223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824

Analysis

max time kernel
19s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 20:44

Target

223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824.exe
Size

732KB
MD5

c851b9d47c687dcdee128adb2fca05d9
SHA1

429d29a831a6faf29e7a5fa0b363b30e338b36ab
SHA256

223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824
SHA512

595f29f525eaca4b96574ea51f403371eb6c58583c1911ed7a733d4ecb00e9ff71e1306c54d9246f59317e82d5d2d050b4f5094e7bca3117889b70d87a1cd298
SSDEEP

12288:ICPIe8GAY+4S7CFvT3FEc1mdjQ6ROniA5br2YhGTmoYbbQbb8sAznLVS:ICP9+Y5SeFT1E1d5RkiMbr2YhTnz5S

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1308	SysSweeper.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0009000000012322-55.dat	upx
behavioral1/files/0x0009000000012322-56.dat	upx
behavioral1/memory/1308-57-0x0000000000400000-0x0000000000504000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1376	223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\QQDoctor\QQDoctor\TSVulEngine.dll	223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824.exe
File created	C:\Program Files (x86)\QQDoctor\QQDoctor\SysSweeper.exe	223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1376	223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824.exe
1376	223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824.exe

C:\Users\Admin\AppData\Local\Temp\223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824.exe
"C:\Users\Admin\AppData\Local\Temp\223d13a5f7df8f3090b971da1e6d0025d6033db2a99ed543f5bb757d6536a824.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1376
- C:\Program Files (x86)\QQDoctor\QQDoctor\SysSweeper.exe
  avckg0n
  2⤵
  - Executes dropped EXE
  PID:1308

C:\Program Files (x86)\QQDoctor\QQDoctor\SysSweeper.exe

Filesize
424KB

MD5
53a3c6e8c3ed3d8cdb5c72bd29cf18fe

SHA1
1e3e9fcba43ac51031b87c5a4bc7a80f2d61d318

SHA256
9d883bda6120f8d7b624d063373d0e7ebf64f77a4c35d5ff861705b92f3fbea3

SHA512
5aab9057efc7b00b98a2d9131659b670e510a94b6f8ea369cf97de8c0035bab5554b0ce85eddb4970be1f88ea5530a56740f72afac24b76279979744e8819f3b

Download Submit
\Program Files (x86)\QQDoctor\QQDoctor\SysSweeper.exe

Filesize
424KB

MD5
53a3c6e8c3ed3d8cdb5c72bd29cf18fe

SHA1
1e3e9fcba43ac51031b87c5a4bc7a80f2d61d318

SHA256
9d883bda6120f8d7b624d063373d0e7ebf64f77a4c35d5ff861705b92f3fbea3

SHA512
5aab9057efc7b00b98a2d9131659b670e510a94b6f8ea369cf97de8c0035bab5554b0ce85eddb4970be1f88ea5530a56740f72afac24b76279979744e8819f3b

Download Submit
memory/1308-57-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/1376-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download