Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 11:50

General

  • Target

    ddf0eae98a27510ce4060af0d7cfb106.exe

  • Size

    320KB

  • MD5

    ddf0eae98a27510ce4060af0d7cfb106

  • SHA1

    e6ecf2805413a1a812105603d4991899dad0111b

  • SHA256

    b98f8392e8aff131ce1415483c1e38750dabe7dcb8c0a42dcc66c5ad6b139933

  • SHA512

    6a01576a35ebedfd49fc574369874a4928561f3056b06d05605a1a3819a200b0da80c40b504493d4f544ad02a583a14ae4d950476e1106b74c0185dbea62b32a

  • SSDEEP

    3072:b2HheJxnhlGS2fqba1YncX6JIeZc2tQAp3dC2Zj/AZXk4jX4tFLk86gP9pWeT:ahoeSPMydrZc2yA7ZjwX8tW

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddf0eae98a27510ce4060af0d7cfb106.exe
    "C:\Users\Admin\AppData\Local\Temp\ddf0eae98a27510ce4060af0d7cfb106.exe"
    1⤵
    • Checks QEMU agent file
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Users\Admin\AppData\Local\Temp\ddf0eae98a27510ce4060af0d7cfb106.exe"
      2⤵
      • Checks QEMU agent file
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1384

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1384-6-0x00000000000D0000-0x00000000001D0000-memory.dmp

          Filesize

          1024KB

        • memory/1384-7-0x00000000000D0000-0x00000000001D0000-memory.dmp

          Filesize

          1024KB

        • memory/1384-8-0x00000000770C0000-0x0000000077269000-memory.dmp

          Filesize

          1.7MB

        • memory/1384-9-0x00000000772B0000-0x0000000077386000-memory.dmp

          Filesize

          856KB

        • memory/1384-12-0x00000000000D0000-0x00000000001D0000-memory.dmp

          Filesize

          1024KB

        • memory/2832-2-0x0000000000240000-0x0000000000252000-memory.dmp

          Filesize

          72KB

        • memory/2832-3-0x00000000770C0000-0x0000000077269000-memory.dmp

          Filesize

          1.7MB

        • memory/2832-4-0x00000000772B0000-0x0000000077386000-memory.dmp

          Filesize

          856KB

        • memory/2832-5-0x00000000772B0000-0x0000000077386000-memory.dmp

          Filesize

          856KB

        • memory/2832-10-0x0000000000240000-0x0000000000252000-memory.dmp

          Filesize

          72KB

        • memory/2832-13-0x0000000000240000-0x0000000000252000-memory.dmp

          Filesize

          72KB