4QCNO[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
4QCNO.rar
Size 1.2MB
Sample230223-dntsmaee63
SHA256 0ffff9d4927d79efa9a3999dccef2a809157653e21c3fb79811295d2e1880a7d
MD5 ebc3a6ec88b3bf597987bc8942bcd2d6
SHA1 c3baec408264453af32c8661144f0d26e692ebf4
SHA512 03f7dc4dd29f0a19fa937bf28505bd2cc65d9e57e9df6a0310897eb37a2dc8b5f51541500ec44f5c638beea01e97170d6bafaef6bfb92ac4315a1f448e1bbcb3
SSDEEP 24576:z4uzazpp+hqb4knhb8VMq07U9sgUe7k71dmpXHGLgGHOFXP7M9zI5:cjpkMbp18a/YhL8apXZGuFo9O
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

4QCNO.rar

.rar 1.2MB
4QCNO/RR.lnk

.lnk 1KB
4QCNO/head

200.0MB
4QCNO/vibrations/airtightness.exe

.exe 1.6MB
4QCNO/vibrations/croaks.sql

1.6MB
4QCNO/vibrations/polaroid.cmd

244B

4QCNO.rar

SHA256 0ffff9d4927d79efa9a3999dccef2a809157653e21c3fb79811295d2e1880a7d
MD5 ebc3a6ec88b3bf597987bc8942bcd2d6
SHA1 c3baec408264453af32c8661144f0d26e692ebf4
SHA512 03f7dc4dd29f0a19fa937bf28505bd2cc65d9e57e9df6a0310897eb37a2dc8b5f51541500ec44f5c638beea01e97170d6bafaef6bfb92ac4315a1f448e1bbcb3
SSDEEP 24576:z4uzazpp+hqb4knhb8VMq07U9sgUe7k71dmpXHGLgGHOFXP7M9zI5:cjpkMbp18a/YhL8apXZGuFo9O
MD5 SHA1 SHA512 SSDEEP

4QCNO/vibrations/airtightness.exe

IMPHASH 96112b6b6508d4708e100f9ca644fda1
SHA256 22d1471ed17c681aa5580c59712005e1c70ef9c306cbcad245a64f7dfae47847
MD5 018796d4670ac12865be2f00382bbc8e
SHA1 8564027153dca487eca613345ab3b2de0add4f26
SHA512 4edac00e0d19b439c300328bf4f7abc98cadfce0d7f4283f1c6278bec24d0ed7c2e51090a2e584a7a2a2e645e396a890d9589fe3f660fa73fc238a09d827bc7b
SSDEEP 24576:qN2PGK9rDuNMZD22lHNFVntTX25fHSMv0UskeuzQU2z6IdcL6UCUK:qN2P39PuNYvlHTX2EMuZuzJ2z6nzK
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

1174032

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

IsValidSecurityDescriptor GetSecurityDescriptorLength CryptReleaseContext CryptAcquireContextW LookupAccountNameW IsValidSid ConvertSidToStringSidW ImpersonateSelf RevertToSelf LookupAccountSidW CryptGetProvParam CryptGetUserKey CryptGetKeyParam CryptDestroyKey RegCreateKeyExW RegSetValueExW RegSetValueExA RegDeleteKeyExW RegCloseKey GetTokenInformation GetLengthSid CopySid OpenProcessToken RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCreateKeyW RegEnumValueW RegEnumKeyW RegDeleteKeyW RegDeleteValueW CryptSetProvParam CryptGenRandom CryptCreateHash CryptVerifySignatureW CryptHashData CryptDestroyHash CryptSetKeyParam CryptDecrypt CryptImportKey RegDeleteTreeW RegOpenKeyW CryptGetHashParam CryptDuplicateKey CryptEncrypt CryptGenKey EventWriteTransfer RegUnLoadKeyW RegOpenCurrentUser RegQueryInfoKeyW RegLoadKeyW RegGetValueW GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority SetNamedSecurityInfoW AddAccessDeniedAce AddAccessAllowedAce AddAccessDeniedObjectAce AddAccessAllowedObjectAce AddAce InitializeAcl LsaStorePrivateData LsaRetrievePrivateData RegConnectRegistryW AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSecurityDescriptorToStringSecurityDescriptorW CryptEnumProvidersA CryptGetDefaultProviderW LogonUserExW ImpersonateLoggedOnUser CreateWellKnownSid MakeAbsoluteSD MakeSelfRelativeSD LsaClose LsaFreeMemory LsaOpenPolicy FreeSid CheckTokenMembership DuplicateToken OpenThreadToken ConvertStringSidToSidW AllocateAndInitializeSid SetSecurityDescriptorDacl SetEntriesInAclW GetSecurityDescriptorDacl DeleteAce EqualSid GetAce GetAclInformation SetSecurityDescriptorOwner InitializeSecurityDescriptor GetSecurityDescriptorControl CryptSignHashW CryptSetHashParam CryptExportKey CryptDuplicateHash CryptContextAddRef

kernel32

GetProfileStringA ResetEvent GetFileTime lstrlenW VirtualFree VirtualAlloc GetTempPathW GetLocalTime K32GetProcessImageFileNameW HeapSetInformation UnmapViewOfFile MapViewOfFile CreateFileMappingW GetSystemInfo GetCurrentThread CreateDirectoryW RemoveDirectoryW GetConsoleOutputCP CompareStringW FoldStringW GetTimeFormatW GetDateFormatW FileTimeToLocalFileTime LoadLibraryExW GetSystemDirectoryW GetCommandLineW FileTimeToSystemTime WriteConsoleW GetACP WideCharToMultiByte OutputDebugStringA GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW LocalFree GetSystemTime SystemTimeToFileTime GetSystemTimeAsFileTime LocalAlloc GetFileAttributesW FreeLibrary CompareFileTime CreateThread WaitForSingleObject GetExitCodeThread CloseHandle GetStdHandle GetFileType GetConsoleMode SetConsoleMode SetLastError GetProcAddress CreateFileW GetFileSize DeleteFileW lstrcmpW GetProcessHeap HeapFree HeapAlloc FormatMessageW GetSystemDefaultLangID InitializeCriticalSection DeleteCriticalSection RaiseException GetModuleHandleW LoadLibraryExA LocalReAlloc GetUserDefaultUILanguage GetSystemDefaultUILanguage OpenEventW PulseEvent GetTickCount64 GetLastError OpenProcess GetProcessTimes QueryFullProcessImageNameW GetCurrentProcess GetFileAttributesExW EncodePointer DecodePointer LoadLibraryW GetTickCount Sleep FindFirstFileW FindNextFileW FindClose ReadFile SetFilePointer GetComputerNameW GetComputerNameExW GetVersionExW FindResourceW LoadResource SizeofResource LockResource WriteFile SetEndOfFile EnterCriticalSection SetConsoleCtrlHandler LeaveCriticalSection VerSetConditionMask VerifyVersionInfoW MultiByteToWideChar SetThreadpoolTimer SetThreadpoolWait FindNextChangeNotification FindCloseChangeNotification CloseThreadpoolWait CloseThreadpoolTimer GetFullPathNameW DelayLoadFailureHook ResolveDelayLoadedAPI FindResourceExW GetLocaleInfoW SearchPathW lstrcmpiW IsDebuggerPresent DebugBreak AcquireSRWLockShared CreateMutexExW CompareStringEx ReleaseSRWLockShared CreateThreadpoolTimer FindFirstChangeNotificationW CreateThreadpoolWait SetEvent ReleaseSemaphore TrySubmitThreadpoolCallback CreateSemaphoreW GetModuleFileNameA CreateSemaphoreExW GetModuleHandleExW InitializeCriticalSectionEx WaitForThreadpoolTimerCallbacks ReleaseMutex CreateEventW GetEnvironmentVariableW GetTempFileNameW ReleaseSRWLockExclusive OutputDebugStringW AcquireSRWLockExclusive WaitForSingleObjectEx OpenSemaphoreW LocalFileTimeToFileTime

msvcrt

wcsncmp _ultow _wcsicmp bsearch fopen fgets strchr fputs fseek ferror _swab _strlwr fprintf malloc _callnewh ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@AEBQEBDH@Z ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ _CxxThrowException memcpy memmove _XcptFilter _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit __setusermatherr _initterm __C_specific_handler _wcmdln wcsstr _commode _lock _unlock __dllonexit _onexit ??1type_info@@UEAA@XZ _errno realloc ?terminate@@YAXXZ strcmp _wtoi _stricmp swscanf _strnicmp isdigit __isascii ??_V@YAXPEAX@Z free wcscspn qsort ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z _wcsnicmp wcsspn _fgetwchar fflush fclose _wfopen_s fwprintf wcstok wcschr wcsrchr iswdigit _vsnwprintf _purecall __CxxFrameHandler3 ??3@YAXPEAX@Z strcspn strncmp _wcslwr wcscmp strstr _fmode _itoa_s memcpy_s wcsncpy_s _wcserror wcsnlen memcmp memset wcscpy_s towupper iswlower towlower iswupper sscanf_s strpbrk strcat_s strcpy_s strspn _vsnprintf getenv fwrite ftell _wgetenv _fileno _setmode wcstoul fgetws feof fgetc _wfopen fputws atoi iswalpha __iob_func iswspace vfwprintf iswxdigit gmtime isxdigit _wsetlocale

certcli

CAGetCAProperty CAFindByName CAEnumFirstCA ord373 CACloseCertType CAEnumNextCertType CACertTypeAccessCheckEx CAGetCertTypeProperty CAEnumCertTypesForCAEx CAFreeCertTypeExtensions CAGetCertTypeExtensions CACertTypeGetSecurity CAGetCertTypeExpiration CAGetCertTypeKeySpec CAFreeCertTypeProperty CAGetCertTypePropertyEx CAGetCertTypeFlagsEx CAEnumNextCA CAEnumCertTypesEx ord356 ord205 ord213 ord254 ord360 ord223 ord256 ord246 ord225 ord358 ord207 ord359 CACloseCA CAGetCAFlags CAGetCAExpiration CAAccessCheck ord361 CAGetCACertificate CAGetCASecurity CASetCAProperty CAUpdateCAEx CAFindByCertType ord257 ord218 ord255 CAEnumCertTypesForCA CACountCertTypes CACertTypeAccessCheck CACountCAs CAFreeCAProperty CARemoveCACertificateTypeEx CAAddCACertificateTypeEx CAUpdateCA ord260 ord366 ord252 ord261 ord253 ord217 ord203 ord247 ord210 CASetCASecurity CASetCACertificate CASetCAFlags CACreateNewCA CAFindCertTypeByName ord370 ord258 ord357 ord245 ord362

crypt32

CryptExportPKCS8 PFXExportCertStoreEx PFXExportCertStore CryptFreeOIDFunctionAddress CryptGetOIDFunctionAddress CryptInitOIDFunctionSet CertStrToNameW CryptDecryptMessage CryptEncryptMessage CryptSignMessage CryptFormatObject CertAddCertificateLinkToStore CertGetIntendedKeyUsage CryptHashPublicKeyInfo CryptStringToBinaryW CryptMsgOpenToDecode CertNameToStrW CryptSignCertificate CryptExportPublicKeyInfoEx CryptSignAndEncodeCertificate CertDuplicateStore CryptMsgUpdate CryptMsgOpenToEncode CryptBinaryToStringW CertOpenServerOcspResponse I_CryptWalkAllLruCacheEntries I_CryptRemoveLruEntry I_CryptGetLruEntryData I_CryptFindLruEntry I_CryptReleaseLruEntry I_CryptInsertLruEntry I_CryptCreateLruEntry CertCloseServerOcspResponse I_CryptFreeLruCache I_CryptCreateLruCache CryptMsgEncodeAndSignCTL CertGetNameStringA CertSetCertificateContextPropertiesFromCTLEntry CertCreateContext I_CertProtectFunction CertAddStoreToCollection CertVerifyCertificateChainPolicy CryptMemFree CertVerifySubjectCertificateContext CryptVerifyCertificateSignatureEx CertGetEnhancedKeyUsage CertVerifyCRLTimeValidity CertVerifyRevocation CertVerifyTimeValidity CryptEnumKeyIdentifierProperties CryptImportPublicKeyInfo CertDuplicateCRLContext CertDeleteCRLFromStore CertAddCTLContextToStore CertAddCRLContextToStore CertEnumSystemStore CertEnumSystemStoreLocation CertEnumPhysicalStore CertControlStore CertSaveStore CertAddSerializedElementToStore CertAddEncodedCTLToStore CertAddEncodedCRLToStore CertAddEncodedCertificateToStore CertSetCTLContextProperty CertSetCRLContextProperty CryptFindCertificateKeyProvInfo CryptAcquireCertificatePrivateKey CertEnumCertificateContextProperties CertGetCRLContextProperty CertEnumCRLContextProperties CertGetCTLContextProperty CertEnumCTLContextProperties CertSetStoreProperty CertComparePublicKeyInfo CryptExportPublicKeyInfo CertFreeCTLContext CertCreateCTLContext CertEnumCTLsInStore CertDeleteCertificateFromStore CertGetNameStringW CryptDecodeObjectEx CryptQueryObject CryptMsgGetParam CryptVerifyDetachedMessageSignature CryptMsgGetAndVerifySigner CryptMsgControl PFXIsPFXBlob PFXImportCertStore CryptImportPKCS8 CertGetPublicKeyLength CryptMsgClose CertAddCertificateContextToStore CertSetCertificateContextProperty CryptGetKeyIdentifierProperty CertFindAttribute CryptHashCertificate CryptDecodeObject CertOpenStore CertFindCertificateInStore CertEnumCertificatesInStore CryptFindLocalizedName CryptVerifyCertificateSignature CertCompareCertificateName CertFreeCertificateChain CertGetCertificateChain CryptHashCertificate2 CryptImportPublicKeyInfoEx2 CryptRegisterOIDInfo CertCreateCertificateContext CryptEnumOIDInfo CertCreateCRLContext CertFreeCRLContext CertEnumCRLsInStore CertCloseStore CertGetCertificateContextProperty CryptFindOIDInfo CryptEncodeObjectEx CertFreeCertificateContext CertFindExtension CertDuplicateCertificateContext

cabinet

ord23 ord22 ord21 ord20

comctl32

InitCommonControlsEx

cryptui

CryptUIDlgViewCertificateW CryptUIDlgFreeCAContext CryptUIDlgViewCRLW

gdi32

GetStockObject

ncrypt

NCryptVerifySignature NCryptIsKeyHandle NCryptFreeObject BCryptVerifySignature NCryptOpenStorageProvider NCryptImportKey NCryptSetProperty NCryptFinalizeKey BCryptSetProperty BCryptGetProperty BCryptCloseAlgorithmProvider SslEnumProtocolProviders SslOpenProvider SslFreeBuffer SslFreeObject NCryptGetProperty BCryptFreeBuffer BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptDecrypt BCryptEncrypt BCryptExportKey BCryptGenRandom BCryptSignHash BCryptResolveProviders BCryptEnumContextFunctions BCryptQueryContextConfiguration BCryptEnumContexts BCryptQueryProviderRegistration BCryptGenerateKeyPair BCryptEnumAlgorithms NCryptFreeBuffer NCryptEnumStorageProviders NCryptEnumKeys NCryptIsAlgSupported NCryptEnumAlgorithms BCryptDestroyKey NCryptSignHash NCryptSecretAgreement NCryptOpenKey NCryptExportKey NCryptEncrypt NCryptDeriveKey NCryptDeleteKey NCryptDecrypt NCryptCreatePersistedKey

netapi32

DsGetSiteNameW DsGetDcNameW NetApiBufferFree NetUserGetGroups DsRoleGetPrimaryDomainInformation DsRoleFreeMemory

normaliz

IdnToAscii IdnToUnicode

ntdll

WinSqmIncrementDWORD RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlNtStatusToDosError RtlGetPersistedStateLocation NtQuerySystemTime RtlTimeToSecondsSince1970 NtQuerySystemInformationEx

ntdsapi

DsFreeDomainControllerInfoW DsBindW DsFreeNameResultW DsCrackNamesW DsUnBindW DsGetDomainControllerInfoW

setupapi

SetupGetIntField SetupCloseInfFile SetupGetStringFieldW SetupFindNextLine SetupGetFieldCount SetupFindFirstLineW SetupGetLineCountW SetupOpenInfFileW

shell32

SHGetFolderPathW SHGetKnownFolderPath

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wldap32

ord145 ord14 ord73 ord208 ord13 ord16 ord12 ord18 ord210 ord65 ord41 ord113 ord140 ord224 ord142 ord79 ord127 ord167 ord147 ord155 ord206 ord135 ord203 ord36 ord27 ord26 ord191

ole32

CoCreateInstance CoTaskMemFree CoInitialize CoUninitialize CoInitializeEx CLSIDFromString CLSIDFromProgID StringFromCLSID ProgIDFromCLSID CoTaskMemAlloc CoCreateInstanceEx CoSetProxyBlanket StgOpenStorageEx PropVariantClear

oleaut32

SafeArrayGetElement SystemTimeToVariantTime SafeArrayGetUBound SysFreeString SafeArrayGetDim VariantCopyInd CreateErrorInfo SetErrorInfo SafeArrayGetLBound VariantTimeToSystemTime SysStringLen SafeArrayDestroy SafeArrayPutElement SysStringByteLen SafeArrayCreate SysAllocStringByteLen SysAllocStringLen SysAllocString VariantClear SafeArrayUnaccessData VariantInit SafeArrayAccessData

rpcrt4

UuidToStringW UuidCreate UuidIsNil UuidFromStringW RpcStringFreeW NdrClientCall3 I_RpcExceptionFilter

secur32

TranslateNameW GetUserNameExW GetComputerObjectNameW

user32

PostQuitMessage UpdateWindow SetWindowLongPtrW SetFocus ShowWindow GetWindowTextW CallWindowProcW GetWindowLongPtrW SetWindowTextW DialogBoxParamW GetDlgItemTextW IsDlgButtonChecked GetMessageW TranslateMessage LoadIconW RegisterClassW GetDlgItemInt EndDialog SetDlgItemInt CheckDlgButton SendDlgItemMessageA EnableWindow GetDlgItem SetDlgItemTextW LoadCursorW MessageBoxW SendMessageW SetCursor CharLowerW GetDesktopWindow DefWindowProcW CreateWindowExW DispatchMessageW PostMessageW LoadStringW

shlwapi

PathFindFileNameW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

374KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4QCNO.rar

4QCNO/RR.lnk

4QCNO/head

4QCNO/vibrations/airtightness.exe

advapi32

kernel32

msvcrt

certcli

crypt32

cabinet

comctl32

cryptui

gdi32

ncrypt

netapi32

normaliz

ntdll

ntdsapi

setupapi

shell32

version

wldap32

ole32

oleaut32

rpcrt4

secur32

user32

shlwapi

4QCNO/vibrations/croaks.sql

4QCNO/vibrations/polaroid.cmd