b8d35ba16bf772e1c3c55972ccda
SHA1

4cb1fcef30fdcfe0f590ba1f223787939257ba36
SHA256

82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f
SHA512

fed3b35b7f131fc80ca8d21f697ea0e91f3b9ed04eb36087b5d652a3396ce46e649dd6f401839ca0235a1c7bcd7e777c7cf27898ae00fe3dfe1712f0064b6be6
SSDEEP

6144:vmOPuFNlaapl0zQwY0CyKlBGfpnAW4VKDkjdl8Jp42KcUMhmtL6Rt93WhX3A1maq:AlhpcCyKOf8l8D42XmxOt93OXQ1eoU

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.eprl.pt
Port:
587
Username:
[email protected]
Password:
6EO##P9jkTTY

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Loads dropped DLL 2 IoCs

pid	Process
1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe
1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
11	api.ipify.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2676	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe
2676	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 2676	1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe	29

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\unstirrable\microprint\torose.lit	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe
File opened for modification	C:\Windows\Values157\calinas\Ledendes.Bul	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	caspol.exe
2676	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	caspol.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2676	1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe	29
PID 1284 wrote to memory of 2676	1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe	29
PID 1284 wrote to memory of 2676	1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe	29
PID 1284 wrote to memory of 2676	1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe	29
PID 1284 wrote to memory of 2676	1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe	29
PID 1284 wrote to memory of 2676	1284	82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe	29

C:\Users\Admin\AppData\Local\Temp\82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe
"C:\Users\Admin\AppData\Local\Temp\82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
  "C:\Users\Admin\AppData\Local\Temp\82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nse29EF.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
\Users\Admin\AppData\Local\Temp\nse29EF.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
\Users\Admin\AppData\Local\Temp\nse29EF.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
memory/1284-67-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download
memory/1284-68-0x0000000077790000-0x0000000077866000-memory.dmp

Filesize
856KB

Download
memory/1284-69-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2676-72-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2676-71-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download
memory/2676-70-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2676-93-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2676-94-0x0000000000F50000-0x0000000004E4C000-memory.dmp

Filesize
63.0MB

Download
memory/2676-95-0x00000000733C0000-0x0000000073AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2676-96-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2676-98-0x0000000037830000-0x0000000037870000-memory.dmp

Filesize
256KB

Download
memory/2676-99-0x00000000733C0000-0x0000000073AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2676-101-0x0000000037830000-0x0000000037870000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing