891a0daa0885b5f75d5c5ce506813069854396b3d61262354218e5676d74a8cf

Analysis

max time kernel
260s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe
Size

356KB
MD5

29472c2abb959e6ff57cc1ad8a1ddac0
SHA1

8d230357fe297538cba4beebe2b0d18c1a0eeff8
SHA256

891a0daa0885b5f75d5c5ce506813069854396b3d61262354218e5676d74a8cf
SHA512

b5a249a95827a6bd0906b7d8e80dba7473b684cbf78b35bc96495102eb3b447a90cab87726dcf39f999627bf6ad06981a09192fe34c85d2962bf7e51015b943f
SSDEEP

6144:zoZRkwFUREpL7+bSttpTi7EAvGRMadlQys3xhd4W94vQDSk4yK4tgLV8ZaUr:zkRkwFUREpL7+ai7EAvGRMYlQBKCWkXj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4608	QTRAYIME.EXE

Loads dropped DLL 1 IoCs

pid	Process
2368	29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qckey32.dll	29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4608	QTRAYIME.EXE
4608	QTRAYIME.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4608	QTRAYIME.EXE
4608	QTRAYIME.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2368	29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4608	2368	29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe	84
PID 2368 wrote to memory of 4608	2368	29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe	84
PID 2368 wrote to memory of 4608	2368	29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe
"C:\Users\Admin\AppData\Local\Temp\29472c2abb959e6ff57cc1ad8a1ddac0_exe32_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\QTRAYIME.EXE
  C:\Users\Admin\AppData\Local\Temp\QTRAYIME.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QTRAYIME.EXE

Filesize
25KB

MD5
7ea8e9d60885d2ba93faa2cbc3624675

SHA1
46176dd4ef29cd259c97d0eac294d8c5e4eb3e40

SHA256
af874742c5fc3a41fa065944e8313825ea19a7bd0d52152d7785f28623429ad3

SHA512
a0e6291ed8b86cf9166f8bf403a7ec15cd98f5649bbe838fb2580cf6c9c9d5579a12ea36ad5cd257714db1f9876ac64829b1238401d429517d0257bdc7aecd33

Download Submit
C:\Users\Admin\AppData\Local\Temp\QTRAYIME.EXE

Filesize
25KB

MD5
7ea8e9d60885d2ba93faa2cbc3624675

SHA1
46176dd4ef29cd259c97d0eac294d8c5e4eb3e40

SHA256
af874742c5fc3a41fa065944e8313825ea19a7bd0d52152d7785f28623429ad3

SHA512
a0e6291ed8b86cf9166f8bf403a7ec15cd98f5649bbe838fb2580cf6c9c9d5579a12ea36ad5cd257714db1f9876ac64829b1238401d429517d0257bdc7aecd33

Download Submit
C:\Users\Admin\AppData\Local\Temp\qtrayime.ini

Filesize
145B

MD5
0f146a7ee3f5e0df3c208aa39caff290

SHA1
d1cd3da7cc6aa3153ece4769c048b22118bfe034

SHA256
f23299c9ca4f37df7a63c76c06faf85a8a7a57cf4334415dbd8251eaeaa1dd1e

SHA512
e8f35d1028e03e39fbf173cfad14813a0c3e5bc2e10926b665cafc9c19554316076282a3c843626b602c9692ead91c7fa6ab8d09d2e76170485f283e827e93d5

Download Submit
C:\Windows\SysWOW64\qckey32.dll

Filesize
24KB

MD5
4fafe78269d8a5a90efc09d9ecd49bc7

SHA1
2de3297e693cf85bf703eac3f32360e42ada9c6b

SHA256
371a686891b1f520514d8b1f635e2d047741d372a5bb2f30a4c6f75d3e5e6301

SHA512
28ec31af35609bfaa604d25797cadf985804923507d320c7b51cd48ad12bf4c0678c8c598d5c078c1afb71c2b8f2ee91b7010cab114f3dc6d7f08109d67bb664

Download Submit
memory/2368-10-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2368-11-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4608-12-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download