90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc

Analysis

max time kernel
262s
max time network
183s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
11-09-2022 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
Size

2.7MB
MD5

c300e95c5387e917ea8b820a4f12ff26
SHA1

06a3e25555589e730f632dd2873381846f9003c8
SHA256

90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc
SHA512

e965a680128bc034617448149c43a500f20338e5f549f1e19e3c8f9f2b923b16b19354f6cedee327d1e829c920e19d970fd2c20a4b5143b5672c12449b5e2454
SSDEEP

49152:Iu3GPkg54jeclLyM6iDT1dYCHngsQAjE+Ca7rrExbs1ornY3dsZRKYFHE:f3GX4D6g1d7HnLZwqHrQRnYNsnKYFH

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3572	mqbkup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
3572	mqbkup.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	1148	WerFault.exe	65

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4100	schtasks.exe
3860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
3572	mqbkup.exe
3572	mqbkup.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3860	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	67
PID 1148 wrote to memory of 3860	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	67
PID 1148 wrote to memory of 3860	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	67
PID 1148 wrote to memory of 3416	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	69
PID 1148 wrote to memory of 3416	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	69
PID 1148 wrote to memory of 3416	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	69
PID 1148 wrote to memory of 4100	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	71
PID 1148 wrote to memory of 4100	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	71
PID 1148 wrote to memory of 4100	1148	90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe	71

C:\Users\Admin\AppData\Local\Temp\90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe
"C:\Users\Admin\AppData\Local\Temp\90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3860
- C:\Windows\SysWOW64\schtasks.exe
  /C /Query /XML /TN "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}"
  2⤵
  PID:3416
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\67765327532705345647"
  2⤵
  - Creates scheduled task(s)
  PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 856
  2⤵
  - Program crash
  PID:1892

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\67765327532705345647

Filesize
1KB

MD5
1a1af8a390890aa01c7a0671241a65a5

SHA1
5ac6ef6b0645a63f38f773d46b3fc3fd6c0af878

SHA256
dda37081f9839c2ec90cecd825e627fa8ac0ff3254b861039dd94a667ff7f24c

SHA512
2e25d11522429a28a3bc262df555f6c014c1e5393ec49739ebff14684b6e201ea9fd0ec8ed3fd7be60ddba4be92691d95a99c25517d84a6e6f30a025b12f9c25

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe

Filesize
2.7MB

MD5
c300e95c5387e917ea8b820a4f12ff26

SHA1
06a3e25555589e730f632dd2873381846f9003c8

SHA256
90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc

SHA512
e965a680128bc034617448149c43a500f20338e5f549f1e19e3c8f9f2b923b16b19354f6cedee327d1e829c920e19d970fd2c20a4b5143b5672c12449b5e2454

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe

Filesize
2.7MB

MD5
c300e95c5387e917ea8b820a4f12ff26

SHA1
06a3e25555589e730f632dd2873381846f9003c8

SHA256
90f6b0a1f6bf9a503f3107325e0b4abdf8807bb971f7c37cc6a8ed71cfb0e8bc

SHA512
e965a680128bc034617448149c43a500f20338e5f549f1e19e3c8f9f2b923b16b19354f6cedee327d1e829c920e19d970fd2c20a4b5143b5672c12449b5e2454

Download Submit
memory/1148-155-0x000000007E4E0000-0x000000007E8B1000-memory.dmp

Filesize
3.8MB

Download
memory/1148-169-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-123-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-121-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-124-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-125-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-126-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-127-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-128-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-129-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-130-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-131-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-132-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-133-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-134-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-156-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-136-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-137-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-139-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-138-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-140-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-141-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-142-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-143-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-144-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-145-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-146-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-147-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-148-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-149-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-150-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-151-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-152-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-153-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-154-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-120-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-135-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-157-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-122-0x0000000000210000-0x0000000000E8F000-memory.dmp

Filesize
12.5MB

Download
memory/1148-159-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-160-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-161-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-162-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-163-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-164-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-165-0x0000000000210000-0x0000000000E8F000-memory.dmp

Filesize
12.5MB

Download
memory/1148-166-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-167-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-168-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-158-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-170-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-171-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-172-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-173-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-174-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-175-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/1148-232-0x000000007E4E0000-0x000000007E8B1000-memory.dmp

Filesize
3.8MB

Download
memory/3572-278-0x0000000001260000-0x0000000001EDF000-memory.dmp

Filesize
12.5MB

Download
memory/3572-290-0x000000007EAE0000-0x000000007EEB1000-memory.dmp

Filesize
3.8MB

Download
memory/3572-289-0x0000000001260000-0x0000000001EDF000-memory.dmp

Filesize
12.5MB

Download
memory/3572-280-0x000000007EAE0000-0x000000007EEB1000-memory.dmp

Filesize
3.8MB

Download
memory/3860-179-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-181-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-177-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-180-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-184-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-178-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-182-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-185-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-186-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-187-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download
memory/3860-183-0x0000000076FB0000-0x000000007713E000-memory.dmp

Filesize
1.6MB

Download