Analysis
-
max time kernel
104s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
12-10-2022 17:58
General
-
Target
97557589ea7b2a424e58e3b875e4ad45c5aa4ba49fe3f154aae081a77ba69f5e.exe
-
Size
418KB
-
MD5
6cf0ff7f755b9fc0f35b107f0ae60e79
-
SHA1
b3e472a438e9335c828b5c17380b7ad554820595
-
SHA256
97557589ea7b2a424e58e3b875e4ad45c5aa4ba49fe3f154aae081a77ba69f5e
-
SHA512
98b4f8e0fe541d4f8b3ae236c1f5c770be8d49b45bbcd354c96a356e29b90585d6077ba60ba8a85d043137fbff19a571bca0a997a52f922068df43ea106b6c8f
-
SSDEEP
6144:PBXsRBP1ttbZO3l5QYktJKjAjTglZGE6w7ofGSsd97vbQI4FB+:+HPPz+AjUl56wVSsnF4D
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97557589ea7b2a424e58e3b875e4ad45c5aa4ba49fe3f154aae081a77ba69f5e.exe"C:\Users\Admin\AppData\Local\Temp\97557589ea7b2a424e58e3b875e4ad45c5aa4ba49fe3f154aae081a77ba69f5e.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Qhemaa.exeC:\Windows\Qhemaa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 6883⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4688 -ip 46881⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418KB
MD56cf0ff7f755b9fc0f35b107f0ae60e79
SHA1b3e472a438e9335c828b5c17380b7ad554820595
SHA25697557589ea7b2a424e58e3b875e4ad45c5aa4ba49fe3f154aae081a77ba69f5e
SHA51298b4f8e0fe541d4f8b3ae236c1f5c770be8d49b45bbcd354c96a356e29b90585d6077ba60ba8a85d043137fbff19a571bca0a997a52f922068df43ea106b6c8f
-
Filesize
418KB
MD56cf0ff7f755b9fc0f35b107f0ae60e79
SHA1b3e472a438e9335c828b5c17380b7ad554820595
SHA25697557589ea7b2a424e58e3b875e4ad45c5aa4ba49fe3f154aae081a77ba69f5e
SHA51298b4f8e0fe541d4f8b3ae236c1f5c770be8d49b45bbcd354c96a356e29b90585d6077ba60ba8a85d043137fbff19a571bca0a997a52f922068df43ea106b6c8f
-
Filesize
426B
MD557017105a32e4db659945e13b0522cb3
SHA16edb52954c4a3641ecad659c5a54da8f3f5c5ebc
SHA256021490fead19c5957a90764184159b5fed0b70e455dceff1d79028f848bd3d0d
SHA512a52245b8d5b383d19b4bf6a5932e20540733a36fd1be9188b8b21565bf5f62d7e41525a517942aafec326535c3f13634214e509a6e00c852ff5ff971112fd01b
-
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
232KB
-
Filesize
424KB
-
Filesize
232KB
-
Filesize
424KB
-
Filesize
232KB