bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce

Analysis

max time kernel
150s
max time network
158s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe
Size

118KB
MD5

60e0bb0651734e438a73d5fd130dae13
SHA1

3fd37138aeb73d4590f018fade81ce108f550269
SHA256

bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce
SHA512

5958b23206568a510ad3e2b01f6446e8ba208d179280206f83f0c4f2635287f7d8753e627a6df141c8f57f68b514ecb6739a06058229ff7d89e93ad0a6ec138d
SSDEEP

3072:hsNCMCN4me7rNzAuxq5XelL044RI4bX1C1uKJrF+SjGeRoc:hscBNqrNUuw5uh04LKi/5F+CGeRo

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qmsvef = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\qmsvef.dll\",FreeTempFileList"	bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1152	1352	bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe	26
PID 1352 wrote to memory of 1152	1352	bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe	26
PID 1352 wrote to memory of 1152	1352	bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe	26
PID 1352 wrote to memory of 1152	1352	bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe	26
PID 1352 wrote to memory of 1152	1352	bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe	26
PID 1352 wrote to memory of 1152	1352	bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe	26
PID 1352 wrote to memory of 1152	1352	bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe	26

C:\Users\Admin\AppData\Local\Temp\bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe
"C:\Users\Admin\AppData\Local\Temp\bda6c1ed66ad82ca4f51eb589abd5ee768c81e51cac6af4bc606b92d8ddac0ce.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\qmsvef.dll",GetCounter
  2⤵
  - Loads dropped DLL
  PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\qmsvef.dll

Filesize
118KB

MD5
7d9f4b0c349ca8b768bc439c19f078ef

SHA1
1de2f215d2e422475a3dd0bb264f66f7766c070b

SHA256
ebb250386e03988bc4dd6a590ac418e7696e2a21409ad761972bffff78482f8a

SHA512
44df32bd041fffad1971b704e999deef3bd9b6af8f84d80c783b6261d12dcd068fd84807c85569b980dce5923e57cfad3710055f4d804b4f2b0124f4a1a39109

Download Submit
\Users\Admin\AppData\Roaming\qmsvef.dll

Filesize
118KB

MD5
7d9f4b0c349ca8b768bc439c19f078ef

SHA1
1de2f215d2e422475a3dd0bb264f66f7766c070b

SHA256
ebb250386e03988bc4dd6a590ac418e7696e2a21409ad761972bffff78482f8a

SHA512
44df32bd041fffad1971b704e999deef3bd9b6af8f84d80c783b6261d12dcd068fd84807c85569b980dce5923e57cfad3710055f4d804b4f2b0124f4a1a39109

Download Submit
\Users\Admin\AppData\Roaming\qmsvef.dll

Filesize
118KB

MD5
7d9f4b0c349ca8b768bc439c19f078ef

SHA1
1de2f215d2e422475a3dd0bb264f66f7766c070b

SHA256
ebb250386e03988bc4dd6a590ac418e7696e2a21409ad761972bffff78482f8a

SHA512
44df32bd041fffad1971b704e999deef3bd9b6af8f84d80c783b6261d12dcd068fd84807c85569b980dce5923e57cfad3710055f4d804b4f2b0124f4a1a39109

Download Submit
\Users\Admin\AppData\Roaming\qmsvef.dll

Filesize
118KB

MD5
7d9f4b0c349ca8b768bc439c19f078ef

SHA1
1de2f215d2e422475a3dd0bb264f66f7766c070b

SHA256
ebb250386e03988bc4dd6a590ac418e7696e2a21409ad761972bffff78482f8a

SHA512
44df32bd041fffad1971b704e999deef3bd9b6af8f84d80c783b6261d12dcd068fd84807c85569b980dce5923e57cfad3710055f4d804b4f2b0124f4a1a39109

Download Submit
\Users\Admin\AppData\Roaming\qmsvef.dll

Filesize
118KB

MD5
7d9f4b0c349ca8b768bc439c19f078ef

SHA1
1de2f215d2e422475a3dd0bb264f66f7766c070b

SHA256
ebb250386e03988bc4dd6a590ac418e7696e2a21409ad761972bffff78482f8a

SHA512
44df32bd041fffad1971b704e999deef3bd9b6af8f84d80c783b6261d12dcd068fd84807c85569b980dce5923e57cfad3710055f4d804b4f2b0124f4a1a39109

Download Submit
memory/1152-68-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/1152-73-0x00000000000B0000-0x00000000000C0000-memory.dmp

Filesize
64KB

Download
memory/1352-55-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1352-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1352-56-0x0000000000240000-0x0000000000261000-memory.dmp

Filesize
132KB

Download
memory/1352-72-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download