Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
ddef0570690db3b804798ad28a011d04.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ddef0570690db3b804798ad28a011d04.exe
Resource
win10v2004-20240226-en
General
-
Target
ddef0570690db3b804798ad28a011d04.exe
-
Size
152KB
-
MD5
ddef0570690db3b804798ad28a011d04
-
SHA1
3a2fca0ff4bd319101ae37efef28986c85e5e148
-
SHA256
8fd7318d961b667f108d7c432cd81662dff4abd2391cc8015e99793c9fd08bd0
-
SHA512
90b27085e795d943cedab158888ef807d0253266d1df9c00c72900f4a2061dc79c8f152fcad59909524af3e54e4e25ade067729d401494aeb16e758c05b1e276
-
SSDEEP
1536:CkUvfHwQ8uSHod7kqqT7Cdn+Mut/q1nVJFgR7f:1C4QEod4fCd+Jt/q19gxf
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ddef0570690db3b804798ad28a011d04.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ddef0570690db3b804798ad28a011d04.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 58 drive.google.com 59 drive.google.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 32 ddef0570690db3b804798ad28a011d04.exe 4228 ddef0570690db3b804798ad28a011d04.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 32 set thread context of 4228 32 ddef0570690db3b804798ad28a011d04.exe 109 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 32 ddef0570690db3b804798ad28a011d04.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 32 ddef0570690db3b804798ad28a011d04.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 32 wrote to memory of 4228 32 ddef0570690db3b804798ad28a011d04.exe 109 PID 32 wrote to memory of 4228 32 ddef0570690db3b804798ad28a011d04.exe 109 PID 32 wrote to memory of 4228 32 ddef0570690db3b804798ad28a011d04.exe 109 PID 32 wrote to memory of 4228 32 ddef0570690db3b804798ad28a011d04.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddef0570690db3b804798ad28a011d04.exe"C:\Users\Admin\AppData\Local\Temp\ddef0570690db3b804798ad28a011d04.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\ddef0570690db3b804798ad28a011d04.exe"C:\Users\Admin\AppData\Local\Temp\ddef0570690db3b804798ad28a011d04.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:3324