Analysis
-
max time kernel
77s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe
Resource
win10v2004-20221111-en
General
-
Target
74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe
-
Size
472KB
-
MD5
5460113722a8266a86734b3283991920
-
SHA1
741308a9ea26c5e14935e036a36225aa4f219132
-
SHA256
74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca
-
SHA512
d63690f0c896b9ab78153c96834bc375455bf16d8373bd72354173f7d535f2c5276f7481d8e70761bd9b2312f93553b582f707b85e769ffcbf6d10f846713a33
-
SSDEEP
12288:GmNQoc2wgN+SnjAkv1DpZeED4m7hoaiRsQ2pGgHx+i:Gm+otN+SnJVZXLhotszEgHx+i
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 868 Qmkhqqy.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Qmkhqqy.exe 74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe File opened for modification C:\Windows\Qmkhqqy.exe 74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 936 74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe"C:\Users\Admin\AppData\Local\Temp\74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:936
-
C:\Windows\Qmkhqqy.exeC:\Windows\Qmkhqqy.exe1⤵
- Executes dropped EXE
PID:868
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
MD55460113722a8266a86734b3283991920
SHA1741308a9ea26c5e14935e036a36225aa4f219132
SHA25674aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca
SHA512d63690f0c896b9ab78153c96834bc375455bf16d8373bd72354173f7d535f2c5276f7481d8e70761bd9b2312f93553b582f707b85e769ffcbf6d10f846713a33