Analysis
-
max time kernel
247s -
max time network
339s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:25
Static task
static1
Behavioral task
behavioral1
Sample
96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe
Resource
win10v2004-20221111-en
General
-
Target
96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe
-
Size
225KB
-
MD5
0516e57beb0b7b716f6b5fd138a3a9d6
-
SHA1
14db1c62a45108b725cec294928c33e12415d900
-
SHA256
96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61
-
SHA512
199662f06bc7106b1164462eb143dc5c7835237689f7a8426d92a603df5779f0d0ca592f2d36b6a75b1b15ed1a4e0485a53bee943e475a409eb781d16fc4ebd6
-
SSDEEP
3072:XC/sHTUt0pfM90Ckr01V3CdqQFxXWVZJtN7TD3sCSBo+nuikD91L6TrDIJ7YmWt:XC/sHot0p/Q30yJtVgCH+29Uf1
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List explorer.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\taskhost.exe = "C:\\Windows\\system32\\taskhost.exe:*:Enabled:Host Process for Windows Tasks" explorer.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\taskhostex.exe = "C:\\Windows\\system32\\taskhostex.exe:*:Enabled:Host Process for Windows Tasks" explorer.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\explorer.exe = "C:\\Windows\\explorer.exe:*:Enabled:Windows Explorer" explorer.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\explorer.exe = "C:\\Windows\\SysWOW64\\explorer.exe:*:Enabled:Windows Explorer" explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
qeum.exepid process 1444 qeum.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 572 explorer.exe -
Loads dropped DLL 1 IoCs
Processes:
96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exepid process 564 96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\Currentversion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\{1DFA435F-4610-D044-402D-CF3FC553F42F} = "C:\\Users\\Admin\\AppData\\Roaming\\Vuib\\qeum.exe" explorer.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\75376C9F-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
qeum.exeexplorer.exepid process 1444 qeum.exe 1444 qeum.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe 572 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
qeum.exepid process 1444 qeum.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exeqeum.exeWinMail.exedescription pid process Token: SeCreateTokenPrivilege 564 96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe Token: SeBackupPrivilege 564 96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe Token: SeSecurityPrivilege 564 96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe Token: SeCreateTokenPrivilege 1444 qeum.exe Token: SeBackupPrivilege 1444 qeum.exe Token: SeManageVolumePrivilege 1232 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1232 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1232 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1232 WinMail.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exeqeum.exeexplorer.exedescription pid process target process PID 564 wrote to memory of 1444 564 96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe qeum.exe PID 564 wrote to memory of 1444 564 96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe qeum.exe PID 564 wrote to memory of 1444 564 96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe qeum.exe PID 564 wrote to memory of 1444 564 96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe qeum.exe PID 1444 wrote to memory of 572 1444 qeum.exe explorer.exe PID 1444 wrote to memory of 572 1444 qeum.exe explorer.exe PID 1444 wrote to memory of 572 1444 qeum.exe explorer.exe PID 1444 wrote to memory of 572 1444 qeum.exe explorer.exe PID 572 wrote to memory of 1280 572 explorer.exe Explorer.EXE PID 572 wrote to memory of 1280 572 explorer.exe Explorer.EXE PID 572 wrote to memory of 1280 572 explorer.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe"C:\Users\Admin\AppData\Local\Temp\96c2a28ff80cbd8d0d02cb497273026003ba9b9275619996479c439e6ee9da61.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Vuib\qeum.exe"C:\Users\Admin\AppData\Roaming\Vuib\qeum.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Modifies firewall policy service
- Deletes itself
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Vuib\qeum.exeFilesize
225KB
MD55d70ea6a686af6c17e37a502bace1ac1
SHA17c866a1f62289a128450e1464983b8dc5777e283
SHA2565bff2180bd31925abb40bceb87d5e3b3ef1d5281b7f1798f66a7a9f9c7f73998
SHA5128362a4b441d3cd8a03f263b9152b56a1cb9eee8c481ea98dcec3b80e9484048c392b4fccb1550e93467fdfe59a9c831829b2f9500c1b80c4e8fbbe8cdea10bc6
-
C:\Users\Admin\AppData\Roaming\Vuib\qeum.exeFilesize
225KB
MD55d70ea6a686af6c17e37a502bace1ac1
SHA17c866a1f62289a128450e1464983b8dc5777e283
SHA2565bff2180bd31925abb40bceb87d5e3b3ef1d5281b7f1798f66a7a9f9c7f73998
SHA5128362a4b441d3cd8a03f263b9152b56a1cb9eee8c481ea98dcec3b80e9484048c392b4fccb1550e93467fdfe59a9c831829b2f9500c1b80c4e8fbbe8cdea10bc6
-
\Users\Admin\AppData\Roaming\Vuib\qeum.exeFilesize
225KB
MD55d70ea6a686af6c17e37a502bace1ac1
SHA17c866a1f62289a128450e1464983b8dc5777e283
SHA2565bff2180bd31925abb40bceb87d5e3b3ef1d5281b7f1798f66a7a9f9c7f73998
SHA5128362a4b441d3cd8a03f263b9152b56a1cb9eee8c481ea98dcec3b80e9484048c392b4fccb1550e93467fdfe59a9c831829b2f9500c1b80c4e8fbbe8cdea10bc6
-
memory/564-56-0x0000000001F90000-0x0000000002025000-memory.dmpFilesize
596KB
-
memory/564-55-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/564-54-0x0000000076D71000-0x0000000076D73000-memory.dmpFilesize
8KB
-
memory/572-68-0x0000000075191000-0x0000000075193000-memory.dmpFilesize
8KB
-
memory/572-84-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/572-69-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/572-66-0x0000000000000000-mapping.dmp
-
memory/1232-70-0x000007FEFC461000-0x000007FEFC463000-memory.dmpFilesize
8KB
-
memory/1232-71-0x000007FEF6E81000-0x000007FEF6E83000-memory.dmpFilesize
8KB
-
memory/1232-72-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/1232-78-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/1444-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1444-62-0x0000000002040000-0x00000000020D5000-memory.dmpFilesize
596KB
-
memory/1444-59-0x0000000000000000-mapping.dmp