Overview

overview

10

Static

static

2d43181992...ea.exe

windows7-x64

10

2d43181992...ea.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 09:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea.exe

  • Size

    198KB

  • MD5

    316e5cc5e5d73244b7a0d92e0994d552

  • SHA1

    a627f2c2387fc82fbe524f7d6b5a8abf22f09ac4

  • SHA256

    2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea

  • SHA512

    9f1507dd72988d95874e3e7ebb8967213bd827017c09f174222625c8106001a2c17f0a4e39bc685caa87ad7769fd393f0fcbd409950538803306d97ef9db5958

  • SSDEEP

    6144:OnTrHfU2yqT0nFC7wkZuUm0wgzaqQE0Fzz1Q:OnnHszqoFC7whrm+DE0w

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 17 IoCs
    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea.exe
    "C:\Users\Admin\AppData\Local\Temp\2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\qbq.exe
      "C:\Users\Admin\AppData\Local\qbq.exe" -gav C:\Users\Admin\AppData\Local\Temp\2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Deletes itself
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1324
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x590
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1000

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\qbq.exe
    Filesize

    198KB

    MD5

    316e5cc5e5d73244b7a0d92e0994d552

    SHA1

    a627f2c2387fc82fbe524f7d6b5a8abf22f09ac4

    SHA256

    2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea

    SHA512

    9f1507dd72988d95874e3e7ebb8967213bd827017c09f174222625c8106001a2c17f0a4e39bc685caa87ad7769fd393f0fcbd409950538803306d97ef9db5958

    Download Submit

  • C:\Users\Admin\AppData\Local\qbq.exe
    Filesize

    198KB

    MD5

    316e5cc5e5d73244b7a0d92e0994d552

    SHA1

    a627f2c2387fc82fbe524f7d6b5a8abf22f09ac4

    SHA256

    2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea

    SHA512

    9f1507dd72988d95874e3e7ebb8967213bd827017c09f174222625c8106001a2c17f0a4e39bc685caa87ad7769fd393f0fcbd409950538803306d97ef9db5958

    Download Submit

  • \Users\Admin\AppData\Local\qbq.exe
    Filesize

    198KB

    MD5

    316e5cc5e5d73244b7a0d92e0994d552

    SHA1

    a627f2c2387fc82fbe524f7d6b5a8abf22f09ac4

    SHA256

    2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea

    SHA512

    9f1507dd72988d95874e3e7ebb8967213bd827017c09f174222625c8106001a2c17f0a4e39bc685caa87ad7769fd393f0fcbd409950538803306d97ef9db5958

    Download Submit

  • \Users\Admin\AppData\Local\qbq.exe
    Filesize

    198KB

    MD5

    316e5cc5e5d73244b7a0d92e0994d552

    SHA1

    a627f2c2387fc82fbe524f7d6b5a8abf22f09ac4

    SHA256

    2d431819926de331e0fce87860ad5278e08de21aadbb055b1a81044ce5a1acea

    SHA512

    9f1507dd72988d95874e3e7ebb8967213bd827017c09f174222625c8106001a2c17f0a4e39bc685caa87ad7769fd393f0fcbd409950538803306d97ef9db5958

    Download Submit

  • memory/1324-64-0x000007FEFB1A1000-0x000007FEFB1A3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1728-58-0x0000000002210000-0x00000000024C7000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/1728-54-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1728-57-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1728-63-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1728-56-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1728-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1908-68-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1908-69-0x0000000000260000-0x0000000000266000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1908-70-0x00000000741D1000-0x00000000741D3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1908-71-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

    Download