Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
12/10/2023, 14:22
General
-
Target
SecuriteInfo.com.W32.Injector.BGBR-7405.10952.18791.exe
-
Size
506KB
-
MD5
d077e377d3376501cbf4514bc3fa01e3
-
SHA1
6c3427fff0f55f6771aa8f637ebbd5b366579dee
-
SHA256
a22d102933a7e28c80dbd4c1a543af84b6d896d056e29d11c2c7ac2d023fd424
-
SHA512
aa9bf9303d02ffdac3d5e2e4602174cb7ceb3a47f422bcc1a924142da50a84d8162c43ad863c92ccb846a4d01de0d992bbe184d96c61806b475be03c237bf86c
-
SSDEEP
12288:9wc+TUh4R5bOYPzaBtA7jfWcYdYYNUK+cqhPv+AVRUj0DgUDsZ:9WTUh4fOyEcYdYuTq8GR4yA
Malware Config
Signatures
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Injector.BGBR-7405.10952.18791.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Injector.BGBR-7405.10952.18791.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Injector.BGBR-7405.10952.18791.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Injector.BGBR-7405.10952.18791.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5b0c77267f13b2f87c084fd86ef51ccfc
SHA1f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA256a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
SHA512f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
-
Filesize
1.7MB
-
Filesize
856KB
-
Filesize
24KB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
1.7MB
-
Filesize
16.4MB