90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc

General

Target

90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
Size

2.7MB
MD5

c300e95c5387e917ea8b820a4f12ff26
SHA1

06a3e25555589e730f632dd2873381846f9003c8
SHA256

90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc
SHA512

e965a680128bc034617448149c43a500f20338e5f549f1e19e3c8f9f2b923b16b19354f6cedee327d1e829c920e19d970fd2c20a4b5143b5672c12449b5e2454
SSDEEP

49152:Iu3GPkg54jeclLyM6iDT1dYCHngsQAjE+Ca7rrExbs1ornY3dsZRKYFHE:f3GX4D6g1d7HnLZwqHrQRnYNsnKYFH

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1876	mqbkup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
1876	mqbkup.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1376	WerFault.exe	25

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1896	schtasks.exe
1176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
1876	mqbkup.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1896	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	27
PID 1376 wrote to memory of 1896	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	27
PID 1376 wrote to memory of 1896	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	27
PID 1376 wrote to memory of 1896	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	27
PID 1376 wrote to memory of 1768	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	29
PID 1376 wrote to memory of 1768	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	29
PID 1376 wrote to memory of 1768	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	29
PID 1376 wrote to memory of 1768	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	29
PID 1376 wrote to memory of 1756	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	32
PID 1376 wrote to memory of 1756	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	32
PID 1376 wrote to memory of 1756	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	32
PID 1376 wrote to memory of 1756	1376	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	32
PID 1640 wrote to memory of 1876	1640	taskeng.exe	34
PID 1640 wrote to memory of 1876	1640	taskeng.exe	34
PID 1640 wrote to memory of 1876	1640	taskeng.exe	34
PID 1640 wrote to memory of 1876	1640	taskeng.exe	34

C:\Users\Admin\AppData\Local\Temp\90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
"C:\Users\Admin\AppData\Local\Temp\90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1896
- C:\Windows\SysWOW64\schtasks.exe
  /C /Query /XML /TN "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}"
  2⤵
  PID:1768
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\67765327532705345647"
  2⤵
  - Creates scheduled task(s)
  PID:1176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 408
  2⤵
  - Program crash
  PID:1756

C:\Windows\system32\taskeng.exe
taskeng.exe {536B31A7-E8E4-40F7-A573-EFF512EB536C} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe

Filesize
2.7MB

MD5
c300e95c5387e917ea8b820a4f12ff26

SHA1
06a3e25555589e730f632dd2873381846f9003c8

SHA256
90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc

SHA512
e965a680128bc034617448149c43a500f20338e5f549f1e19e3c8f9f2b923b16b19354f6cedee327d1e829c920e19d970fd2c20a4b5143b5672c12449b5e2454

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe

Filesize
2.7MB

MD5
c300e95c5387e917ea8b820a4f12ff26

SHA1
06a3e25555589e730f632dd2873381846f9003c8

SHA256
90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc

SHA512
e965a680128bc034617448149c43a500f20338e5f549f1e19e3c8f9f2b923b16b19354f6cedee327d1e829c920e19d970fd2c20a4b5143b5672c12449b5e2454

Download Submit
memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1376-58-0x00000000001E0000-0x0000000000E5F000-memory.dmp

Filesize
12.5MB

Download
memory/1376-59-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1876-64-0x00000000011B0000-0x0000000001E2F000-memory.dmp

Filesize
12.5MB

Download
memory/1876-65-0x00000000011B0000-0x0000000001E2F000-memory.dmp

Filesize
12.5MB

Download
memory/1876-66-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads