26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749

General

Target

26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
Size

182KB
MD5

366d1773468b870f7c6107efb0e9aa70
SHA1

4a8ad564be4460824e5e6048246213d40161c394
SHA256

26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749
SHA512

1a142a296d267ff2931ffe1709a9bc9890ced9ce105e22eb8650e154ecd32fb45294d871667c1e27a2d5813ef853fb9f606225431c59196b8b75a798fe9d4f1f
SSDEEP

3072:g96kfLhHSdldQEcRIPOBU4OkvDxutbY1ufFCqZ9rcbCE0M4HJ29Yv:g96kfLVSl3cKJ4OkbcbkwCqZ9rfM4Hz

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

39 1756 rundll32.exe
42 1756 rundll32.exe

flow	pid	process
39	1756	rundll32.exe
42	1756	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QQjtl\Parameters\ServiceDll	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe

Loads dropped DLL 3 IoCs

Processes:

26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exesvchost.exerundll32.exe

pid process

4816 26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
3068 svchost.exe
1756 rundll32.exe

Drops file in Program Files directory 2 IoCs

Processes:

26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe

description	ioc	process
File created	C:\Program Files (x86)\wi240568375nd.temp	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
File created	C:\Program Files (x86)\wi240568421nd.temp	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe

Drops file in Windows directory 3 IoCs

Processes:

26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe

description	ioc	process
File opened for modification	C:\Windows\MySomeInfo.ini	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
File created	C:\Windows\HowArMe.txt	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
File created	C:\Windows\HowArMe.reg	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDwARE\DESCRIPTIoN\System\CeNtralProcessoR\0	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exerundll32.exe

pid	process
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe
1756	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exesvchost.exe

description	pid	process
Token: SeBackupPrivilege	4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
Token: SeRestorePrivilege	4816	26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
Token: SeDebugPrivilege	3068	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 3068 wrote to memory of 1756	3068	svchost.exe	rundll32.exe
PID 3068 wrote to memory of 1756	3068	svchost.exe	rundll32.exe
PID 3068 wrote to memory of 1756	3068	svchost.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe
"C:\Users\Admin\AppData\Local\Temp\26f8ac295a2947028e47839e346ccf0926dcd28b7f500009f385a18c6ebf8749.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\debug.dll,CodeMain QQjtl
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Internet Explorer\360liveupdate.dll

Filesize
20.0MB

MD5
7d4a807d6782800096525841deeb9493

SHA1
aa667e1e9ed92e8bf21f417a782a26f3a99c61c7

SHA256
e9010c23e5ad32d24bf73266edbbfe9e2a59bcee5918a140dcbb5f8a60e976a9

SHA512
ead2fd928e98f996dcd51584dca9395ebd4baa55868ef6aed3bf7e1ce69d74275ae5b2b604b6fb6e0ad3325841fa10e71bfcbc67e9bf15a5b6a22e9d9d030482

Download Submit
C:\Windows\SysWOW64\Debug.dll

Filesize
20.1MB

MD5
ddf944e3d426bebc6f2b853ddb49d92e

SHA1
8b86440f68a51605028b0957192b1a026f87e972

SHA256
bbb84ec1d6e108cea531a62237304b0921e09fe250cbfcf7b4580f93df9ef886

SHA512
6071d9533bf73d08788d1ec00893c6a8cf0b74e312a052c2e20bc5423b986a18643349f2bbd3e6be812c757a2bd60bfc204e5cf817281e0418ca99f6482573d9

Download Submit
C:\Windows\SysWOW64\Debug.dll

Filesize
20.1MB

MD5
ddf944e3d426bebc6f2b853ddb49d92e

SHA1
8b86440f68a51605028b0957192b1a026f87e972

SHA256
bbb84ec1d6e108cea531a62237304b0921e09fe250cbfcf7b4580f93df9ef886

SHA512
6071d9533bf73d08788d1ec00893c6a8cf0b74e312a052c2e20bc5423b986a18643349f2bbd3e6be812c757a2bd60bfc204e5cf817281e0418ca99f6482573d9

Download Submit
\??\c:\windows\SysWOW64\debug.dll

Filesize
20.1MB

MD5
ddf944e3d426bebc6f2b853ddb49d92e

SHA1
8b86440f68a51605028b0957192b1a026f87e972

SHA256
bbb84ec1d6e108cea531a62237304b0921e09fe250cbfcf7b4580f93df9ef886

SHA512
6071d9533bf73d08788d1ec00893c6a8cf0b74e312a052c2e20bc5423b986a18643349f2bbd3e6be812c757a2bd60bfc204e5cf817281e0418ca99f6482573d9

Download Submit
memory/1756-137-0x0000000000000000-mapping.dmp

Download
memory/4816-133-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4816-135-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads