Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 20:32
Static task
static1
Behavioral task
behavioral1
Sample
qvujt.lng.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
qvujt.lng.exe
Resource
win10-en-20211014
General
-
Target
qvujt.lng.exe
-
Size
292KB
-
MD5
5385a1ec75fc2b24e2c894d6a309ada0
-
SHA1
57f8a0229dce9ac9fb3d28420f470b0c277ba7c8
-
SHA256
8314ef4ef699f13b4f4a13b199cd58a253a1129c8842dc2717caccd4745865ec
-
SHA512
ad9802829ec1ee5952302271b211ccf02fe7789595cf7b4c6a213b83ba55fcf4614fcf663b2b0ae26f4426d9e81233cad17f5b1b1557a8920e51471e4f357b70
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 888 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
qvujt.lng.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\{E3E4EBBF-E909-3314-D6F3-A490A9CE6EFD} = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\cacls.exe" qvujt.lng.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exeqvujt.lng.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 qvujt.lng.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString qvujt.lng.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz qvujt.lng.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" svchost.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" svchost.exe -
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
qvujt.lng.exesvchost.exepid process 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 608 qvujt.lng.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe 888 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exefind.exedescription pid process Token: SeDebugPrivilege 888 svchost.exe Token: SeDebugPrivilege 596 find.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
qvujt.lng.exesvchost.exedescription pid process target process PID 608 wrote to memory of 888 608 qvujt.lng.exe svchost.exe PID 608 wrote to memory of 888 608 qvujt.lng.exe svchost.exe PID 608 wrote to memory of 888 608 qvujt.lng.exe svchost.exe PID 608 wrote to memory of 888 608 qvujt.lng.exe svchost.exe PID 608 wrote to memory of 888 608 qvujt.lng.exe svchost.exe PID 608 wrote to memory of 888 608 qvujt.lng.exe svchost.exe PID 608 wrote to memory of 888 608 qvujt.lng.exe svchost.exe PID 888 wrote to memory of 596 888 svchost.exe find.exe PID 888 wrote to memory of 596 888 svchost.exe find.exe PID 888 wrote to memory of 596 888 svchost.exe find.exe PID 888 wrote to memory of 596 888 svchost.exe find.exe PID 888 wrote to memory of 596 888 svchost.exe find.exe PID 888 wrote to memory of 596 888 svchost.exe find.exe PID 888 wrote to memory of 596 888 svchost.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qvujt.lng.exe"C:\Users\Admin\AppData\Local\Temp\qvujt.lng.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe2⤵
- Deletes itself
- Checks processor information in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Identities\cacls.exeMD5
5385a1ec75fc2b24e2c894d6a309ada0
SHA157f8a0229dce9ac9fb3d28420f470b0c277ba7c8
SHA2568314ef4ef699f13b4f4a13b199cd58a253a1129c8842dc2717caccd4745865ec
SHA512ad9802829ec1ee5952302271b211ccf02fe7789595cf7b4c6a213b83ba55fcf4614fcf663b2b0ae26f4426d9e81233cad17f5b1b1557a8920e51471e4f357b70
-
memory/596-98-0x0000000000100000-0x0000000000148000-memory.dmpFilesize
288KB
-
memory/596-95-0x0000000000100000-0x0000000000148000-memory.dmpFilesize
288KB
-
memory/596-94-0x0000000000000000-mapping.dmp
-
memory/608-55-0x0000000000240000-0x0000000000250000-memory.dmpFilesize
64KB
-
memory/608-56-0x0000000000250000-0x0000000000298000-memory.dmpFilesize
288KB
-
memory/608-59-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/608-60-0x0000000000250000-0x0000000000298000-memory.dmpFilesize
288KB
-
memory/608-54-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB
-
memory/888-62-0x0000000000080000-0x00000000000C8000-memory.dmpFilesize
288KB
-
memory/888-88-0x0000000076050000-0x0000000076160000-memory.dmpFilesize
1.1MB
-
memory/888-74-0x0000000075C40000-0x0000000075C87000-memory.dmpFilesize
284KB
-
memory/888-65-0x0000000000080000-0x00000000000C8000-memory.dmpFilesize
288KB
-
memory/888-82-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB
-
memory/888-84-0x0000000076050000-0x0000000076160000-memory.dmpFilesize
1.1MB
-
memory/888-83-0x0000000077DC0000-0x0000000077F40000-memory.dmpFilesize
1.5MB
-
memory/888-85-0x0000000075C40000-0x0000000075C87000-memory.dmpFilesize
284KB
-
memory/888-86-0x0000000077DC0000-0x0000000077F40000-memory.dmpFilesize
1.5MB
-
memory/888-70-0x0000000075C40000-0x0000000075C87000-memory.dmpFilesize
284KB
-
memory/888-87-0x0000000077DC0000-0x0000000077F40000-memory.dmpFilesize
1.5MB
-
memory/888-90-0x0000000076050000-0x0000000076160000-memory.dmpFilesize
1.1MB
-
memory/888-91-0x0000000077DC0000-0x0000000077F40000-memory.dmpFilesize
1.5MB
-
memory/888-89-0x0000000077DC0000-0x0000000077F40000-memory.dmpFilesize
1.5MB
-
memory/888-64-0x0000000000080000-0x00000000000C8000-memory.dmpFilesize
288KB
-
memory/888-63-0x0000000000000000-mapping.dmp
-
memory/888-61-0x00000000000D0000-0x0000000000119000-memory.dmpFilesize
292KB