850c934fda7a97f8b020e041dca4eca90e110477c48cff3adac9d45a9961ad20 | Triage

Analysis

max time kernel
93s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 02:23

Sharing

Report Analysis Logs

General

Target

xbs/QPetXX.exe
Size

92KB
MD5

904821bfda992dc4440e0872784a41d8
SHA1

9c7c0caadafd569ee58af8cf5c342d7c15216fdd
SHA256

720dacf73dad68f1e267e6446786c97dfd88b3c8469a7a53d14581bf2a3e9416
SHA512

c8893530a569e00589bf9f6fdc64ef24d95f9c73f68ba4ec73fdfc8e43bd2e6bd9e7c5a50d479a5ad0fedc7368cd22f9b8c7275ef085be7c0a98c67ec80a0f92
SSDEEP

1536:ElyBREfXjEvBOJnXzmUEGlLVxsc40Fc7AUEZ9T0ulCh5cT5fFK46VHMS:QfXjEsJntFnseWEj0ulG5u5/2sS

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/4972-132-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral4/memory/4972-133-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4544	4972	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	QPetXX.exe
4972	QPetXX.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4972	QPetXX.exe
4972	QPetXX.exe
4972	QPetXX.exe
4972	QPetXX.exe

C:\Users\Admin\AppData\Local\Temp\xbs\QPetXX.exe
"C:\Users\Admin\AppData\Local\Temp\xbs\QPetXX.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1320
  2⤵
  - Program crash
  PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4972 -ip 4972
1⤵
PID:3108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-132-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4972-133-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download