b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03

Analysis

max time kernel
151s
max time network
162s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
Size

510KB
MD5

1567c21815e4106a3fac9b2cef843e05
SHA1

14f49f9c6978333b628f58f88de01bbd936b1952
SHA256

b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03
SHA512

f6b5ac901ed1b275f4233b8a1ad46f694654a3a3a640fcbd91c167bcebd64fc77b103dbff8b262f9cf180206fdbf2de11928a3c673f58031cd26d54955f780e1
SSDEEP

6144:1z2yP2JhecVucqmbafvj4Dlq7YR3N+tnXsUrk2fUJaZqicB3oxLJfW4uMuuei9QT:Yh9I+aXOlq7GN+QvJExLj0UQPL

Score

7^/10

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Loads dropped DLL 11 IoCs

pid	Process
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
2556	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 2556	2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	28

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\armstolenes.Sno	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Sandboxes59\vismuts.ini	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
File opened for modification	C:\Windows\resources\0409\digitalurenes.tra	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
File opened for modification	C:\Windows\resources\Transited106.Hor	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2556	2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	28
PID 2152 wrote to memory of 2556	2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	28
PID 2152 wrote to memory of 2556	2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	28
PID 2152 wrote to memory of 2556	2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	28
PID 2152 wrote to memory of 2556	2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	28
PID 2152 wrote to memory of 2556	2152	b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
"C:\Users\Admin\AppData\Local\Temp\b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\b30207db46afba1196520a334dfa6a722d940e2a8750663d8462b6e30505ff03_JC.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabE0B0.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE111.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\BgImage.dll

Filesize
7KB

MD5
350a507070ed063ac6a511aeef67861a

SHA1
cf647b90a1212e090f1d236d1b50a5010cbf3bae

SHA256
5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab

SHA512
cde5747cc8539625e4262afad9699ce4e8325133d7ed7f47b9d46989a7aa0d2cc2488441acc57368f485ef1dd3e02b9ef2faa642f68e9f1db53a39e0f896d468

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\BgImage.dll

Filesize
7KB

MD5
350a507070ed063ac6a511aeef67861a

SHA1
cf647b90a1212e090f1d236d1b50a5010cbf3bae

SHA256
5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab

SHA512
cde5747cc8539625e4262afad9699ce4e8325133d7ed7f47b9d46989a7aa0d2cc2488441acc57368f485ef1dd3e02b9ef2faa642f68e9f1db53a39e0f896d468

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\BgImage.dll

Filesize
7KB

MD5
350a507070ed063ac6a511aeef67861a

SHA1
cf647b90a1212e090f1d236d1b50a5010cbf3bae

SHA256
5c66abd3f06eaa357ed9663224c927cf7120dca010572103faa88832bb31c5ab

SHA512
cde5747cc8539625e4262afad9699ce4e8325133d7ed7f47b9d46989a7aa0d2cc2488441acc57368f485ef1dd3e02b9ef2faa642f68e9f1db53a39e0f896d468

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\nsDialogs.dll

Filesize
9KB

MD5
13b6a88cf284d0f45619e76191e2b995

SHA1
09ebb0eb4b1dca73d354368414906fc5ad667e06

SHA256
cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911

SHA512
2aeeae709d759e34592d8a06c90e58aa747e14d54be95fb133994fdcebb1bdc8bc5d82782d0c8c3cdfd35c7bea5d7105379d3c3a25377a8c958c7b2555b1209e

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
\Users\Admin\AppData\Local\Temp\nsi5B2B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
memory/2152-54-0x00000000771B0000-0x0000000077359000-memory.dmp

Filesize
1.7MB

Download
memory/2152-55-0x00000000773A0000-0x0000000077476000-memory.dmp

Filesize
856KB

Download
memory/2152-56-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2556-57-0x00000000771B0000-0x0000000077359000-memory.dmp

Filesize
1.7MB

Download
memory/2556-218-0x00000000771B0000-0x0000000077359000-memory.dmp

Filesize
1.7MB

Download
memory/2556-249-0x0000000072730000-0x0000000073792000-memory.dmp

Filesize
16.4MB

Download