Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 20:32
Static task
static1
Behavioral task
behavioral1
Sample
qvujt.lng.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
qvujt.lng.exe
Resource
win10-en-20211014
General
-
Target
qvujt.lng.exe
-
Size
292KB
-
MD5
5385a1ec75fc2b24e2c894d6a309ada0
-
SHA1
57f8a0229dce9ac9fb3d28420f470b0c277ba7c8
-
SHA256
8314ef4ef699f13b4f4a13b199cd58a253a1129c8842dc2717caccd4745865ec
-
SHA512
ad9802829ec1ee5952302271b211ccf02fe7789595cf7b4c6a213b83ba55fcf4614fcf663b2b0ae26f4426d9e81233cad17f5b1b1557a8920e51471e4f357b70
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
osk.exepid process 3488 osk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
qvujt.lng.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\{D2619F50-8B95-9014-46B3-3B32A8FB23BE} = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\7s9k05ye.default-release\\datareporting\\archived\\auditpol.exe" qvujt.lng.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1812 3456 WerFault.exe qvujt.lng.exe 820 3488 WerFault.exe osk.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
qvujt.lng.exeosk.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 qvujt.lng.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString qvujt.lng.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz qvujt.lng.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 osk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString osk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz osk.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
xcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
Processes:
osk.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" osk.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
osk.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" osk.exe -
Processes:
osk.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main osk.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
qvujt.lng.exepid process 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe 3456 qvujt.lng.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
WerFault.exeosk.exexcopy.exeWerFault.exedescription pid process Token: SeRestorePrivilege 1812 WerFault.exe Token: SeBackupPrivilege 1812 WerFault.exe Token: SeDebugPrivilege 1812 WerFault.exe Token: SeDebugPrivilege 3488 osk.exe Token: SeDebugPrivilege 1468 xcopy.exe Token: SeDebugPrivilege 820 WerFault.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
qvujt.lng.exeosk.exedescription pid process target process PID 3456 wrote to memory of 3488 3456 qvujt.lng.exe osk.exe PID 3456 wrote to memory of 3488 3456 qvujt.lng.exe osk.exe PID 3456 wrote to memory of 3488 3456 qvujt.lng.exe osk.exe PID 3456 wrote to memory of 3488 3456 qvujt.lng.exe osk.exe PID 3456 wrote to memory of 3488 3456 qvujt.lng.exe osk.exe PID 3456 wrote to memory of 3488 3456 qvujt.lng.exe osk.exe PID 3488 wrote to memory of 1468 3488 osk.exe xcopy.exe PID 3488 wrote to memory of 1468 3488 osk.exe xcopy.exe PID 3488 wrote to memory of 1468 3488 osk.exe xcopy.exe PID 3488 wrote to memory of 1468 3488 osk.exe xcopy.exe PID 3488 wrote to memory of 1468 3488 osk.exe xcopy.exe PID 3488 wrote to memory of 1468 3488 osk.exe xcopy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qvujt.lng.exe"C:\Users\Admin\AppData\Local\Temp\qvujt.lng.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 11482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\osk.exeC:\Windows\System32\osk.exe2⤵
- Deletes itself
- Checks processor information in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xcopy.exeC:\Windows\System32\xcopy.exe3⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 15163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7s9k05ye.default-release\datareporting\archived\auditpol.exeMD5
5385a1ec75fc2b24e2c894d6a309ada0
SHA157f8a0229dce9ac9fb3d28420f470b0c277ba7c8
SHA2568314ef4ef699f13b4f4a13b199cd58a253a1129c8842dc2717caccd4745865ec
SHA512ad9802829ec1ee5952302271b211ccf02fe7789595cf7b4c6a213b83ba55fcf4614fcf663b2b0ae26f4426d9e81233cad17f5b1b1557a8920e51471e4f357b70
-
memory/1468-145-0x0000000000860000-0x00000000008A8000-memory.dmpFilesize
288KB
-
memory/1468-142-0x0000000000860000-0x00000000008A8000-memory.dmpFilesize
288KB
-
memory/1468-141-0x0000000000000000-mapping.dmp
-
memory/3456-115-0x0000000002200000-0x0000000002248000-memory.dmpFilesize
288KB
-
memory/3456-119-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/3456-118-0x0000000002180000-0x0000000002190000-memory.dmpFilesize
64KB
-
memory/3456-120-0x0000000002200000-0x0000000002248000-memory.dmpFilesize
288KB
-
memory/3488-130-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3488-136-0x0000000075530000-0x00000000756F2000-memory.dmpFilesize
1.8MB
-
memory/3488-128-0x0000000075530000-0x00000000756F2000-memory.dmpFilesize
1.8MB
-
memory/3488-131-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3488-133-0x0000000075530000-0x00000000756F2000-memory.dmpFilesize
1.8MB
-
memory/3488-134-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3488-135-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3488-129-0x0000000074F10000-0x0000000075494000-memory.dmpFilesize
5.5MB
-
memory/3488-137-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3488-138-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3488-139-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3488-126-0x0000000000230000-0x0000000000278000-memory.dmpFilesize
288KB
-
memory/3488-125-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3488-122-0x0000000000230000-0x0000000000278000-memory.dmpFilesize
288KB
-
memory/3488-121-0x0000000000000000-mapping.dmp