Static task
static1
Behavioral task
behavioral1
Sample
kq.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
kq.exe
Resource
win10v2004-20230831-en
General
-
Target
kq.exe
-
Size
339KB
-
MD5
3b01e99c99284c74a90cefdd3bc6e9ff
-
SHA1
60194a2f2ba4ba1c8b44675b5be5983804ab5bb1
-
SHA256
6ff69b6e0f778aabf521a72a70c34274acfabc59a3472f7cba2372ebb8875d0f
-
SHA512
d375ef42b9de9c06da41d7ad61176b10bf020bfa8eaa0fcf544adb6e9b6563e158939b8e2a39687f03a96c0f799af74a9a9df6cc3f3f8c2099b0c566bb9ea13a
-
SSDEEP
6144:LS2lfkZS8UaZGi50qgA3KOpDPXmzC2epPo:x1sSDqgA3KOp0C2M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource kq.exe
Files
-
kq.exe.exe windows x64
0329221787df822934882df7ce296d0a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CancelIo
CloseHandle
CreateEventA
CreateFileW
CreateIoCompletionPort
CreateMutexA
CreateProcessW
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteTimerQueue
EncodePointer
EnterCriticalSection
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileAttributesW
GetFileSizeEx
GetFileType
GetLastError
GetLocalTime
GetLogicalDriveStringsW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultUILanguage
GetSystemTimeAsFileTime
GetUserDefaultUILanguage
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MoveFileW
MultiByteToWideChar
OpenProcess
PostQueuedCompletionStatus
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessShutdownParameters
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
WriteConsoleW
WriteFile
lstrcatW
lstrcmpW
lstrcmpiW
lstrcpyW
lstrlenW
advapi32
CryptAcquireContextA
CryptGenRandom
user32
wsprintfA
wsprintfW
wvsprintfW
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
oleaut32
SysAllocString
VariantClear
VariantInit
shell32
CommandLineToArgvW
SHEmptyRecycleBinA
shlwapi
StrStrIA
StrStrIW
rstrtmgr
RmEndSession
RmGetList
RmRegisterResources
RmShutdown
RmStartSession
ws2_32
WSAAddressToStringW
WSACleanup
WSAGetLastError
WSAIoctl
WSASocketW
WSAStartup
bind
closesocket
gethostbyname
gethostname
getsockopt
htons
inet_ntoa
setsockopt
shutdown
socket
netapi32
NetApiBufferFree
NetShareEnum
iphlpapi
GetIpNetTable
Sections
.text Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.voltbl Size: 512B - Virtual size: 46B
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
./9= Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 411B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
safnqx Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE