Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 21:36
Static task
static1
Behavioral task
behavioral1
Sample
07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe
-
Size
269KB
-
MD5
d2e31c73af82cd670b487cf9bb5daf7f
-
SHA1
7954c56dc41baff77c51d9b52626fe8bb9298751
-
SHA256
07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b
-
SHA512
e682bb8137a21956e37594bbd1a20007a9f6938ef56db9be19dea04b8e61584db398a81dbf6c842c24deb705150d4f38403143dff33d38b250aefcfd7abd44e7
-
SSDEEP
6144:X1ssjw8OeS6xxJUwM5ew23FIgWcU7ipzWKXzY:usketJUB5ew2yuU7iNfE
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe -
Loads dropped DLL 1 IoCs
pid Process 2308 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2308 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe 5048 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2308 set thread context of 5048 2308 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe 84 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\Sjakaltpperne\Uselviskheds\Konversationsleksikons227\Retsforflgelsernes.Man 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2308 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 5048 2308 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe 84 PID 2308 wrote to memory of 5048 2308 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe 84 PID 2308 wrote to memory of 5048 2308 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe 84 PID 2308 wrote to memory of 5048 2308 07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe"C:\Users\Admin\AppData\Local\Temp\07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe"C:\Users\Admin\AppData\Local\Temp\07b35bc0d76eebc56cd228b1212d08f693cbefcad6878970b626b0ac1809a55b.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5792b6f86e296d3904285b2bf67ccd7e0
SHA1966b16f84697552747e0ddd19a4ba8ab5083af31
SHA256c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
SHA51297edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c