Overview
overview
8Static
static
8FastVerCode.dll
windows7-x64
8FastVerCode.dll
windows10-2004-x64
3ICSharpCod...ib.dll
windows7-x64
1ICSharpCod...ib.dll
windows10-2004-x64
1Interop.ADODB.dll
windows7-x64
1Interop.ADODB.dll
windows10-2004-x64
1Interop.ADOX.dll
windows7-x64
1Interop.ADOX.dll
windows10-2004-x64
1Interop.ADQX.dll
windows7-x64
8Interop.ADQX.dll
windows10-2004-x64
8Interop.ADQX64.dll
windows7-x64
1Interop.ADQX64.dll
windows10-2004-x64
1Interop.JPO.dll
windows7-x64
1Interop.JPO.dll
windows10-2004-x64
3Interop.JRO.dll
windows7-x64
1Interop.JRO.dll
windows10-2004-x64
1UUWiseHelper.dll
windows7-x64
1UUWiseHelper.dll
windows10-2004-x64
3dl.dll
windows7-x64
1dl.dll
windows10-2004-x64
1irisskin2.dll
windows7-x64
1irisskin2.dll
windows10-2004-x64
1qq_post.exe
windows7-x64
8qq_post.exe
windows10-2004-x64
8�...��.exe
windows7-x64
8�...��.exe
windows10-2004-x64
8Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 17:26
Behavioral task
behavioral1
Sample
FastVerCode.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
FastVerCode.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
ICSharpCode.SharpZipLib.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Interop.ADODB.dll
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
Interop.ADODB.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Interop.ADOX.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
Interop.ADOX.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
Interop.ADQX.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Interop.ADQX.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Interop.ADQX64.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Interop.ADQX64.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
Interop.JPO.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Interop.JPO.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Interop.JRO.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Interop.JRO.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
UUWiseHelper.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
UUWiseHelper.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
dl.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
dl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
irisskin2.dll
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
irisskin2.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
qq_post.exe
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
qq_post.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
QQȺӪ.exe
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
QQȺӪ.exe
Resource
win10v2004-20220812-en
General
-
Target
qq_post.exe
-
Size
1.1MB
-
MD5
641cc768cca07c32e5fb3250299661a8
-
SHA1
4a8ccc4f8c864ec627d2a5df6b87c43ff6c45578
-
SHA256
4dfe9134a35c3cea04e73ee86e490d25fb8340b6640814912497d999bc328648
-
SHA512
d4dc9ee5fc4e3c0a445192328fb44bf029f7699e3739b6628d763e40db7c05ba3301275a51561d9b30222c0a3992cabb39fafd0b674e89595bbdba05845677cd
-
SSDEEP
12288:NCVFRHFP1hoG8y+xvfrqTmwnvGrjD2lhiZwpbVIlL/QoNBjUZqdAutKhXiVjgDR:NCVFzC9QAUZAVtKhw
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral24/memory/4016-132-0x0000000010000000-0x0000000010255000-memory.dmp vmprotect behavioral24/memory/4016-135-0x0000000010000000-0x0000000010255000-memory.dmp vmprotect behavioral24/memory/4016-138-0x0000000010000000-0x0000000010255000-memory.dmp vmprotect -
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
dw20.exedescription pid process Token: SeRestorePrivilege 744 dw20.exe Token: SeBackupPrivilege 744 dw20.exe Token: SeBackupPrivilege 744 dw20.exe Token: SeBackupPrivilege 744 dw20.exe Token: SeBackupPrivilege 744 dw20.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
qq_post.exedescription pid process target process PID 4016 wrote to memory of 744 4016 qq_post.exe dw20.exe PID 4016 wrote to memory of 744 4016 qq_post.exe dw20.exe PID 4016 wrote to memory of 744 4016 qq_post.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qq_post.exe"C:\Users\Admin\AppData\Local\Temp\qq_post.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 11842⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:744
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-136-0x0000000000000000-mapping.dmp
-
memory/4016-132-0x0000000010000000-0x0000000010255000-memory.dmpFilesize
2.3MB
-
memory/4016-134-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/4016-135-0x0000000010000000-0x0000000010255000-memory.dmpFilesize
2.3MB
-
memory/4016-137-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/4016-138-0x0000000010000000-0x0000000010255000-memory.dmpFilesize
2.3MB