Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18/09/2023, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
76c558e35dabf3bb233dc75b8a57a160_JC.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
76c558e35dabf3bb233dc75b8a57a160_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
76c558e35dabf3bb233dc75b8a57a160_JC.exe
-
Size
56KB
-
MD5
76c558e35dabf3bb233dc75b8a57a160
-
SHA1
cb5c20ac9a202f93908134d21bcb4c8e193b1743
-
SHA256
189bd2124bf6745f8083c6f6820feef1044e0190a0415ff1c467f427b4d8593c
-
SHA512
23fb8486053064d4c8d954fdaaf9249164c3dea558fe2bd37433f4a00589066370a77a1ee19c0ae631239d93d24f36797ca1df82d54981e6a6ad0df7684b61ff
-
SSDEEP
768:xgMNEhm6g4/yZnquYIv+6wH9H7MfygXaDMFQXD7e7DQ:xgMamW/luj6NNDsQXD7i8
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qlvois.exe -
Executes dropped EXE 1 IoCs
pid Process 1048 qlvois.exe -
Loads dropped DLL 2 IoCs
pid Process 2588 76c558e35dabf3bb233dc75b8a57a160_JC.exe 2588 76c558e35dabf3bb233dc75b8a57a160_JC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\qlvois = "C:\\Users\\Admin\\qlvois.exe" qlvois.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe 1048 qlvois.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2588 76c558e35dabf3bb233dc75b8a57a160_JC.exe 1048 qlvois.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 1048 2588 76c558e35dabf3bb233dc75b8a57a160_JC.exe 28 PID 2588 wrote to memory of 1048 2588 76c558e35dabf3bb233dc75b8a57a160_JC.exe 28 PID 2588 wrote to memory of 1048 2588 76c558e35dabf3bb233dc75b8a57a160_JC.exe 28 PID 2588 wrote to memory of 1048 2588 76c558e35dabf3bb233dc75b8a57a160_JC.exe 28 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27 PID 1048 wrote to memory of 2588 1048 qlvois.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\76c558e35dabf3bb233dc75b8a57a160_JC.exe"C:\Users\Admin\AppData\Local\Temp\76c558e35dabf3bb233dc75b8a57a160_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\qlvois.exe"C:\Users\Admin\qlvois.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD535e54d0fdd9446c0af852c87aed09b65
SHA1a5d6b79949a851d6d4db35492c187a967de44ff4
SHA2564c44d6e91bdab8dc2a47a43403bb8b8a5906fc5d0245a8277f3bc9029adbd7e1
SHA5128ad3a1f0154d781262ece87af59286fbf1a0992e61e3e46cf6682d60dc4951b52bdd14ef5e5052208c55b6c99148e52364233138a9c3ed37d000b2962fd71f12
-
Filesize
56KB
MD535e54d0fdd9446c0af852c87aed09b65
SHA1a5d6b79949a851d6d4db35492c187a967de44ff4
SHA2564c44d6e91bdab8dc2a47a43403bb8b8a5906fc5d0245a8277f3bc9029adbd7e1
SHA5128ad3a1f0154d781262ece87af59286fbf1a0992e61e3e46cf6682d60dc4951b52bdd14ef5e5052208c55b6c99148e52364233138a9c3ed37d000b2962fd71f12
-
Filesize
56KB
MD535e54d0fdd9446c0af852c87aed09b65
SHA1a5d6b79949a851d6d4db35492c187a967de44ff4
SHA2564c44d6e91bdab8dc2a47a43403bb8b8a5906fc5d0245a8277f3bc9029adbd7e1
SHA5128ad3a1f0154d781262ece87af59286fbf1a0992e61e3e46cf6682d60dc4951b52bdd14ef5e5052208c55b6c99148e52364233138a9c3ed37d000b2962fd71f12
-
Filesize
56KB
MD535e54d0fdd9446c0af852c87aed09b65
SHA1a5d6b79949a851d6d4db35492c187a967de44ff4
SHA2564c44d6e91bdab8dc2a47a43403bb8b8a5906fc5d0245a8277f3bc9029adbd7e1
SHA5128ad3a1f0154d781262ece87af59286fbf1a0992e61e3e46cf6682d60dc4951b52bdd14ef5e5052208c55b6c99148e52364233138a9c3ed37d000b2962fd71f12
-
Filesize
56KB
MD535e54d0fdd9446c0af852c87aed09b65
SHA1a5d6b79949a851d6d4db35492c187a967de44ff4
SHA2564c44d6e91bdab8dc2a47a43403bb8b8a5906fc5d0245a8277f3bc9029adbd7e1
SHA5128ad3a1f0154d781262ece87af59286fbf1a0992e61e3e46cf6682d60dc4951b52bdd14ef5e5052208c55b6c99148e52364233138a9c3ed37d000b2962fd71f12