52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722.exe
Size

330KB
MD5

0e555a0a44ab5d4ca550dfcf10968c6b
SHA1

59c8fd31589e42a53754d49a1f8d79050665db58
SHA256

52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722
SHA512

ec4c284153b2be390333a035d4dec1556de2bca5ae1aae1ee10efffdd8e8cf4ea0518de6e59563e1fb7762c7d371464dd1eb928b6eda94f4b610ec2b207a582e
SSDEEP

6144:xxAl+L7TuevSla3TdKQtK6f1g+GcG8DCqabJaqvAz:x2l+LdvSlItK60ctCq4Yz

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4980	qoixm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\Currentversion\Run	qoixm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{4CDAB5F0-556D-BCA0-9C47-614551B27B47} = "C:\\Users\\Admin\\AppData\\Roaming\\Deru\\qoixm.exe"	qoixm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5076 set thread context of 1752	5076	52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722.exe	82

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe
4980	qoixm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4980	5076	52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722.exe	81
PID 5076 wrote to memory of 4980	5076	52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722.exe	81
PID 5076 wrote to memory of 4980	5076	52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722.exe	81
PID 4980 wrote to memory of 2296	4980	qoixm.exe	42
PID 4980 wrote to memory of 2296	4980	qoixm.exe	42
PID 4980 wrote to memory of 2296	4980	qoixm.exe	42
PID 4980 wrote to memory of 2296	4980	qoixm.exe	42
PID 4980 wrote to memory of 2296	4980	qoixm.exe	42
PID 4980 wrote to memory of 2308	4980	qoixm.exe	43
PID 4980 wrote to memory of 2308	4980	qoixm.exe	43
PID 4980 wrote to memory of 2308	4980	qoixm.exe	43
PID 4980 wrote to memory of 2308	4980	qoixm.exe	43
PID 4980 wrote to memory of 2308	4980	qoixm.exe	43
PID 4980 wrote to memory of 2472	4980	qoixm.exe	77
PID 4980 wrote to memory of 2472	4980	qoixm.exe	77
PID 4980 wrote to memory of 2472	4980	qoixm.exe	77
PID 4980 wrote to memory of 2472	4980	qoixm.exe	77
PID 4980 wrote to memory of 2472	4980	qoixm.exe	77
PID 4980 wrote to memory of 2376	4980	qoixm.exe	69
PID 4980 wrote to memory of 2376	4980	qoixm.exe	69
PID 4980 wrote to memory of 2376	4980	qoixm.exe	69
PID 4980 wrote to memory of 2376	4980	qoixm.exe	69
PID 4980 wrote to memory of 2376	4980	qoixm.exe	69
PID 4980 wrote to memory of 1352	4980	qoixm.exe	68
PID 4980 wrote to memory of 1352	4980	qoixm.exe	68
PID 4980 wrote to memory of 1352	4980	qoixm.exe	68
PID 4980 wrote to memory of 1352	4980	qoixm.exe	68
PID 4980 wrote to memory of 1352	4980	qoixm.exe	68
PID 4980 wrote to memory of 3252	4980	qoixm.exe	67
PID 4980 wrote to memory of 3252	4980	qoixm.exe	67
PID 4980 wrote to memory of 3252	4980	qoixm.exe	67
PID 4980 wrote to memory of 3252	4980	qoixm.exe	67
PID 4980 wrote to memory of 3252	4980	qoixm.exe	67
PID 4980 wrote to memory of 3404	4980	qoixm.exe	65
PID 4980 wrote to memory of 3404	4980	qoixm.exe	65
PID 4980 wrote to memory of 3404	4980	qoixm.exe	65
PID 4980 wrote to memory of 3404	4980	qoixm.exe	65
PID 4980 wrote to memory of 3404	4980	qoixm.exe	65
PID 4980 wrote to memory of 3492	4980	qoixm.exe	64
PID 4980 wrote to memory of 3492	4980	qoixm.exe	64
PID 4980 wrote to memory of 3492	4980	qoixm.exe	64
PID 4980 wrote to memory of 3492	4980	qoixm.exe	64
PID 4980 wrote to memory of 3492	4980	qoixm.exe	64
PID 4980 wrote to memory of 3576	4980	qoixm.exe	63
PID 4980 wrote to memory of 3576	4980	qoixm.exe	63
PID 4980 wrote to memory of 3576	4980	qoixm.exe	63
PID 4980 wrote to memory of 3576	4980	qoixm.exe	63
PID 4980 wrote to memory of 3576	4980	qoixm.exe	63
PID 4980 wrote to memory of 3828	4980	qoixm.exe	62
PID 4980 wrote to memory of 3828	4980	qoixm.exe	62
PID 4980 wrote to memory of 3828	4980	qoixm.exe	62
PID 4980 wrote to memory of 3828	4980	qoixm.exe	62
PID 4980 wrote to memory of 3828	4980	qoixm.exe	62
PID 4980 wrote to memory of 4872	4980	qoixm.exe	60
PID 4980 wrote to memory of 4872	4980	qoixm.exe	60
PID 4980 wrote to memory of 4872	4980	qoixm.exe	60
PID 4980 wrote to memory of 4872	4980	qoixm.exe	60
PID 4980 wrote to memory of 4872	4980	qoixm.exe	60
PID 4980 wrote to memory of 4252	4980	qoixm.exe	50
PID 4980 wrote to memory of 4252	4980	qoixm.exe	50
PID 4980 wrote to memory of 4252	4980	qoixm.exe	50
PID 4980 wrote to memory of 4252	4980	qoixm.exe	50
PID 4980 wrote to memory of 4252	4980	qoixm.exe	50
PID 4980 wrote to memory of 5076	4980	qoixm.exe	80

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2308

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:4252

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3828

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3576

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3492

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3404

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1352

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2376
- C:\Users\Admin\AppData\Local\Temp\52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722.exe
  "C:\Users\Admin\AppData\Local\Temp\52a24cf49cb784b7b1986010b598a50f0d9d4644af9472ed8d1e2a0c94b2e722.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Users\Admin\AppData\Roaming\Deru\qoixm.exe
    "C:\Users\Admin\AppData\Roaming\Deru\qoixm.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpca10496d.bat"
    3⤵
    PID:1752

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpca10496d.bat

Filesize
307B

MD5
8e90dc47a720a65e8e35eca810d04887

SHA1
403a23b6802e8ead2ab7c62433bd33822f65ed3e

SHA256
79c31e99acb22bddebb9b9bb14116074fafce760c163788bfb9cf3fd2a90887b

SHA512
5b4f0543dfb24bb6d574bc521e6b5cdc1b6339fdb822f84d7e29b93fe6ff6e74b6bef2a9fe2f1bf92eb16990aab1ac7714dbb2a7ff5bdd05d79620e99fe41035

Download Submit
C:\Users\Admin\AppData\Roaming\Deru\qoixm.exe

Filesize
330KB

MD5
83931696ceb91a9446047960862fdb00

SHA1
6294b66ff8b01dad33753532347396345b86902f

SHA256
cf391f122aed920b45dcf651fb1f970e62caff9f7e31c83b5224aefca5c8e02b

SHA512
fd8131c4a5bab2571c68bed4fc3736f96bd9fd1e71d61f51035fb3a92f9fac866de0ef933b0adc1555f10eaf4b44e69f612e0550162a329858d550fd0163404a

Download Submit
C:\Users\Admin\AppData\Roaming\Deru\qoixm.exe

Filesize
330KB

MD5
83931696ceb91a9446047960862fdb00

SHA1
6294b66ff8b01dad33753532347396345b86902f

SHA256
cf391f122aed920b45dcf651fb1f970e62caff9f7e31c83b5224aefca5c8e02b

SHA512
fd8131c4a5bab2571c68bed4fc3736f96bd9fd1e71d61f51035fb3a92f9fac866de0ef933b0adc1555f10eaf4b44e69f612e0550162a329858d550fd0163404a

Download Submit
memory/1752-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1752-159-0x0000000000A00000-0x0000000000A47000-memory.dmp

Filesize
284KB

Download
memory/1752-158-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1752-157-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1752-156-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1752-155-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1752-154-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1752-152-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1752-146-0x0000000000A00000-0x0000000000A47000-memory.dmp

Filesize
284KB

Download
memory/4980-148-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4980-147-0x0000000001FA0000-0x0000000001FE7000-memory.dmp

Filesize
284KB

Download
memory/4980-161-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5076-142-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5076-150-0x0000000000720000-0x0000000000767000-memory.dmp

Filesize
284KB

Download
memory/5076-151-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5076-143-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5076-132-0x0000000000720000-0x0000000000767000-memory.dmp

Filesize
284KB

Download
memory/5076-144-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5076-141-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5076-140-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5076-139-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/5076-134-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5076-149-0x0000000002170000-0x00000000021B7000-memory.dmp

Filesize
284KB

Download
memory/5076-133-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5076-135-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download