Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 11:50
Static task
static1
Behavioral task
behavioral1
Sample
ddf0eae98a27510ce4060af0d7cfb106.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ddf0eae98a27510ce4060af0d7cfb106.exe
Resource
win10v2004-20240226-en
General
-
Target
ddf0eae98a27510ce4060af0d7cfb106.exe
-
Size
320KB
-
MD5
ddf0eae98a27510ce4060af0d7cfb106
-
SHA1
e6ecf2805413a1a812105603d4991899dad0111b
-
SHA256
b98f8392e8aff131ce1415483c1e38750dabe7dcb8c0a42dcc66c5ad6b139933
-
SHA512
6a01576a35ebedfd49fc574369874a4928561f3056b06d05605a1a3819a200b0da80c40b504493d4f544ad02a583a14ae4d950476e1106b74c0185dbea62b32a
-
SSDEEP
3072:b2HheJxnhlGS2fqba1YncX6JIeZc2tQAp3dC2Zj/AZXk4jX4tFLk86gP9pWeT:ahoeSPMydrZc2yA7ZjwX8tW
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ddf0eae98a27510ce4060af0d7cfb106.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\circumnutatory = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Chield5\\ecarte.exe" ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4764 ddf0eae98a27510ce4060af0d7cfb106.exe 112 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4764 set thread context of 112 4764 ddf0eae98a27510ce4060af0d7cfb106.exe 104 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4764 ddf0eae98a27510ce4060af0d7cfb106.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4764 ddf0eae98a27510ce4060af0d7cfb106.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4764 wrote to memory of 112 4764 ddf0eae98a27510ce4060af0d7cfb106.exe 104 PID 4764 wrote to memory of 112 4764 ddf0eae98a27510ce4060af0d7cfb106.exe 104 PID 4764 wrote to memory of 112 4764 ddf0eae98a27510ce4060af0d7cfb106.exe 104 PID 4764 wrote to memory of 112 4764 ddf0eae98a27510ce4060af0d7cfb106.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddf0eae98a27510ce4060af0d7cfb106.exe"C:\Users\Admin\AppData\Local\Temp\ddf0eae98a27510ce4060af0d7cfb106.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\ddf0eae98a27510ce4060af0d7cfb106.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:3120