daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b

Analysis

max time kernel
178s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe
Size

198KB
MD5

e4b4574e3c2e40b9768d6527c485df4e
SHA1

01837305f13918d4aa0f69a1a84c142296076ecb
SHA256

daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b
SHA512

15ac8d3c1a4dcacdca21b1df2b5f49e9d39962913985bf24f070c6d26b1e46249ed77cd246528a541e9453576da079617218f480dd954a7fe414119d86458c76
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOw:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXp

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe

Executes dropped EXE 1 IoCs

pid	Process
8	qcihost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\qcihost.exe	daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe
File opened for modification	C:\Windows\Debug\qcihost.exe	daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qcihost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qcihost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2380	daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3744	2380	daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe	90
PID 2380 wrote to memory of 3744	2380	daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe	90
PID 2380 wrote to memory of 3744	2380	daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe	90

C:\Users\Admin\AppData\Local\Temp\daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe
"C:\Users\Admin\AppData\Local\Temp\daba98a9cd6383b2cc1f808c64b60aeb3d3977632d6e750f712035120f53a44b.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DABA98~1.EXE > nul
  2⤵
  PID:3744

C:\Windows\Debug\qcihost.exe
C:\Windows\Debug\qcihost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\qcihost.exe

Filesize
198KB

MD5
6ff723cd1e812d0e7e0d81cde41b610e

SHA1
a73ef6dde4d47e11dd1b687aadcaa4f53b656739

SHA256
90ca6cfeeef19dc659219c5bcd1dbcb983dfba499f220cba508226cb0b90c518

SHA512
f589f44e47ec08000bed796880f90c960d8185c4db5d7e9e7716f378f2bf4b02377b2ad0e7d66f92fb60ef4ce03fe066f99e72c229f836306f0d3f19ea1eb509

Download Submit
C:\Windows\debug\qcihost.exe

Filesize
198KB

MD5
6ff723cd1e812d0e7e0d81cde41b610e

SHA1
a73ef6dde4d47e11dd1b687aadcaa4f53b656739

SHA256
90ca6cfeeef19dc659219c5bcd1dbcb983dfba499f220cba508226cb0b90c518

SHA512
f589f44e47ec08000bed796880f90c960d8185c4db5d7e9e7716f378f2bf4b02377b2ad0e7d66f92fb60ef4ce03fe066f99e72c229f836306f0d3f19ea1eb509

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads