cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e

Analysis

max time kernel
185s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe
Size

722KB
MD5

a1329e138d02a4043ffbab3fc6c6a2b0
SHA1

19451a72e6cde7f3a95d4c8205e14ea836f7be49
SHA256

cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e
SHA512

7eb8c1a69990186e91d10b4ebe898c5b46bd535b7daf483a8f16baabeca067a1aa905b7f7b803dd65f9c184a010681c60e162913b9df9ebc46a61df67e0c26ac
SSDEEP

12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D02tESgDAHJkgKKyHEJ0bXPxx5:P1/aGLDCM4D8ayGMTd0pVNykJ0bXPxx5

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1744	qlboq.exe

Loads dropped DLL 2 IoCs

pid	Process
1876	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe
1876	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\qlboq.exe"	qlboq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1744	1876	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe	28
PID 1876 wrote to memory of 1744	1876	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe	28
PID 1876 wrote to memory of 1744	1876	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe	28
PID 1876 wrote to memory of 1744	1876	cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe	28

C:\Users\Admin\AppData\Local\Temp\cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe
"C:\Users\Admin\AppData\Local\Temp\cba8ea730673d20e6460ecc38076865f5ebdf4049a94bd569654a330f4fef72e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876
- C:\ProgramData\qlboq.exe
  "C:\ProgramData\qlboq.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Saaaalamm\Mira.h

Filesize
268KB

MD5
15cccb964efeeb58f9cd8ebf5757b3a1

SHA1
cda2c453e19b020166b7a89d4389d33300a7febb

SHA256
4dbb6abdd207bfb4d794a8305d28e352deb8281efe70e4365d05263f80c395a7

SHA512
b933d0a0ca1ea341d0ef24903b68f09115859515b1949be109f05b414a2656e16bba686edac405fc9174ddbbf0942abf8042707b82a7382782ca3b838f8628fa

Download Submit
C:\ProgramData\qlboq.exe

Filesize
454KB

MD5
de4b81491d5ba7e89509223690329dc6

SHA1
e41fe9b45d7859c8b1867100884bc322d6bf9ac4

SHA256
c4bce6b0bf060138d4161be6e0e7c8414e04838e73d07929a1c12ade3b2f521f

SHA512
ade0e4c0b407f89f1190abb470f551894c3b1c0b3c053456188b28e1a708175a9d9fc67852d5155d7c40f6135a280992d36230623eaf6a459f07ded4d20999d7

Download Submit
C:\ProgramData\qlboq.exe

Filesize
454KB

MD5
de4b81491d5ba7e89509223690329dc6

SHA1
e41fe9b45d7859c8b1867100884bc322d6bf9ac4

SHA256
c4bce6b0bf060138d4161be6e0e7c8414e04838e73d07929a1c12ade3b2f521f

SHA512
ade0e4c0b407f89f1190abb470f551894c3b1c0b3c053456188b28e1a708175a9d9fc67852d5155d7c40f6135a280992d36230623eaf6a459f07ded4d20999d7

Download Submit
\ProgramData\qlboq.exe

Filesize
454KB

MD5
de4b81491d5ba7e89509223690329dc6

SHA1
e41fe9b45d7859c8b1867100884bc322d6bf9ac4

SHA256
c4bce6b0bf060138d4161be6e0e7c8414e04838e73d07929a1c12ade3b2f521f

SHA512
ade0e4c0b407f89f1190abb470f551894c3b1c0b3c053456188b28e1a708175a9d9fc67852d5155d7c40f6135a280992d36230623eaf6a459f07ded4d20999d7

Download Submit
\ProgramData\qlboq.exe

Filesize
454KB

MD5
de4b81491d5ba7e89509223690329dc6

SHA1
e41fe9b45d7859c8b1867100884bc322d6bf9ac4

SHA256
c4bce6b0bf060138d4161be6e0e7c8414e04838e73d07929a1c12ade3b2f521f

SHA512
ade0e4c0b407f89f1190abb470f551894c3b1c0b3c053456188b28e1a708175a9d9fc67852d5155d7c40f6135a280992d36230623eaf6a459f07ded4d20999d7

Download Submit
memory/1876-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download