559bfa18074709e2f59b77e84f70ad0448f853fa6e416dfc603187de9896c99d

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2023 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tenors.exe
Size

856KB
MD5

2307efdb5e44354475c089fedfe6f60d
SHA1

89170148d514a23229664b728de4853b3b8da651
SHA256

559bfa18074709e2f59b77e84f70ad0448f853fa6e416dfc603187de9896c99d
SHA512

82df3b1826cbe1daea7c4cd3979624053bcef7c10091706340d6eb04dd0f824bafb934bbffd39a29b426365d54eb57ea8a850d553469fcadca5a851230ceade3
SSDEEP

24576:INPx3Tpk5nvqnwo3MI9e5s6Dmz6uc1L9J8xVCT5ATqY2BXY6+g7:mBT2tVo31Wsrz6VL9J8xVCT5AT2Y6N

Score

7^/10

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Tenors.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Tenors.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	Tenors.exe

Loads dropped DLL 1 IoCs

pid	Process
4576	Tenors.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5004	Tenors.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4576	Tenors.exe
5004	Tenors.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4576 set thread context of 5004	4576	Tenors.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe
5004	Tenors.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4576	Tenors.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	Tenors.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 5004	4576	Tenors.exe	96
PID 4576 wrote to memory of 5004	4576	Tenors.exe	96
PID 4576 wrote to memory of 5004	4576	Tenors.exe	96
PID 4576 wrote to memory of 5004	4576	Tenors.exe	96
PID 4576 wrote to memory of 5004	4576	Tenors.exe	96

C:\Users\Admin\AppData\Local\Temp\Tenors.exe
"C:\Users\Admin\AppData\Local\Temp\Tenors.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\Tenors.exe
  "C:\Users\Admin\AppData\Local\Temp\Tenors.exe"
  2⤵
  - Checks QEMU agent file
  - Checks computer location settings
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsn81F2.tmp\System.dll

Filesize
12KB

MD5
dd87a973e01c5d9f8e0fcc81a0af7c7a

SHA1
c9206ced48d1e5bc648b1d0f54cccc18bf643a14

SHA256
7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1

SHA512
4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f

Download Submit
memory/4576-14-0x0000000077311000-0x0000000077431000-memory.dmp

Filesize
1.1MB

Download
memory/4576-15-0x0000000074170000-0x0000000074177000-memory.dmp

Filesize
28KB

Download
memory/5004-16-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/5004-17-0x0000000077311000-0x0000000077431000-memory.dmp

Filesize
1.1MB

Download
memory/5004-18-0x0000000077398000-0x0000000077399000-memory.dmp

Filesize
4KB

Download
memory/5004-19-0x00000000773B5000-0x00000000773B6000-memory.dmp

Filesize
4KB

Download
memory/5004-29-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/5004-33-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/5004-34-0x0000000001660000-0x0000000004AFC000-memory.dmp

Filesize
52.6MB

Download
memory/5004-35-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/5004-36-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/5004-37-0x0000000035190000-0x00000000354DA000-memory.dmp

Filesize
3.3MB

Download
memory/5004-38-0x0000000077311000-0x0000000077431000-memory.dmp

Filesize
1.1MB

Download
memory/5004-39-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download