ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe
Size

102KB
MD5

80835661bca16bd648d7080d8e89b0cd
SHA1

a0aff1fb93daaac4456cd2988c00f3edafa9acb7
SHA256

ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd
SHA512

a1a7bab02d1f1c034619ab35aee0ff1442013526bf1dc674568829e0d52b88c80c2dd496a4b22aabc463d74db80d767fc70ebc08710e99bbf64319b8c42d8cfa
SSDEEP

1536:5rJq4nGN1BXCmpL1BXCmpAabQdUE4++nM:5rJq4nGq+E4BM

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1584	CQLO.exe
1448	ssvchost.exe
580	msvchost.exe

Loads dropped DLL 12 IoCs

pid	Process
1652	ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe
1652	ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe
1584	CQLO.exe
1584	CQLO.exe
1584	CQLO.exe
1448	ssvchost.exe
1448	ssvchost.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regm64.dll	CQLO.exe
File created	C:\Windows\SysWOW64\msvchost.exe	CQLO.exe
File opened for modification	C:\Windows\SysWOW64\msvchost.exe	CQLO.exe
File created	C:\Windows\SysWOW64\ssvchost.exe	CQLO.exe
File opened for modification	C:\Windows\SysWOW64\rmnl.dll	msvchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1404	580	WerFault.exe	31

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1816	DllHost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1584	CQLO.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1584	1652	ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe	29
PID 1652 wrote to memory of 1584	1652	ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe	29
PID 1652 wrote to memory of 1584	1652	ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe	29
PID 1652 wrote to memory of 1584	1652	ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe	29
PID 1584 wrote to memory of 1448	1584	CQLO.exe	30
PID 1584 wrote to memory of 1448	1584	CQLO.exe	30
PID 1584 wrote to memory of 1448	1584	CQLO.exe	30
PID 1584 wrote to memory of 1448	1584	CQLO.exe	30
PID 1448 wrote to memory of 580	1448	ssvchost.exe	31
PID 1448 wrote to memory of 580	1448	ssvchost.exe	31
PID 1448 wrote to memory of 580	1448	ssvchost.exe	31
PID 1448 wrote to memory of 580	1448	ssvchost.exe	31
PID 580 wrote to memory of 1404	580	msvchost.exe	32
PID 580 wrote to memory of 1404	580	msvchost.exe	32
PID 580 wrote to memory of 1404	580	msvchost.exe	32
PID 580 wrote to memory of 1404	580	msvchost.exe	32

C:\Users\Admin\AppData\Local\Temp\ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe
"C:\Users\Admin\AppData\Local\Temp\ba45e780bdd85f80d9ce89acdca2317c94361ed79190440c14b7251e6fac76bd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\CQLO.exe
  C:\Users\Admin\AppData\Local\Temp\CQLO.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\ssvchost.exe
    "C:\Windows\system32\ssvchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\SysWOW64\msvchost.exe
      "C:\Windows\system32\msvchost.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 196
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1404

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CQLO.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CQLO.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\HDK.ICO

Filesize
86KB

MD5
155b6feae392761f11fdf8bae8496a8e

SHA1
bca6d8dc7de014624b2c98e953682d24c62f214d

SHA256
71d1973887a0a3dbe23decff4522ed6dfa9018438b1de71a83de4c211936f457

SHA512
ecc26e4346ebb5346a6fd0e98c52e244ceb6a992d3ec20a58041b8698bc5c9fa4f1dadcb604aa4f719e8c8c64d5ec7932b0e19fdde24411b1d988bb36c977673

Download Submit
C:\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
C:\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
C:\Windows\SysWOW64\ssvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Users\Admin\AppData\Local\Temp\CQLO.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Users\Admin\AppData\Local\Temp\CQLO.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\msvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\regm64.dll

Filesize
12KB

MD5
618ba27f0502751f408b211f61747827

SHA1
c78868c7b629d2e5d4f447099c9726379b6d421d

SHA256
5c5b2b741b4a7a152f9750e36c61fab1f65ef41955013db8aa487a2ab29b6eb6

SHA512
de6454a04c43c4d0d7f6604b9c0e61eea5fa88b9c15253817b7823b9e3446778331d25ca005625b69bf1f1cf01abe6b89dcdb752d6e179cb59be31f0439fe99d

Download Submit
\Windows\SysWOW64\ssvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
\Windows\SysWOW64\ssvchost.exe

Filesize
12KB

MD5
56145debb02db2c1e9308d1caeb2c96f

SHA1
216c3f62a149a675f6de222c4aaf34c30a83ddd8

SHA256
6fee768c68d5ceb63fb31ee91b483ae4170ab9c4cd597c0a83566f3cd4570730

SHA512
40871214ded0ba47610aebce3f10b7a7072bbdf9590ddb4dcd028786cadcf1327b874c5a6c2675d5c11b12f6ae3e1185986e56e3bed01017cfb5af7facfeb4b4

Download Submit
memory/1652-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download