29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458

General

Target

29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
Size

110KB
MD5

92d10ea8c6e4ba09b890ed3442366b05
SHA1

99336c983b2be7d2a36cba42f063edbebcc7ef61
SHA256

29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458
SHA512

7fabfa95a31fef4ee5be8e5bd86d26b2b2b139c6932dc03f98aa4701f988ecc78b017c46bbd721e2f1b62098247680f0a275696643dc4d6af1622bd54cbb4df8
SSDEEP

1536:5axYRgCriHeTsxKWbIvMEJzZ6f+w3EKy3w2FzdycPBtS5K/W2OrD0ixZb1:oMriHszt5v6f+/w2JUsLS5K/W2OTxZZ

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:\windows\iqs.exe = "c:\\windows\\iqs.exe:*:Enabled:Microsoft Firevall Engine"	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe

Executes dropped EXE 1 IoCs

Processes:

iqs.exe

pid process

888 iqs.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1532 netsh.exe

pid	process
888	iqs.exe

pid	process
1532	netsh.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1112-55-0x0000000000400000-0x00000000004C0000-memory.dmp	upx
behavioral1/memory/1112-58-0x0000000000400000-0x00000000004C0000-memory.dmp	upx
behavioral1/memory/888-60-0x0000000000400000-0x00000000004C0000-memory.dmp	upx
behavioral1/memory/888-61-0x0000000000400000-0x00000000004C0000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iqs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	iqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Firevall Engine = "c:\\windows\\iqs.exe"	iqs.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	iqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Firevall Engine = "c:\\windows\\iqs.exe"	iqs.exe

Drops file in Windows directory 3 IoCs

Processes:

29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exeiqs.exe

description	ioc	process
File created	\??\c:\windows\iqs.exe	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
File opened for modification	\??\c:\windows\iqs.exe	iqs.exe
File opened for modification	\??\c:\windows\iqs.exe	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exeiqs.exe

pid	process
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
888	iqs.exe
888	iqs.exe
888	iqs.exe
888	iqs.exe
888	iqs.exe
888	iqs.exe
888	iqs.exe
888	iqs.exe
888	iqs.exe
888	iqs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exeiqs.exe

description	pid	process
Token: SeDebugPrivilege	1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
Token: SeDebugPrivilege	888	iqs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exeiqs.exe

description	pid	process	target process
PID 1112 wrote to memory of 888	1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe	iqs.exe
PID 1112 wrote to memory of 888	1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe	iqs.exe
PID 1112 wrote to memory of 888	1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe	iqs.exe
PID 1112 wrote to memory of 888	1112	29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe	iqs.exe
PID 888 wrote to memory of 1532	888	iqs.exe	netsh.exe
PID 888 wrote to memory of 1532	888	iqs.exe	netsh.exe
PID 888 wrote to memory of 1532	888	iqs.exe	netsh.exe
PID 888 wrote to memory of 1532	888	iqs.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe
"C:\Users\Admin\AppData\Local\Temp\29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458.exe"
1⤵
- Modifies firewall policy service
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

\??\c:\windows\iqs.exe
c:\windows\iqs.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "c:\windows\iqs.exe" "MSN Messenger" ENABLE
3⤵
- Modifies Windows Firewall
PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\iqs.exe
Filesize
110KB

MD5
92d10ea8c6e4ba09b890ed3442366b05

SHA1
99336c983b2be7d2a36cba42f063edbebcc7ef61

SHA256
29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458

SHA512
7fabfa95a31fef4ee5be8e5bd86d26b2b2b139c6932dc03f98aa4701f988ecc78b017c46bbd721e2f1b62098247680f0a275696643dc4d6af1622bd54cbb4df8

Download Submit
\??\c:\windows\iqs.exe
Filesize
110KB

MD5
92d10ea8c6e4ba09b890ed3442366b05

SHA1
99336c983b2be7d2a36cba42f063edbebcc7ef61

SHA256
29fd67537c2cfd0e858ac27ea12900a374594c3ab2c629115f5aa0e5fd664458

SHA512
7fabfa95a31fef4ee5be8e5bd86d26b2b2b139c6932dc03f98aa4701f988ecc78b017c46bbd721e2f1b62098247680f0a275696643dc4d6af1622bd54cbb4df8

Download Submit
memory/888-56-0x0000000000000000-mapping.dmp

Download
memory/888-60-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/888-61-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1112-54-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1112-58-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1532-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads